Skip to content
This repository has been archived by the owner on Jun 29, 2022. It is now read-only.

Allow user to setup Google Oauth for Grafana #538

Closed
surajssd opened this issue Jun 3, 2020 · 2 comments · Fixed by #541
Closed

Allow user to setup Google Oauth for Grafana #538

surajssd opened this issue Jun 3, 2020 · 2 comments · Fixed by #541
Labels
area/monitoring Monitoring area/security Security related stuff

Comments

@surajssd
Copy link
Member

surajssd commented Jun 3, 2020

This can be done in two ways.

One

One is by providing configs in Prometheus Operator Values file under this section:

grafana:
  grafana.ini:
    server:
      domain: monitoring.example.com
    auth.google:
      enabled: true
      client_secret: newS3cretKey
      ...

src: https://grafana.com/docs/grafana/v6.5/auth/google/

Two

Or this can also be replaced with env var as follows:

export GF_SERVER_DOMAIN=monitoring.example.com
export GF_AUTH_GOOGLE_ENABLED=true
export GF_AUTH_GOOGLE_CLIENT_SECRET=newS3cretKey

All the values under grafana.ini can be replaced with env var in following format: GF_<SectionName>_<KeyName>.

Where the section name is the text within the brackets. Everything should be upper case, . should be replaced by _. As shown above

src: https://grafana.com/docs/grafana/v6.5/installation/configuration/#using-environment-variables

@surajssd surajssd added area/monitoring Monitoring area/security Security related stuff labels Jun 3, 2020
@invidian
Copy link
Member

invidian commented Jun 3, 2020

See also #424. Perhaps we could use environment variables for handling the secrets? Like AKS is doing right now:

  // Environment variables used to load sensitive parts of the configuration.
  clientIDEnv       = "LOKOMOTIVE_AKS_CLIENT_ID"
  clientSecretEnv   = "LOKOMOTIVE_AKS_CLIENT_SECRET" // #nosec G101
  subscriptionIDEnv = "LOKOMOTIVE_AKS_SUBSCRIPTION_ID"
  tenantIDEnv       = "LOKOMOTIVE_AKS_TENANT_ID"`

@surajssd surajssd added the proposed/next-sprint Issues proposed for next sprint label Jun 9, 2020
@surajssd
Copy link
Member Author

So finally it was decided that we expose all the env vars using the hcl variable. We create a secret out of it and then that is exposed into the grafana pod automatically.

@iaguis iaguis removed the proposed/next-sprint Issues proposed for next sprint label Jun 18, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
area/monitoring Monitoring area/security Security related stuff
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants