Skip to content

Commit 08cea33

Browse files
duanhongyiduanhongyi
committed
chore(grafana): add ldap support for grafana
1 parent 182c371 commit 08cea33

11 files changed

Lines changed: 169 additions & 97 deletions

‎charts/monitor/templates/monitor-grafana-deployment.yaml‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ metadata:
66
labels:
77
heritage: drycc
88
annotations:
9-
component.drycc.cc/version: {{ .Values.monitor.grafana.docker_tag }}
9+
component.drycc.cc/version: {{ .Values.grafana.docker_tag }}
1010
spec:
1111
replicas: 1
1212
strategy:
@@ -24,16 +24,16 @@ spec:
2424
spec:
2525
containers:
2626
- name: drycc-monitor-grafana
27-
image: {{.Values.monitor.grafana.docker_registry}}{{.Values.monitor.grafana.org}}/grafana:{{.Values.monitor.grafana.docker_tag}}
28-
imagePullPolicy: {{.Values.monitor.grafana.pull_policy}}
29-
{{- if or (.Values.monitor.grafana.limits_cpu) (.Values.monitor.grafana.limits_memory)}}
27+
image: {{.Values.grafana.docker_registry}}{{.Values.grafana.org}}/grafana:{{.Values.grafana.docker_tag}}
28+
imagePullPolicy: {{.Values.grafana.pull_policy}}
29+
{{- if or (.Values.grafana.limits_cpu) (.Values.grafana.limits_memory)}}
3030
resources:
3131
limits:
32-
{{- if (.Values.monitor.grafana.limits_cpu) }}
33-
cpu: {{.Values.monitor.grafana.limits_cpu}}
32+
{{- if (.Values.grafana.limits_cpu) }}
33+
cpu: {{.Values.grafana.limits_cpu}}
3434
{{- end}}
35-
{{- if (.Values.monitor.grafana.limits_memory) }}
36-
memory: {{.Values.monitor.grafana.limits_memory}}
35+
{{- if (.Values.grafana.limits_memory) }}
36+
memory: {{.Values.grafana.limits_memory}}
3737
{{- end}}
3838
{{- end}}
3939
env:
@@ -65,15 +65,17 @@ spec:
6565
- name: "BIND_PORT"
6666
value: "3500"
6767
- name: "DEFAULT_USER"
68-
value: {{.Values.monitor.grafana.user}}
68+
value: {{.Values.grafana.user}}
6969
- name: "DEFAULT_USER_PASSWORD"
70-
value: {{.Values.monitor.grafana.password}}
71-
- name: "ALLOW_SIGN_UP"
72-
value: {{.Values.monitor.grafana.allow_sign_up | quote}}
70+
value: {{.Values.grafana.password}}
71+
{{- range $key, $value := .Values.grafana.environment }}
72+
- name: {{ $key }}
73+
value: {{ $value | quote }}
74+
{{- end }}
7375
ports:
7476
- containerPort: 3500
7577
name: ui
76-
{{- if .Values.monitor.grafana.persistence.enabled }}
78+
{{- if .Values.grafana.persistence.enabled }}
7779
volumeMounts:
7880
- name: grafana-data
7981
mountPath: /var/lib/grafana

‎charts/monitor/templates/monitor-grafana-pvc.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.monitor.grafana.persistence.enabled }}
1+
{{- if .Values.grafana.persistence.enabled }}
22
kind: PersistentVolumeClaim
33
apiVersion: v1
44
metadata:
@@ -7,18 +7,18 @@ metadata:
77
heritage: drycc
88
spec:
99
accessModes:
10-
- {{ .Values.monitor.grafana.persistence.accessMode | quote }}
10+
- {{ .Values.grafana.persistence.accessMode | quote }}
1111
resources:
1212
requests:
13-
storage: {{ .Values.monitor.grafana.persistence.size | quote }}
14-
{{- if .Values.monitor.grafana.persistence.storageClass }}
15-
{{- if (eq "-" .Values.monitor.grafana.persistence.storageClass) }}
13+
storage: {{ .Values.grafana.persistence.size | quote }}
14+
{{- if .Values.grafana.persistence.storageClass }}
15+
{{- if (eq "-" .Values.grafana.persistence.storageClass) }}
1616
storageClassName: ""
1717
{{- else }}
18-
storageClassName: "{{ .Values.monitor.grafana.persistence.storageClass }}"
18+
storageClassName: "{{ .Values.grafana.persistence.storageClass }}"
1919
{{- end }}
2020
{{- end }}
21-
{{- if .Values.monitor.grafana.persistence.volumeName }}
22-
volumeName: "{{ .Values.monitor.grafana.persistence.volumeName }}"
21+
{{- if .Values.grafana.persistence.volumeName }}
22+
volumeName: "{{ .Values.grafana.persistence.volumeName }}"
2323
{{- end }}
2424
{{- end }}

‎charts/monitor/templates/monitor-influxdb-creds-secret.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ metadata:
77
heritage: drycc
88
type: Opaque
99
data:
10-
url: {{ .Values.monitor.influxdb.url | b64enc }}
11-
database: {{ .Values.monitor.influxdb.database | b64enc }}
12-
user: {{ .Values.monitor.influxdb.user | b64enc }}
13-
password: {{ .Values.monitor.influxdb.password | b64enc }}
10+
url: {{ .Values.influxdb.url | b64enc }}
11+
database: {{ .Values.influxdb.database | b64enc }}
12+
user: {{ .Values.influxdb.user | b64enc }}
13+
password: {{ .Values.influxdb.password | b64enc }}
1414
{{- end }}

‎charts/monitor/templates/monitor-influxdb-deployment.yaml‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ metadata:
66
labels:
77
heritage: drycc
88
annotations:
9-
component.drycc.cc/version: {{ .Values.monitor.influxdb.docker_tag }}
9+
component.drycc.cc/version: {{ .Values.influxdb.docker_tag }}
1010
spec:
1111
replicas: 1
1212
strategy:
@@ -21,16 +21,16 @@ spec:
2121
spec:
2222
containers:
2323
- name: drycc-monitor-influxdb
24-
image: {{.Values.monitor.influxdb.docker_registry}}{{.Values.monitor.influxdb.org}}/influxdb:{{.Values.monitor.influxdb.docker_tag}}
25-
imagePullPolicy: {{.Values.monitor.influxdb.pull_policy}}
26-
{{- if or (.Values.monitor.influxdb.limits_cpu) (.Values.monitor.influxdb.limits_memory)}}
24+
image: {{.Values.influxdb.docker_registry}}{{.Values.influxdb.org}}/influxdb:{{.Values.influxdb.docker_tag}}
25+
imagePullPolicy: {{.Values.influxdb.pull_policy}}
26+
{{- if or (.Values.influxdb.limits_cpu) (.Values.influxdb.limits_memory)}}
2727
resources:
2828
limits:
29-
{{- if (.Values.monitor.influxdb.limits_cpu) }}
30-
cpu: {{.Values.monitor.influxdb.limits_cpu}}
29+
{{- if (.Values.influxdb.limits_cpu) }}
30+
cpu: {{.Values.influxdb.limits_cpu}}
3131
{{- end}}
32-
{{- if (.Values.monitor.influxdb.limits_memory) }}
33-
memory: {{.Values.monitor.influxdb.limits_memory}}
32+
{{- if (.Values.influxdb.limits_memory) }}
33+
memory: {{.Values.influxdb.limits_memory}}
3434
{{- end}}
3535
{{- end}}
3636
ports:
@@ -54,7 +54,7 @@ spec:
5454
port: 8086
5555
initialDelaySeconds: 1
5656
timeoutSeconds: 1
57-
{{- if .Values.monitor.influxdb.persistence.enabled }}
57+
{{- if .Values.influxdb.persistence.enabled }}
5858
volumeMounts:
5959
- name: influxdb-data
6060
mountPath: /data

‎charts/monitor/templates/monitor-influxdb-pvc.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.monitor.influxdb.persistence.enabled }}
1+
{{- if .Values.influxdb.persistence.enabled }}
22
kind: PersistentVolumeClaim
33
apiVersion: v1
44
metadata:
@@ -7,18 +7,18 @@ metadata:
77
heritage: drycc
88
spec:
99
accessModes:
10-
- {{ .Values.monitor.influxdb.persistence.accessMode | quote }}
10+
- {{ .Values.influxdb.persistence.accessMode | quote }}
1111
resources:
1212
requests:
13-
storage: {{ .Values.monitor.influxdb.persistence.size | quote }}
14-
{{- if .Values.monitor.influxdb.persistence.storageClass }}
15-
{{- if (eq "-" .Values.monitor.influxdb.persistence.storageClass) }}
13+
storage: {{ .Values.influxdb.persistence.size | quote }}
14+
{{- if .Values.influxdb.persistence.storageClass }}
15+
{{- if (eq "-" .Values.influxdb.persistence.storageClass) }}
1616
storageClassName: ""
1717
{{- else }}
18-
storageClassName: "{{ .Values.monitor.influxdb.persistence.storageClass }}"
18+
storageClassName: "{{ .Values.influxdb.persistence.storageClass }}"
1919
{{- end }}
2020
{{- end }}
21-
{{- if .Values.monitor.influxdb.persistence.volumeName }}
22-
volumeName: "{{ .Values.monitor.influxdb.persistence.volumeName }}"
21+
{{- if .Values.influxdb.persistence.volumeName }}
22+
volumeName: "{{ .Values.influxdb.persistence.volumeName }}"
2323
{{- end }}
2424
{{- end }}

‎charts/monitor/templates/monitor-telegraf-daemon.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ metadata:
55
labels:
66
heritage: drycc
77
annotations:
8-
component.drycc.cc/version: {{ .Values.monitor.telegraf.docker_tag }}
8+
component.drycc.cc/version: {{ .Values.telegraf.docker_tag }}
99
spec:
1010
selector:
1111
matchLabels:
@@ -22,16 +22,16 @@ spec:
2222
serviceAccount: drycc-monitor-telegraf
2323
containers:
2424
- name: drycc-monitor-telegraf
25-
image: {{.Values.monitor.telegraf.docker_registry}}{{.Values.monitor.telegraf.org}}/telegraf:{{.Values.monitor.telegraf.docker_tag}}
26-
imagePullPolicy: {{.Values.monitor.telegraf.pull_policy}}
27-
{{- if or (.Values.monitor.telegraf.limits_cpu) (.Values.monitor.telegraf.limits_memory)}}
25+
image: {{.Values.telegraf.docker_registry}}{{.Values.telegraf.org}}/telegraf:{{.Values.telegraf.docker_tag}}
26+
imagePullPolicy: {{.Values.telegraf.pull_policy}}
27+
{{- if or (.Values.telegraf.limits_cpu) (.Values.telegraf.limits_memory)}}
2828
resources:
2929
limits:
30-
{{- if (.Values.monitor.telegraf.limits_cpu) }}
31-
cpu: {{.Values.monitor.telegraf.limits_cpu}}
30+
{{- if (.Values.telegraf.limits_cpu) }}
31+
cpu: {{.Values.telegraf.limits_cpu}}
3232
{{- end}}
33-
{{- if (.Values.monitor.telegraf.limits_memory) }}
34-
memory: {{.Values.monitor.telegraf.limits_memory}}
33+
{{- if (.Values.telegraf.limits_memory) }}
34+
memory: {{.Values.telegraf.limits_memory}}
3535
{{- end}}
3636
{{- end}}
3737
env:

‎charts/monitor/templates/monitor-telegraf-deployment.yaml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ metadata:
77
labels:
88
heritage: drycc
99
annotations:
10-
component.drycc.cc/version: {{ .Values.monitor.telegraf.docker_tag }}
10+
component.drycc.cc/version: {{ .Values.telegraf.docker_tag }}
1111
spec:
1212
replicas: 1
1313
selector:
@@ -25,16 +25,16 @@ spec:
2525
serviceAccount: drycc-monitor-telegraf
2626
containers:
2727
- name: drycc-monitor-telegraf
28-
image: {{.Values.monitor.telegraf.docker_registry}}{{.Values.monitor.telegraf.org}}/telegraf:{{.Values.monitor.telegraf.docker_tag}}
29-
imagePullPolicy: {{.Values.monitor.telegraf.pull_policy}}
30-
{{- if or (.Values.monitor.telegraf.limits_cpu) (.Values.monitor.telegraf.limits_memory)}}
28+
image: {{.Values.telegraf.docker_registry}}{{.Values.telegraf.org}}/telegraf:{{.Values.telegraf.docker_tag}}
29+
imagePullPolicy: {{.Values.telegraf.pull_policy}}
30+
{{- if or (.Values.telegraf.limits_cpu) (.Values.telegraf.limits_memory)}}
3131
resources:
3232
limits:
33-
{{- if (.Values.monitor.telegraf.limits_cpu) }}
34-
cpu: {{.Values.monitor.telegraf.limits_cpu}}
33+
{{- if (.Values.telegraf.limits_cpu) }}
34+
cpu: {{.Values.telegraf.limits_cpu}}
3535
{{- end}}
36-
{{- if (.Values.monitor.telegraf.limits_memory) }}
37-
memory: {{.Values.monitor.telegraf.limits_memory}}
36+
{{- if (.Values.telegraf.limits_memory) }}
37+
memory: {{.Values.telegraf.limits_memory}}
3838
{{- end}}
3939
{{- end}}
4040
env:

‎charts/monitor/values.yaml‎

Lines changed: 38 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,41 @@
1-
monitor:
2-
grafana:
3-
org: "drycc"
4-
pull_policy: "Always"
5-
docker_tag: "canary"
6-
docker_registry: ""
7-
allow_sign_up: "true"
8-
# limits_cpu: "100m"
9-
# limits_memory: "50Mi"
10-
persistence:
11-
enabled: false
12-
accessMode: ReadWriteOnce
13-
size: 5Gi
14-
influxdb:
15-
org: "drycc"
16-
pull_policy: "Always"
17-
docker_tag: "canary"
18-
docker_registry: ""
19-
# limits_cpu: "100m"
20-
# limits_memory: "50Mi"
21-
url: "my.influx.url"
22-
database: "kubernetes"
23-
user: "user"
24-
password: "password"
25-
persistence:
26-
enabled: false
27-
accessMode: ReadWriteOnce
28-
size: 20Gi
29-
telegraf:
30-
org: "drycc"
31-
pull_policy: "Always"
32-
docker_tag: "canary"
33-
docker_registry: ""
34-
# limits_cpu: "100m"
35-
# limits_memory: "50Mi"
1+
grafana:
2+
org: "drycc"
3+
pull_policy: "Always"
4+
docker_tag: "canary"
5+
docker_registry: ""
6+
# limits_cpu: "100m"
7+
# limits_memory: "50Mi"
8+
persistence:
9+
enabled: false
10+
accessMode: ReadWriteOnce
11+
size: 5Gi
12+
# Any custom grafana environment variables
13+
# can be specified as key-value pairs under environment
14+
# this is usually a non required setting.
15+
environment:
16+
ALLOW_SIGN_UP: false
17+
influxdb:
18+
org: "drycc"
19+
pull_policy: "Always"
20+
docker_tag: "canary"
21+
docker_registry: ""
22+
# limits_cpu: "100m"
23+
# limits_memory: "50Mi"
24+
url: "my.influx.url"
25+
database: "kubernetes"
26+
user: "user"
27+
password: "password"
28+
persistence:
29+
enabled: false
30+
accessMode: ReadWriteOnce
31+
size: 20Gi
32+
telegraf:
33+
org: "drycc"
34+
pull_policy: "Always"
35+
docker_tag: "canary"
36+
docker_registry: ""
37+
# limits_cpu: "100m"
38+
# limits_memory: "50Mi"
3639

3740
nsqd:
3841
replicas: 1

‎grafana/rootfs/usr/share/grafana/grafana.ini.tpl‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -221,9 +221,9 @@ enabled = {{ default "true" .BASIC_AUTH }}
221221

222222
#################################### Auth LDAP ##########################
223223
[auth.ldap]
224-
{{ if .LDAP_AUTH }}
225-
enabled = {{ .LDAP_AUTH }}
226-
config_file = {{ default "/etc/grafana/ldap.toml" .LDAP_AUTH_CONFIG_FILE }}
224+
{{ if .LDAP_ENDPOINT }}
225+
enabled = true
226+
config_file = "/usr/share/grafana/ldap.toml"
227227
{{ end }}
228228

229229
#################################### SMTP / Emailing ##########################

‎grafana/rootfs/usr/share/grafana/ldap.toml.tpl‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
[[servers]]
2+
# Ldap server host (specify multiple hosts space separated)
3+
host = "{{ .LDAP_HOST }}"
4+
# Default port is 389 or 636 if use_ssl = true
5+
port = {{ .LDAP_PORT }}
6+
# Set to true if LDAP server supports TLS
7+
use_ssl = {{ .LDAP_USE_SSL }}
8+
# Set to true if connect LDAP server with STARTTLS pattern (create connection in insecure, then upgrade to secure connection with TLS)
9+
start_tls = true
10+
# set to true if you want to skip SSL cert validation
11+
ssl_skip_verify = true
12+
13+
# Search user bind dn
14+
bind_dn = "{{ .LDAP_BIND_DN }}"
15+
# Search user bind password
16+
# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
17+
bind_password = "{{ .LDAP_BIND_PASSWORD }}"
18+
19+
# User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)"
20+
# Allow login from email or username, example "(|(sAMAccountName=%s)(userPrincipalName=%s))"
21+
search_filter = "{{ .LDAP_USER_FILTER }}"
22+
23+
# An array of base dns to search through
24+
search_base_dns = ["{{ .LDAP_USER_BASEDN }}"]
25+
26+
# Specify names of the LDAP attributes your LDAP uses
27+
[servers.attributes]
28+
name = "givenName"
29+
surname = "sn"
30+
username = "cn"
31+
member_of = "memberOf"
32+
email = "mail"
33+
34+
[[servers.group_mappings]]
35+
group_dn = "{{ .LDAP_ADMIN_GROUP }}"
36+
org_role = "Admin"
37+
grafana_admin = true # Available in Grafana v5.3 and above
38+
39+
[[servers.group_mappings]]
40+
group_dn = "{{ .LDAP_EDITOR_GROUP }}"
41+
org_role = "Editor"
42+
43+
[[servers.group_mappings]]
44+
group_dn = "{{ .LDAP_VIEWER_GROUP }}"
45+
org_role = "Viewer"

0 commit comments

Comments
 (0)