Skip to content

Commit edaab1c

Browse files
duanhongyiduanhongyi
committed
feat(grafana): add multi-tenant support
1 parent b17ed4e commit edaab1c

40 files changed

Lines changed: 47282 additions & 44896 deletions

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ SHELL := /bin/bash
22

33
# grafana share/use the following targets/exports
44
SHORT_NAME ?= grafana
5-
SHELL_SCRIPTS = rootfs/usr/share/grafana/start-grafana
5+
SHELL_SCRIPTS = rootfs/usr/bin/start-grafana
66

77
BUILD_TAG ?= git-$(shell git rev-parse --short HEAD)
88
DRYCC_REGISTRY ?= ${DEV_REGISTRY}

‎README.md‎

Lines changed: 0 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -13,103 +13,6 @@ We welcome your input! If you have feedback, please [submit an issue][issues]. I
1313

1414
[Grafana](https://grafana.org/) is a graphing application built for time series data. It natively supports prometheus and provides great dashboarding support. This project is focused on provided a grafana installation that can be run within a kubernetes installation. The grafana application is agnostic to [Workflow][Workflow] and can be installed as a stand alone system with the monitoring suite.
1515

16-
## Configuration
17-
18-
| ENV Var | Default Value | Description |
19-
|---------|---------------|-------------|
20-
| <a name="app_mode"></a> [APP_MODE](#app_mode) | development | Has two possible values (production or development). |
21-
| <a name="data_path"></a> [DATA_PATH](#data_path) | /var/lib/grafana | Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used). |
22-
| <a name="log_path"></a> [LOG_PATH](#log_path) | /var/log | Directory where grafana can store logs. |
23-
| <a name="server_protocol"></a> [SERVER_PROTOCOL](#server_protocol) | http | Protocol (http or https). |
24-
| <a name="bind_address"></a> [BIND_ADDRESS](#bind_address) | `""` | The ip address to bind to, empty will bind to all interfaces |
25-
| <a name="bind_port"></a> [BIND_PORT](#bind_port) | 3000 | The http port to use |
26-
| <a name="domain"></a> [DOMAIN](#domain) | localhost | The public facing domain name used to access grafana from a browser |
27-
| <a name="enforce_domain"></a> [ENFORCE_DOMAIN](#enforce_domain) | false | Redirect to correct domain if host header does not match domain. Prevents DNS rebinding attacks |
28-
| <a name="root_url"></a> [ROOT_URL](#root_url) | `"%(protocol)s://%(domain)s:%(http_port)s/"` | The full public facing url |
29-
| <a name="router_logging"></a> [ROUTER_LOGGING](#router_logging) | false | Log web requests |
30-
| <a name="static_root_path"></a> [STATIC_ROOT_PATH](#static_root_path) | public | the path relative working path |
31-
| <a name="enable_gzip"></a> [ENABLE_GZIP](#enable_gzip) | false | enable gzip |
32-
| <a name="cert_file"></a> [CERT_FILE](#cert_file) | no default | https certs |
33-
| <a name="cert_key"></a> [CERT_KEY](#cert_key) | no default | https certs key |
34-
| <a name="database_type"></a> [DATABASE_TYPE](#database_type) | no default | Potential values: mysql, postgres, sqlite3 |
35-
| <a name="database_host"></a> [DATABASE_HOST](#database_host) | no default | Address to external database host |
36-
| <a name="database_name"></a> [DATABASE_NAME](#database_name) | no default | Name of database to store information |
37-
| <a name="database_user"></a> [DATABASE_USER](#database_user) | no default | User to log into the database with |
38-
| <a name="database_password"></a> [DATABASE_PASSWORD](#database_password) | no default | Database password |
39-
| <a name="database_ssl_mode"></a> [DATABASE_SSL_MODE](#database_ssl_mode) | no default | For "postgres" only, either "disable", "require" or "verify-full" |
40-
| <a name="database_path"></a> [DATABASE_PATH](#database_path) | no default | For "sqlite3" only, path relative to data_path setting |
41-
| <a name="session_provider"></a> [SESSION_PROVIDER](#session_provider) | file | Either "memory", "file", "valkey", "mysql", "postgres", default is "file" |
42-
| <a name="session_provider_config"></a> [SESSION_PROVIDER_CONFIG](#session_provider_config) | no default | Provider config options <br>`memory: not have any config yet`<br>`file: session dir path, is relative to grafana data_path`<br>`mysql: user:password@tcp(127.0.0.1:3306)/database_name`<br>`postgres: user=a password=b host=localhost port=5432 dbname=c sslmode=disable` |
43-
| <a name="session_cookie_name"></a> [SESSION_COOKIE_NAME](#session_cookie_name) | grafana_sess | Session cookie name |
44-
| <a name="session_life_time"></a> [SESSION_LIFE_TIME](#session_life_time) | 86400 | Session life time, default is 86400 |
45-
| <a name="grafana_reporting"></a> [GRAFANA_REPORTING](#grafana_reporting) | false | Server reporting, sends usage counters to stats.grafana.org every 24 hours. No ip addresses are being tracked, only simple counters to track running instances, dashboard and error counts. It is very helpful to us. Change this option to false to disable reporting. |
46-
| <a name="google_analytics_ua_id"></a> [GOOGLE_ANALYTICS_UA_ID](#google_analytics_ua_id) | no default | Google Analytics universal tracking code, only enabled if you specify an id here |
47-
| <a name="default_user"></a> [DEFAULT_USER](#default_user) | admin | default admin user, created on startup |
48-
| <a name="default_user_password"></a> [DEFAULT_USER_PASSWORD](#default_user_password) | admin | default admin password, can be changed before first start of grafana, or in profile settings |
49-
| <a name="secret_key"></a> [SECRET_KEY](#secret_key) | SW2YcwTIb9zpOOhoPsMm | used for signing |
50-
| <a name="login_remember_day"></a> [LOGIN_REMEMBER_DAYS](#login_remember_day) | 7 | Auto-login remember days |
51-
| <a name="cookie_username"></a> [COOKIE_USERNAME](#cookie_username) | grafana_user | |
52-
| <a name="cookie_remember_name"></a> [COOKIE_REMEMBER_NAME](#cookie_remember_name) | grafana_remember | |
53-
| <a name="disable_gravatar"></a> [DISABLE_GRAVATAR](#disable_gravatar) | false | disable gravatar profile images |
54-
| <a name="datasource_proxy_whitelist"></a> [DATASOURCE_PROXY_WHITELIST](#datasource_proxy_whitelist) | no default | data source proxy whitelist (ip_or_domain:port seperated by spaces) |
55-
| <a name="allow_sign_up"></a> [ALLOW_SIGN_UP](#allow_sign_up) | true | allow user signup / registration |
56-
| <a name="allow_org_create"></a> [ALLOW_ORG_CREATE](#allow_org_create) | true | Allow non admin users to create organizations |
57-
| <a name="auto_assign_org"></a> [AUTO_ASSIGN_ORG](#auto_assign_org) | true | Set to true to automatically assign new users to the default organization (id 1) |
58-
| <a name="auto_assign_org_role"></a> [AUTO_ASSIGN_ORG_ROLE](#auto_assign_org_role) | Viewer | Default role new users will be automatically assigned (if disabled above is set to true) |
59-
| <a name="login_hint"></a> [LOGIN_HINT](#login_hint) | email or username | Background text for the user field on the login page |
60-
| <a name="anon_access"></a> [ANON_ACCESS](#anon_access) | false | enable anonymous access |
61-
| <a name="org_name"></a> [ORG_NAME](#org_name) | Main Org. | specify organization name that should be used for unauthenticated users |
62-
| <a name="unauthed_user_org_role"></a> [UNAUTHED_USER_ORG_ROLE](#unauthed_user_org_role) | Viewer | specify role for unauthenticated users |
63-
| <a name="github_auth"></a> [GITHUB_AUTH](#github_auth) | no default | Enable Github Auth (true/false) |
64-
| <a name="github_auth_allow_sign_up"></a> [GITHUB_AUTH_ALLOW_SIGN_UP](#github_auth_allow_sign_up) | false | Allow signup with github auth |
65-
| <a name="github_auth_client_id"></a> [GITHUB_AUTH_CLIENT_ID](#github_auth_client_id) | no default | Github Client Auth |
66-
| <a name="github_auth_client_secret"></a> [GITHUB_AUTH_CLIENT_SECRET](#github_auth_client_secret) | no default | Github Auth client secret |
67-
| <a name="github_auth_scopes"></a> [GITHUB_AUTH_SCOPES](#github_auth_scopes) | user:email,read:org | Github Auth Scopes |
68-
| <a name="github_auth_url"></a> [GITHUB_AUTH_URL](#github_auth_url) | https://github.com/login/oauth/authorize | Github authorization URL |
69-
| <a name="github_auth_token_url"></a> [GITHUB_AUTH_TOKEN_URL](#github_auth_token_url) | https://github.com/login/oauth/access_token | Github Auth Token URL |
70-
| <a name="github_auth_api_url"></a> [GITHUB_AUTH_API_URL](#github_auth_api_url) | https://api.github.com/user | Github Auth API URL |
71-
| <a name="github_auth_team_ids"></a> [GITHUB_AUTH_TEAM_IDS](#github_auth_team_ids) | "" | Team IDs to use for Github Auth |
72-
| <a name="github_auth_allowed_orgs"></a> [GITHUB_AUTH_ALLOWED_ORGS](#github_auth_allowed_orgs) | "" | Allowed ORGs for Github Auth |
73-
| <a name="google_auth"></a> [GOOGLE_AUTH](#google_auth) | no default | Enable Google Auth for login (true/false) |
74-
| <a name="google_auth_allow_sign_up"></a> [GOOGLE_AUTH_ALLOW_SIGN_UP](#google_auth_allow_sign_up) | false | Allow people to sign up using Google Auth |
75-
| <a name="google_auth_client_id"></a> [GOOGLE_AUTH_CLIENT_ID](#google_auth_client_id) | no default | Google Auth Client ID |
76-
| <a name="google_auth_client_secret"></a> [GOOGLE_AUTH_CLIENT_SECRET](#google_auth_client_secret) | no default | Google Auth Client Secret |
77-
| <a name="google_auth_scopes"></a> [GOOGLE_AUTH_SCOPES](#google_auth_scopes) | https://www.googleapis.com/auth/userinfo.profile<br> https://www.googleapis.com/auth/userinfo.email | Google Auth Scopes |
78-
| <a name="google_auth_url"></a> [GOOGLE_AUTH_URL](#google_auth_url) | https://accounts.google.com/o/oauth2/auth | Google Auth URL |
79-
| <a name="google_auth_token_url"></a> [GOOGLE_AUTH_TOKEN_URL](#google_auth_token_url) | https://accounts.google.com/o/oauth2/token | Google Auth Token URL |
80-
| <a name="google_auth_api_url"></a> [GOOGLE_AUTH_API_URL](#google_auth_api_url) | https://www.googleapis.com/oauth2/v1/userinfo | Google Auth API URL |
81-
| <a name="google_auth_allowed_domains"></a> [GOOGLE_AUTH_ALLOWED_DOMAINS](#google_auth_allowed_domains) | "" | Google Auth allowed domains |
82-
| <a name="auth_proxy"></a> [AUTH_PROXY](#auth_proxy) | no default | If enabled use an authorization proxy |
83-
| <a name="auth_header_name"></a> [AUTH_HEADER_NAME](#auth_header_name) | X-WEBAUTH-USER | Header to use for authorization |
84-
| <a name="auth_header_property"></a> [AUTH_HEADER_PROPERTY](#auth_header_property) | username | Property to use in Authorization Header |
85-
| <a name="auth_auto_sign_up"></a> [AUTH_AUTO_SIGN_UP](#auth_auto_sign_up) | true | Auto Signup user with data passed from Authorization Header|
86-
| <a name="basic_auth"></a> [BASIC_AUTH](#basic_auth) | true | Enable Basic Auth |
87-
| <a name="ldap_auth"></a> [LDAP_AUTH](#ldap_auth) | no default | Enable LDAP Auth |
88-
| <a name="ldap_auth_config_file"></a> [LDAP_AUTH_CONFIG_FILE](#ldap_auth_config_file) | /etc/grafana/ldap.toml | Config file to use for LDAP Auth |
89-
| <a name="smtp"></a> [SMTP](#smtp) | no default | Enable SMTP/Emailing |
90-
| <a name="smtp_host"></a> [SMTP_HOST](#smtp_host) | no default | SMTP Host |
91-
| <a name="smtp_user"></a> [SMTP_USER](#smtp_user) | no default | User for SMTP |
92-
| <a name="smtp_password"></a> [SMTP_PASSWORD](#smtp_password) | no default | Password for SMTP |
93-
| <a name="smtp_cert_file"></a> [SMTP_CERT_FILE](#smtp_cert_file) | no default | Cert file for SMTP HTTPS |
94-
| <a name="smtp_key_file"></a> [SMTP_KEY_FILE](#smtp_key_file) | no default | Key file for SMTP HTTPS |
95-
| <a name="smtp_skip_verify"></a> [SMTP_SKIP_VERIFY](#smtp_skip_verify) | false | Skip HTTPS verify |
96-
| <a name="smtp_from_address"></a> [SMTP_FROM_ADDRESS](#smtp_from_address) | admin@grafana.localhost | From address to use when sending emails |
97-
| <a name="welcome_email"></a> [WELCOME_EMAIL](#welcome_email) | false | Send welcome email on sign up |
98-
| <a name="log_mode"></a> [LOG_MODE](#log_mode) | console | Either "console", "file", default is "console" Use comma to separate multiple modes, e.g. "console, file" |
99-
| <a name="buffer_length"></a> [BUFFER_LENGTH](#buffer_length) | 10000 | Buffer length of channel, keep it as it is if you don't know what it is. |
100-
| <a name="log_level"></a> [LOG_LEVEL](#log_level) | Info | Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "Trace" |
101-
| <a name="log_level_console"></a> [LOG_LEVEL_CONSOLE](#log_level_console) | Info | For "console" mode only |
102-
| <a name="log_level_file"></a> [LOG_LEVEL_FILE](#log_level_file) | Info | For "file" mode only |
103-
| <a name="log_rotate"></a> [LOG_ROTATE](#log_rotate) | true | This enables automated log rotate(switch of following options), default is true |
104-
| <a name="log_max_lines"></a> [LOG_MAX_LINES](#log_max_lines) | 1000000 | Max line number of single file |
105-
| <a name="log_max_lines_shift"></a> [LOG_MAX_LINES_SHIFT](#log_max_lines_shift) | 28 | Max size shift of single file, default is 28 means 1 << 28, 256MB |
106-
| <a name="log_daily_rotate"></a> [LOG_DAILY_ROTATE](#log_daily_rotate) | true | Segment log daily, default is true |
107-
| <a name="log_max_days"></a> [LOG_MAX_DAYS](#log_max_days) | 7 | Expired days of log file(delete after max days) |
108-
| <a name="dashboard_json"></a> [DASHBOARD_JSON](#dashboard_json) | true | Poll a location for json files that contain dashboards |
109-
| <a name="dashboard_json_path"></a> [DASHBOARD_JSON_PATH](#dashboard_json_path) | /usr/share/grafana/dashboards | Location to scan for json dashboards |
110-
| <a name="plugins_path"></a> [PLUGINS_PATH](#plugins_path) | /var/lib/grafana/plugins | Path to where grafana can install plugins |
111-
| <a name="gf_install_plugins"></a> [GF_INSTALL_PLUGINS](#gf_install_plugins) | no default | Pass the plugins as a comma seperated list |
112-
11316
## Development
11417

11518
The provided `Makefile` has various targets to help support building and publishing new images into a kubernetes cluster.

‎charts/grafana/templates/_helpers.tmpl‎

Lines changed: 63 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,39 @@
11
{{/* Generate grafana envs */}}
22
{{- define "grafana.envs" }}
33
env:
4+
- name: POD_IP
5+
valueFrom:
6+
fieldRef:
7+
fieldPath: status.podIP
48
- name: NAMESPACE
59
valueFrom:
610
fieldRef:
711
fieldPath: metadata.namespace
12+
{{- if .Values.prometheusUrl }}
13+
- name: "PROMETHEUS_URL"
14+
value: "{{ .Values.prometheusUrl }}"
15+
{{- else if .Values.prometheus.enabled }}
16+
- name: "PROMETHEUS_URL"
17+
value: "http://$(DRYCC_CONTROLLER_API_SERVICE_HOST):$(DRYCC_CONTROLLER_API_SERVICE_PORT)/v2/prometheus"
18+
{{- end }}
19+
- name: "VALKEY_LOCATION"
20+
value: {{ ternary "on-cluster" "off-cluster" .Values.valkey.enabled }}
21+
- name: "STORAGE_LOCATION"
22+
value: {{ ternary "on-cluster" "off-cluster" .Values.storage.enabled }}
23+
- name: "DATABASE_LOCATION"
24+
value: {{ ternary "on-cluster" "off-cluster" .Values.database.enabled }}
25+
- name: "PASSPORT_LOCATION"
26+
value: {{ ternary "on-cluster" "off-cluster" .Values.passport.enabled }}
27+
- name: "REGISTRY_LOCATION"
28+
value: {{ ternary "on-cluster" "off-cluster" .Values.registry.enabled }}
29+
- name: "PROMETHEUS_LOCATION"
30+
value: {{ ternary "on-cluster" "off-cluster" .Values.prometheus.enabled }}
31+
- name: "DRYCC_GATEWAY_SCHEME"
32+
{{- if .Values.global.certManagerEnabled }}
33+
value: https
34+
{{- else }}
35+
value: http
36+
{{- end}}
837
- name: GF_DATABASE_TYPE
938
value: postgres
1039
{{- if (.Values.databaseUrl) }}
@@ -24,70 +53,55 @@ env:
2453
- name: GF_DATABASE_URL
2554
value: "postgres://$(GF_DATABASE_USER):$(GF_DATABASE_PASSWORD)@drycc-database.{{.Release.Namespace}}.svc.{{.Values.global.clusterDomain}}:5432/grafana"
2655
{{- end }}
27-
{{- if .Values.prometheusUrl }}
28-
- name: "PROMETHEUS_URL"
29-
value: "{{ .Values.prometheusUrl }}"
30-
{{- else if .Values.prometheus.enabled }}
31-
- name: "PROMETHEUS_URL"
32-
value: "http://drycc-victoriametrics-vmselect.{{$.Release.Namespace}}.svc.{{$.Values.global.clusterDomain}}:8481/select/0/prometheus"
33-
{{- end }}
34-
- name: "BIND_PORT"
35-
value: "3000"
36-
{{- if not (.Values.environment.DEFAULT_USER) }}
37-
- name: "DEFAULT_USER"
56+
{{- if not (.Values.environment.GF_SECURITY_ADMIN_USER) }}
57+
- name: "GF_SECURITY_ADMIN_USER"
3858
value: {{ randAlphaNum 32 }}
3959
{{- end}}
40-
{{- if not (.Values.environment.DEFAULT_USER_PASSWORD) }}
41-
- name: "DEFAULT_USER_PASSWORD"
60+
{{- if not (.Values.environment.GF_SECURITY_ADMIN_PASSWORD) }}
61+
- name: "GF_SECURITY_ADMIN_PASSWORD"
4262
value: {{ randAlphaNum 32 }}
4363
{{- end}}
44-
- name: "KUBERNETES_CLUSTER_DOMAIN"
45-
value: {{.Values.global.clusterDomain}}
46-
{{- range $key, $value := .Values.environment }}
47-
- name: {{ $key }}
48-
value: {{ $value | quote }}
49-
{{- end }}
50-
- name: "DRYCC_GRAFANA_URL"
51-
{{- if .Values.global.certManagerEnabled }}
52-
value: https://drycc-grafana.{{ .Values.global.platformDomain }}
53-
{{- else }}
54-
value: http://drycc-grafana.{{ .Values.global.platformDomain }}
55-
{{- end }}
64+
{{- if not (.Values.environment.GF_SECURITY_SECRET_KEY) }}
65+
- name: "GF_SECURITY_SECRET_KEY"
66+
value: {{ randAlphaNum 32 }}
67+
{{- end}}
68+
- name: "GF_SERVER_ROOT_URL"
69+
value: $(DRYCC_GATEWAY_SCHEME)://drycc-grafana.{{ .Values.global.platformDomain }}
5670
{{- if .Values.passport.enabled}}
57-
- name: "DRYCC_PASSPORT_URL"
58-
{{- if .Values.global.certManagerEnabled }}
59-
value: https://drycc-passport.{{ .Values.global.platformDomain }}
60-
{{- else }}
61-
value: http://drycc-passport.{{ .Values.global.platformDomain }}
62-
{{- end }}
63-
- name: DRYCC_PASSPORT_KEY
71+
- name: GF_AUTH_GENERIC_OAUTH_AUTH_URL
72+
value: $(DRYCC_GATEWAY_SCHEME)://drycc-passport.{{ .Values.global.platformDomain }}/oauth/authorize/
73+
- name: GF_AUTH_GENERIC_OAUTH_TOKEN_URL
74+
value: $(DRYCC_GATEWAY_SCHEME)://drycc-passport.{{ .Values.global.platformDomain }}/oauth/token/
75+
- name: GF_AUTH_GENERIC_OAUTH_API_URL
76+
value: $(DRYCC_GATEWAY_SCHEME)://drycc-passport.{{ .Values.global.platformDomain }}/oauth/userinfo/
77+
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
6478
valueFrom:
6579
secretKeyRef:
6680
name: passport-creds
6781
key: drycc-passport-grafana-key
68-
- name: DRYCC_PASSPORT_SECRET
82+
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
6983
valueFrom:
7084
secretKeyRef:
7185
name: passport-creds
7286
key: drycc-passport-grafana-secret
7387
{{- else }}
74-
- name: DRYCC_PASSPORT_URL
75-
value: "{{ .Values.passportUrl }}"
76-
- name: DRYCC_PASSPORT_KEY
88+
- name: GF_AUTH_GENERIC_OAUTH_AUTH_URL
89+
value: {{ .Values.passportUrl }}/oauth/authorize/
90+
- name: GF_AUTH_GENERIC_OAUTH_TOKEN_URL
91+
value: {{ .Values.passportUrl }}/oauth/token/
92+
- name: GF_AUTH_GENERIC_OAUTH_API_URL
93+
value: {{ .Values.passportUrl }}/oauth/userinfo/
94+
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
7795
value: "{{ .Values.passportKey }}"
78-
- name: DRYCC_PASSPORT_SECRET
96+
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
7997
value: "{{ .Values.passportSecret }}"
8098
{{- end }}
81-
- name: "VALKEY_LOCATION"
82-
value: {{ ternary "on-cluster" "off-cluster" .Values.valkey.enabled }}
83-
- name: "STORAGE_LOCATION"
84-
value: {{ ternary "on-cluster" "off-cluster" .Values.storage.enabled }}
85-
- name: "DATABASE_LOCATION"
86-
value: {{ ternary "on-cluster" "off-cluster" .Values.database.enabled }}
87-
- name: "PASSPORT_LOCATION"
88-
value: {{ ternary "on-cluster" "off-cluster" .Values.passport.enabled }}
89-
- name: "REGISTRY_LOCATION"
90-
value: {{ ternary "on-cluster" "off-cluster" .Values.registry.enabled }}
91-
- name: "PROMETHEUS_LOCATION"
92-
value: {{ ternary "on-cluster" "off-cluster" .Values.prometheus.enabled }}
99+
- name: GF_UNIFIED_ALERTING_HA_PEERS
100+
value: "drycc-grafana.{{.Release.Namespace}}.svc.{{.Values.global.clusterDomain}}:9094"
101+
- name: GF_UNIFIED_ALERTING_HA_ADVERTISE_ADDRESS
102+
value: "$(POD_IP):9094"
103+
{{- range $key, $value := .Values.environment }}
104+
- name: {{ $key }}
105+
value: {{ $value | quote }}
106+
{{- end }}
93107
{{- end }}

0 commit comments

Comments
 (0)