-
Notifications
You must be signed in to change notification settings - Fork 27
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
GrafanaDatasource: support gateway and HTTPS #707
Comments
Hi @andreasgerstmayr, I would like to work on this issue could you please assign it to me? |
Great, I've assigned it to you.
This is already implemented: observatorium/api#575 |
How can we help move this forward? |
Do you use the gateway in static (OIDC) or OpenShift mode? For the static mode it should be straightforward to implement, the operator can create a datasource for each tenant and enable the "Forward OAuth identity" feature in the datasource. Note however, this will only work if you configure OAuth to log in to your Grafana instance. For the OpenShift mode, which ServiceAccount token should be used to access the tenants? Grafana cannot be configured to use the OpenShift OAuth server to login, because the OpenShift OAuth server does not support OIDC. |
Openshift, via the Multitenancy config listed in https://docs.openshift.com/container-platform/4.13/observability/distr_tracing/distr_tracing_tempo/distr-tracing-tempo-configuring.html#distr-tracing-tempo-config-multitenancy_distr-tracing-tempo-configuring - we've deviated from this setup in putting Tempo, Minio and OTLP into a single namespace (openshift-distributed-tracing) and renamed the tenants, but otherwise it's fairly static.
We have a The only things I don't yet know:
What I've also tried was passing |
That'll give everyone who can access Grafana (read) access to all tenants? It does work technically, but I don't think it's great from a security point of view.
For the ingest path I suggest OTEL, described in the link above. In the Grafana Tempo docs there's a page on how to setup the datasource manually: https://grafana.com/docs/tempo/latest/setup/operator/grafana_datasource/#manual-data-source-configuration |
Understood, but that's what we have rbac for ... in Grafana ;-)
Sweet - we now have this working using the GrafanaDatasource with the Tempo Gateway behind an HTTPS endpoint. I'm attaching the GrafanaDatasource in case someone can make good use on OpenShift (while noting the security caveats), maybe we can come up with some better solution in the future ;-) |
Support gateway and HTTPS when creating the GrafanaDatasource:
tempo-operator/internal/manifests/grafana/datasource.go
Lines 34 to 35 in 5a79e61
The text was updated successfully, but these errors were encountered: