mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-06 03:57:52 +09:00
IvanHunters
26e5f06d27
The chart previously injected the two settings the users-Job's
contract depends on — `skip_org_role_sync = true` and
`oauth_allow_insecure_email_lookup = true` — only inside the
`mode: System` branch of `grafana.yaml`. `values.yaml` and
`docs/oidc-grafana.md` both promised the settings would be forced
regardless of mode, but under `mode: CustomConfig` the operator's
inline `auth.generic_oauth` map was written verbatim, both
settings were absent, and the users-Job's role assignments were
silently stranded (no lookup by email → new Grafana account minted
at login) or transiently overwritten (no skip_org_role_sync → any
`role_attribute_path` or Grafana's `auto_assign_org_role: Viewer`
overwrote the Job's role on each login).
Fix: merge a `$chartForcedOidc` dict on top of both the generated
System block and the operator's inline map (`merge` wins for
overlapping keys, so the operator can NOT override the two
settings). CustomConfig secretRef mode cannot receive the merge
because the ini fragment is authoritative — the chart now hard-fails
render when both `customConfig.secretRef.name` and non-empty
`spec.oidc.users` are set, forcing the operator to either switch to
inline config or manage authorization themselves inside the ini.
Also:
- Align the inner HR `timeout` on `packages/extra/monitoring/templates/helmrelease.yaml`
from 10m to 15m so it matches the outer cozyrds
`release.cozystack.io/helm-install-timeout: "15m"` and does not
fail while the users-Job is still inside its
`activeDeadlineSeconds: 900`.
- Route the users-Job image through `cozy-lib.image` so
mirrored / air-gapped installations resolve it (matches the
pattern in `packages/apps/mariadb/templates/hooks/cleanup-pvc.yaml`).
- Add `spec.ttlSecondsAfterFinished: 3600` on the users-Job so a
succeeded Job + Pod are garbage-collected on the next reconcile
interval rather than lingering until the next hook activation
(which never fires on release uninstall).
- Harden the users-Job shell:
* emails read NUL-terminated (`jq --raw-output0`) so an address
containing whitespace cannot corrupt the `for email in ...`
loop's field splitting;
* `/api/users/lookup?loginOrEmail=<email>` URL-encoded via
`jq @uri` so `&`/`=`/`?` in the local part parse correctly on
the Grafana side;
* prune loop switched from pipe-delimited fields to TSV inside
NUL-terminated records, with `cut -f` for extraction.
- Add a template-level assertion (`monitoring.oidc.assertUsersEmailShape`)
rejecting emails that do not match a conservative regex —
cheaper failure mode than a 400 from Grafana.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
168 lines
5.4 KiB
YAML
168 lines
5.4 KiB
YAML
host: ""
|
|
|
|
metricsStorages:
|
|
## Example:
|
|
## metricsStorages:
|
|
## - name: shortterm
|
|
## retentionPeriod: "3d"
|
|
## deduplicationInterval: "15s"
|
|
## storage: 10Gi
|
|
## storageClassName: ""
|
|
## vminsert:
|
|
## minAllowed:
|
|
## cpu: 200m
|
|
## memory: 512Mi
|
|
## maxAllowed:
|
|
## cpu: 1500m
|
|
## memory: 3Gi
|
|
## vmselect:
|
|
## minAllowed:
|
|
## cpu: 300m
|
|
## memory: 1Gi
|
|
## maxAllowed:
|
|
## cpu: 3500m
|
|
## memory: 6Gi
|
|
## vmstorage:
|
|
## minAllowed:
|
|
## cpu: 500m
|
|
## memory: 2Gi
|
|
## maxAllowed:
|
|
## cpu: 4000m
|
|
## memory: 8Gi
|
|
- name: shortterm
|
|
retentionPeriod: "3d"
|
|
deduplicationInterval: "15s"
|
|
storage: 10Gi
|
|
storageClassName: ""
|
|
- name: longterm
|
|
retentionPeriod: "14d"
|
|
deduplicationInterval: "5m"
|
|
storage: 10Gi
|
|
storageClassName: ""
|
|
|
|
logsStorages:
|
|
- name: generic
|
|
retentionPeriod: "1"
|
|
storage: 10Gi
|
|
storageClassName: ""
|
|
alerta:
|
|
storage: 10Gi
|
|
storageClassName: ""
|
|
resources:
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
alerts:
|
|
telegram:
|
|
token: ""
|
|
chatID: ""
|
|
disabledSeverity: []
|
|
slack:
|
|
url: ""
|
|
disabledSeverity: []
|
|
dashboardUrl: ""
|
|
summaryFmt: ""
|
|
grafana:
|
|
db:
|
|
size: 10Gi
|
|
resources:
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
vmagent:
|
|
externalLabels:
|
|
cluster: cozystack
|
|
environment: ""
|
|
remoteWrite:
|
|
urls:
|
|
- http://vminsert-shortterm:8480/insert/0/prometheus
|
|
- http://vminsert-longterm:8480/insert/0/prometheus
|
|
## inlineScrapeConfig: |
|
|
## - job_name: "custom"
|
|
## static_configs:
|
|
## - targets: ["my-service:9090"]
|
|
|
|
## OIDC authentication for the Grafana instance.
|
|
##
|
|
## Identity mode picks the auth source for `[auth.generic_oauth]`:
|
|
## None no OIDC; login form + admin_user/admin_password Secret
|
|
## stay the only auth path (default).
|
|
## System trust the platform `cozy` Keycloak realm via a
|
|
## per-instance confidential client and audience binding.
|
|
## Requires the platform-level authentication.oidc.enabled
|
|
## flag; the chart hard-fails the render otherwise.
|
|
## CustomConfig trust a tenant-supplied issuer directly (BYO IdP).
|
|
## Exactly one of `customConfig.config` (inline) or
|
|
## `customConfig.secretRef.name` (existing Secret) must be
|
|
## set — the chart fails the render otherwise. `cozy` is
|
|
## not in the path in this mode.
|
|
##
|
|
## Authorization is app-side: `users` is reconciled into Grafana org
|
|
## membership/roles by a chart-owned post-install/post-upgrade Job.
|
|
## Users not listed here get nothing when they log in — no default org
|
|
## role from group mapping.
|
|
##
|
|
## The admin_user / admin_password Secret stays a documented break-glass
|
|
## path regardless of mode.
|
|
oidc:
|
|
mode: "None"
|
|
## CustomConfig payload — consumed only when `mode: CustomConfig`.
|
|
## Exactly one of `config` or `secretRef.name` MUST be set.
|
|
customConfig:
|
|
## Inline map of grafana.ini `[auth.generic_oauth]` keys. Any key
|
|
## accepted by Grafana's generic_oauth provider is valid; typical
|
|
## keys are `enabled: "true"`, `client_id`, `client_secret`,
|
|
## `auth_url`, `token_url`, `api_url`, `scopes`. Grafana defaults
|
|
## `enabled: false`, so an inline map without an explicit
|
|
## `enabled: "true"` is inert — remember to set it.
|
|
##
|
|
## The chart merges TWO chart-forced settings on top of this map so
|
|
## the users-Job contract holds:
|
|
## * `skip_org_role_sync: "true"` (login never overwrites the
|
|
## Job's org-role assignments);
|
|
## * `oauth_allow_insecure_email_lookup: "true"` (OIDC identity
|
|
## binds to the pre-provisioned local account by email).
|
|
## These two keys cannot be overridden — set them explicitly here
|
|
## and the chart still wins. `role_attribute_path` would be dead
|
|
## config; the Job manages roles.
|
|
##
|
|
## Mutually exclusive with `customConfig.secretRef.name`.
|
|
config: {}
|
|
## Reference to an operator-managed Secret carrying a ready-made
|
|
## `[auth.generic_oauth]` ini fragment in the `auth.ini` key. The
|
|
## chart mounts it and Grafana loads it via
|
|
## `GF_PATHS_CUSTOM_INI`. Mutually exclusive with
|
|
## `customConfig.config`.
|
|
##
|
|
## IMPORTANT — users-map is NOT supported in this branch: the
|
|
## chart cannot inject `skip_org_role_sync=true` /
|
|
## `oauth_allow_insecure_email_lookup=true` into a Secret-mounted
|
|
## ini fragment, so the users-Job's role assignments would be
|
|
## silently overwritten on the next login. Either use
|
|
## `customConfig.config` (inline) and let the chart merge the two
|
|
## settings, or leave `spec.oidc.users` empty and manage
|
|
## authorization inside the mounted ini fragment yourself. The
|
|
## chart hard-fails render when both `secretRef.name` and non-empty
|
|
## `users` are set.
|
|
secretRef:
|
|
name: ""
|
|
## Users granted access to this Grafana instance's org. Each entry
|
|
## produces one pre-provisioned Grafana account (matched to the OIDC
|
|
## login by `email`) and one org membership + role in the release's
|
|
## `Main Org.`. Empty by default — no OIDC user gets any role until
|
|
## an operator lists them here.
|
|
##
|
|
## Example:
|
|
## users:
|
|
## - email: alice@example.com
|
|
## role: Admin
|
|
## - email: bob@example.com
|
|
## role: Viewer
|
|
users: []
|