[v10.0.x] [feat] docs; update admonition syntax (#68857)
[feat] docs; update admonition syntax (#68842)
* [feat] docs; update admonition syntax
- Standardizes according to style conventions: https://grafana.com/docs/writers-toolkit/style-guide/style-conventions/#admonitions
- Prepares docs for better, uniform admonition style.
* Remove false positives and irregularities
* false positive removal
* Update docs/sources/datasources/mysql/_index.md
* Update docs/sources/developers/angular_deprecation/angular-plugins.md
* fix link errors
* Prettify some nested blockquotes
* remoe unnecessary admonition
(cherry picked from commit 1c4bb9ca00)
Co-authored-by: Matt Dodson <47385188+MattDodsonEnglish@users.noreply.github.com>
This commit is contained in:
Grot (@grafanabot)
co-authored by
Matt Dodson
Matt Dodson
parent
defce65315
commit
1e8c28eff4
@@ -17,7 +17,9 @@ weight: 1800
|
||||
|
||||
If you are running Grafana in a Docker image, then you configure Grafana using [environment variables]({{< relref "./configure-grafana#override-configuration-with-environment-variables" >}}) rather than directly editing the configuration file. If you want to save your data, then you also need to designate persistent storage or bind mounts for the Grafana container.
|
||||
|
||||
> **Note:** These examples use the Grafana Enterprise docker image. You can use the Grafana Open Source edition by changing the docker image to `grafana/grafana-oss`.
|
||||
{{% admonition type="note" %}}
|
||||
These examples use the Grafana Enterprise docker image. You can use the Grafana Open Source edition by changing the docker image to `grafana/grafana-oss`.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Save your Grafana data
|
||||
|
||||
|
||||
@@ -11,7 +11,9 @@ weight: 200
|
||||
|
||||
Grafana has default and custom configuration files. You can customize your Grafana instance by modifying the custom configuration file or by using environment variables. To see the list of settings for a Grafana instance, refer to [View server settings]({{< relref "../../administration/stats-and-license#view-server-settings" >}}).
|
||||
|
||||
> **Note:** After you add custom options, [uncomment](#remove-comments-in-the-ini-files) the relevant sections of the configuration file. Restart Grafana for your changes to take effect.
|
||||
{{% admonition type="note" %}}
|
||||
After you add custom options, [uncomment](#remove-comments-in-the-ini-files) the relevant sections of the configuration file. Restart Grafana for your changes to take effect.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Configuration file location
|
||||
|
||||
@@ -87,7 +89,9 @@ export GF_FEATURE_TOGGLES_ENABLE=newNavigation
|
||||
|
||||
## Variable expansion
|
||||
|
||||
> **Note:** Only available in Grafana 7.1+.
|
||||
{{% admonition type="note" %}}
|
||||
Only available in Grafana 7.1+.
|
||||
{{% /admonition %}}
|
||||
|
||||
If any of your options contains the expression `$__<provider>{<argument>}`
|
||||
or `${<environment variable>}`, then they will be processed by Grafana's
|
||||
@@ -225,9 +229,11 @@ This is the full URL used to access Grafana from a web browser. This is
|
||||
important if you use Google or GitHub OAuth authentication (for the
|
||||
callback URL to be correct).
|
||||
|
||||
> **Note:** This setting is also important if you have a reverse proxy
|
||||
> in front of Grafana that exposes it through a subpath. In that
|
||||
> case add the subpath to the end of this URL setting.
|
||||
{{% admonition type="note" %}}
|
||||
This setting is also important if you have a reverse proxy
|
||||
in front of Grafana that exposes it through a subpath. In that
|
||||
case add the subpath to the end of this URL setting.
|
||||
{{% /admonition %}}
|
||||
|
||||
### serve_from_sub_path
|
||||
|
||||
@@ -278,7 +284,9 @@ Path where the socket should be created when `protocol=socket`. Make sure Grafan
|
||||
|
||||
### cdn_url
|
||||
|
||||
> **Note**: Available in Grafana v7.4 and later versions.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana v7.4 and later versions.
|
||||
{{% /admonition %}}
|
||||
|
||||
Specify a full HTTP URL address to the root of your Grafana CDN assets. Grafana will add edition and version paths.
|
||||
|
||||
@@ -511,7 +519,9 @@ Set to false, disables checking for new versions of Grafana from Grafana's GitHu
|
||||
|
||||
### check_for_plugin_updates
|
||||
|
||||
> **Note**: Available in Grafana v8.5.0 and later versions.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana v8.5.0 and later versions.
|
||||
{{% /admonition %}}
|
||||
|
||||
Set to false disables checking for new versions of installed plugins from https://grafana.com. When enabled, the check for a new plugin runs every 10 minutes. It will notify, via the UI, when a new plugin update exists. The check itself will not prompt any auto-updates of the plugin, nor will it send any sensitive information.
|
||||
|
||||
@@ -733,7 +743,9 @@ As of Grafana v7.3, this also limits the refresh interval options in Explore.
|
||||
|
||||
Path to the default home dashboard. If this value is empty, then Grafana uses StaticRootPath + "dashboards/home.json".
|
||||
|
||||
> **Note:** On Linux, Grafana uses `/usr/share/grafana/public/dashboards/home.json` as the default home dashboard location.
|
||||
{{% admonition type="note" %}}
|
||||
On Linux, Grafana uses `/usr/share/grafana/public/dashboards/home.json` as the default home dashboard location.
|
||||
{{% /admonition %}}
|
||||
|
||||
<hr />
|
||||
|
||||
@@ -874,7 +886,9 @@ URL to redirect the user to after they sign out.
|
||||
|
||||
### oauth_auto_login
|
||||
|
||||
> **Note**: This option is deprecated - use `auto_login` option for specific OAuth provider instead.
|
||||
{{% admonition type="note" %}}
|
||||
This option is deprecated - use `auto_login` option for specific OAuth provider instead.
|
||||
{{% /admonition %}}
|
||||
|
||||
Set to `true` to attempt login with OAuth automatically, skipping the login screen.
|
||||
This setting is ignored if multiple OAuth providers are configured. Default is `false`.
|
||||
@@ -886,13 +900,17 @@ Administrators can increase this if they experience OAuth login state mismatch e
|
||||
|
||||
### oauth_skip_org_role_update_sync
|
||||
|
||||
> **Note**: This option is deprecated in favor of OAuth provider specific `skip_org_role_sync` settings. The following sections explain settings for each provider.
|
||||
{{% admonition type="note" %}}
|
||||
This option is deprecated in favor of OAuth provider specific `skip_org_role_sync` settings. The following sections explain settings for each provider.
|
||||
{{% /admonition %}}
|
||||
|
||||
If you want to change the `oauth_skip_org_role_update_sync` setting to `false`, then for each provider you have set up, use the `skip_org_role_sync` setting to specify whether you want to skip the synchronization.
|
||||
|
||||
> **Warning**: Currently if no organization role mapping is found for a user, Grafana doesn't update the user's organization role.
|
||||
> With Grafana 10, if `oauth_skip_org_role_update_sync` option is set to `false`, users with no mapping will be
|
||||
> reset to the default organization role on every login. [See `auto_assign_org_role` option]({{< relref "#auto_assign_org_role" >}}).
|
||||
{{% admonition type="warning" %}}
|
||||
Currently if no organization role mapping is found for a user, Grafana doesn't update the user's organization role.
|
||||
With Grafana 10, if `oauth_skip_org_role_update_sync` option is set to `false`, users with no mapping will be
|
||||
reset to the default organization role on every login. [See `auto_assign_org_role` option]({{< relref "#auto_assign_org_role" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
### skip_org_role_sync
|
||||
|
||||
@@ -932,7 +950,9 @@ The behavior of `oauth_skip_org_role_update_sync` and `skip_org_role_sync`, can
|
||||
| false | true | User organization role is set to `auto_assign_org_role` and can be changed in Grafana. | true |
|
||||
| true | true | User organization role is set to `auto_assign_org_role` and can be changed in Grafana. | true |
|
||||
|
||||
> **Note:** For GitLab, GitHub, Okta, Generic OAuth providers, Grafana synchronizes organization roles and sets Grafana Admins. The `allow_assign_grafana_admin` setting is also accounted for, to allow or not setting the Grafana Admin role from the external provider.
|
||||
{{% admonition type="note" %}}
|
||||
For GitLab, GitHub, Okta, Generic OAuth providers, Grafana synchronizes organization roles and sets Grafana Admins. The `allow_assign_grafana_admin` setting is also accounted for, to allow or not setting the Grafana Admin role from the external provider.
|
||||
{{% /admonition %}}
|
||||
|
||||
**[auth.github]**
|
||||
| `oauth_skip_org_role_update_sync` | `skip_org_role_sync` | **Resulting Org Role** | Modifiable |
|
||||
@@ -1817,7 +1837,9 @@ keep the default, just leave this empty. You must still provide a `region` value
|
||||
Set this to true to force path-style addressing in S3 requests, i.e., `http://s3.amazonaws.com/BUCKET/KEY`, instead
|
||||
of the default, which is virtual hosted bucket addressing when possible (`http://BUCKET.s3.amazonaws.com/KEY`).
|
||||
|
||||
> **Note:** This option is specific to the Amazon S3 service.
|
||||
{{% admonition type="note" %}}
|
||||
This option is specific to the Amazon S3 service.
|
||||
{{% /admonition %}}
|
||||
|
||||
### bucket_url
|
||||
|
||||
@@ -1929,7 +1951,9 @@ Options to configure a remote HTTP image rendering service, e.g. using https://g
|
||||
|
||||
#### renderer_token
|
||||
|
||||
> **Note**: Available in Grafana v9.1.2 and Image Renderer v3.6.1 or later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana v9.1.2 and Image Renderer v3.6.1 or later.
|
||||
{{% /admonition %}}
|
||||
|
||||
An auth token will be sent to and verified by the renderer. The renderer will deny any request without an auth token matching the one configured on the renderer.
|
||||
|
||||
@@ -1992,7 +2016,9 @@ Enter a comma-separated list of plugin identifiers to hide in the plugin catalog
|
||||
|
||||
### max_connections
|
||||
|
||||
> **Note**: Available in Grafana v8.0 and later versions.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana v8.0 and later versions.
|
||||
{{% /admonition %}}
|
||||
|
||||
The `max_connections` option specifies the maximum number of connections to the Grafana Live WebSocket endpoint per Grafana server instance. Default is `100`.
|
||||
|
||||
@@ -2002,7 +2028,9 @@ Refer to [Grafana Live configuration documentation]({{< relref "../set-up-grafan
|
||||
|
||||
### allowed_origins
|
||||
|
||||
> **Note**: Available in Grafana v8.0.4 and later versions.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana v8.0.4 and later versions.
|
||||
{{% /admonition %}}
|
||||
|
||||
The `allowed_origins` option is a comma-separated list of additional origins (`Origin` header of HTTP Upgrade request during WebSocket connection establishment) that will be accepted by Grafana Live.
|
||||
|
||||
@@ -2019,7 +2047,9 @@ allowed_origins = "https://*.example.com"
|
||||
|
||||
### ha_engine
|
||||
|
||||
> **Note**: Available in Grafana v8.1 and later versions.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana v8.1 and later versions.
|
||||
{{% /admonition %}}
|
||||
|
||||
**Experimental**
|
||||
|
||||
@@ -2029,7 +2059,9 @@ For more information, refer to the [Configure Grafana Live HA setup]({{< relref
|
||||
|
||||
### ha_engine_address
|
||||
|
||||
> **Note**: Available in Grafana v8.1 and later versions.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana v8.1 and later versions.
|
||||
{{% /admonition %}}
|
||||
|
||||
**Experimental**
|
||||
|
||||
@@ -2051,7 +2083,9 @@ Properties described in this section are available for all plugins, but you must
|
||||
|
||||
### tracing
|
||||
|
||||
> **Note**: Available in Grafana v9.5.0 or later, and [OpenTelemetry must be configured as well](#tracingopentelemetry).
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana v9.5.0 or later, and [OpenTelemetry must be configured as well](#tracingopentelemetry).
|
||||
{{% /admonition %}}
|
||||
|
||||
If `true`, propagate the tracing context to the plugin backend and enable tracing (if the backend supports it).
|
||||
|
||||
@@ -2123,7 +2157,9 @@ When rendering_mode = clustered, you can define the maximum number of browser in
|
||||
|
||||
### rendering_clustering_timeout
|
||||
|
||||
> **Note**: Available in grafana-image-renderer v3.3.0 and later versions.
|
||||
{{% admonition type="note" %}}
|
||||
Available in grafana-image-renderer v3.3.0 and later versions.
|
||||
{{% /admonition %}}
|
||||
|
||||
When rendering_mode = clustered, you can specify the duration a rendering request can take before it will time out. Default is `30` seconds.
|
||||
|
||||
@@ -2163,7 +2199,9 @@ Keys of alpha features to enable, separated by space.
|
||||
|
||||
## [date_formats]
|
||||
|
||||
> **Note:** The date format options below are only available in Grafana v7.2+.
|
||||
{{% admonition type="note" %}}
|
||||
The date format options below are only available in Grafana v7.2+.
|
||||
{{% /admonition %}}
|
||||
|
||||
This section controls system-wide defaults for date formats used in time ranges, graphs, and date input boxes.
|
||||
|
||||
@@ -2203,7 +2241,9 @@ Set the default start of the week, valid values are: `saturday`, `sunday`, `mond
|
||||
|
||||
## [expressions]
|
||||
|
||||
> **Note:** This feature is available in Grafana v7.4 and later versions.
|
||||
{{% admonition type="note" %}}
|
||||
This feature is available in Grafana v7.4 and later versions.
|
||||
{{% /admonition %}}
|
||||
|
||||
### enabled
|
||||
|
||||
|
||||
@@ -11,7 +11,9 @@ weight: 300
|
||||
|
||||
Custom branding allows you to replace the Grafana brand and logo with your own corporate brand and logo.
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
{{% admonition type="note" %}}
|
||||
Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
|
||||
Grafana Enterprise has custom branding options in the `grafana.ini` file. As with all configuration options, you can also set them with environment variables.
|
||||
|
||||
@@ -94,7 +96,9 @@ GF_WHITE_LABELING_FOOTER_LINKS_EXTRACUSTOM_TEXT=Custom Text
|
||||
GF_WHITE_LABELING_FOOTER_LINKS_EXTRACUSTOM_URL=http://your.custom.site
|
||||
```
|
||||
|
||||
> **Note:** The following two links are always present in the footer:
|
||||
{{% admonition type="note" %}}
|
||||
The following two links are always present in the footer:
|
||||
{{% /admonition %}}
|
||||
|
||||
- Grafana edition
|
||||
- Grafana version with build number
|
||||
|
||||
@@ -19,7 +19,9 @@ Defaults to `<paths.data>/license.jwt`.
|
||||
|
||||
### license_text
|
||||
|
||||
> **Note:** Available in Grafana Enterprise version 7.4 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana Enterprise version 7.4 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
When set to the text representation (i.e. content of the license file)
|
||||
of the license, Grafana will evaluate and apply the given license to
|
||||
@@ -27,7 +29,9 @@ the instance.
|
||||
|
||||
### auto_refresh_license
|
||||
|
||||
> **Note:** Available in Grafana Enterprise version 7.4 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana Enterprise version 7.4 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
When enabled, Grafana will send the license and usage statistics to
|
||||
the license issuer. If the license has been updated on the issuer's
|
||||
@@ -37,7 +41,9 @@ automatically. Defaults to `true`.
|
||||
|
||||
### license_validation_type
|
||||
|
||||
> **Note:** Available in Grafana Enterprise version 8.3 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana Enterprise version 8.3 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
When set to `aws`, Grafana will validate its license status with Amazon Web Services (AWS) instead of with Grafana Labs. Only use this setting if you purchased an Enterprise license from AWS Marketplace. Defaults to empty, which means that by default Grafana Enterprise will validate using a license issued by Grafana Labs. For details about licenses issued by AWS, refer to [Activate a Grafana Enterprise license purchased through AWS Marketplace]({{< relref "../../../administration/enterprise-licensing/activate-aws-marketplace-license" >}}).
|
||||
|
||||
@@ -342,7 +348,9 @@ New duration for renewed tokens. Vault may be configured to ignore this value an
|
||||
|
||||
## [security.egress]
|
||||
|
||||
> **Note:** Available in Grafana Enterprise version 7.4 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana Enterprise version 7.4 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
Security egress makes it possible to control outgoing traffic from the Grafana server.
|
||||
|
||||
@@ -370,7 +378,9 @@ Encryption algorithm used to encrypt secrets stored in the database and cookies.
|
||||
|
||||
## [caching]
|
||||
|
||||
> **Note:** Available in Grafana Enterprise version 7.5 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana Enterprise version 7.5 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
When query caching is enabled, Grafana can temporarily store the results of data source queries and serve cached responses to similar requests.
|
||||
|
||||
@@ -386,7 +396,9 @@ Setting 'enabled' to `true` allows users to configure query caching for data sou
|
||||
|
||||
This value is `true` by default.
|
||||
|
||||
> **Note:** This setting enables the caching feature, but it does not turn on query caching for any data source. To turn on query caching for a data source, update the setting on the data source configuration page. For more information, refer to the [query caching docs]({{< relref "../../../administration/data-source-management#enable-and-configure-query-caching" >}}).
|
||||
{{% admonition type="note" %}}
|
||||
This setting enables the caching feature, but it does not turn on query caching for any data source. To turn on query caching for a data source, update the setting on the data source configuration page. For more information, refer to the [query caching docs]({{< relref "../../../administration/data-source-management#enable-and-configure-query-caching" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
### ttl
|
||||
|
||||
@@ -398,7 +410,9 @@ The max duration that a query result is stored in the caching system before it i
|
||||
|
||||
The default is `0s` (disabled).
|
||||
|
||||
> **Note:** Disabling this constraint is not recommended in production environments.
|
||||
{{% admonition type="note" %}}
|
||||
Disabling this constraint is not recommended in production environments.
|
||||
{{% /admonition %}}
|
||||
|
||||
### max_value_mb
|
||||
|
||||
@@ -418,7 +432,9 @@ This setting defines the duration to wait for the caching backend to return a ca
|
||||
|
||||
The default is `0s` (disabled).
|
||||
|
||||
> **Note:** Disabling this timeout is not recommended in production environments.
|
||||
{{% admonition type="note" %}}
|
||||
Disabling this timeout is not recommended in production environments.
|
||||
{{% /admonition %}}
|
||||
|
||||
### write_timeout
|
||||
|
||||
@@ -426,7 +442,9 @@ This setting defines the number of seconds to wait for the caching backend to st
|
||||
|
||||
The default is `0s` (disabled).
|
||||
|
||||
> **Note:** Disabling this timeout is not recommended in production environments.
|
||||
{{% admonition type="note" %}}
|
||||
Disabling this timeout is not recommended in production environments.
|
||||
{{% /admonition %}}
|
||||
|
||||
## [caching.encryption]
|
||||
|
||||
@@ -458,7 +476,9 @@ To disable the maximum, set this value to `0`.
|
||||
|
||||
The default is `25`.
|
||||
|
||||
> **Note:** Disabling the maximum is not recommended in production environments.
|
||||
{{% admonition type="note" %}}
|
||||
Disabling the maximum is not recommended in production environments.
|
||||
{{% /admonition %}}
|
||||
|
||||
## [caching.redis]
|
||||
|
||||
@@ -473,9 +493,13 @@ The default is `"redis://localhost:6379"`.
|
||||
A comma-separated list of Redis cluster members, either in `host:port` format or using the full Redis URLs (`redis://username:password@localhost:6379`). For example, `localhost:7000, localhost: 7001, localhost:7002`.
|
||||
If you use the full Redis URLs, then you can specify the scheme, username, and password only once. For example, `redis://username:password@localhost:0000,localhost:1111,localhost:2222`. You cannot specify a different username and password for each URL.
|
||||
|
||||
> **Note:** If you have specify `cluster`, the value for `url` is ignored.
|
||||
{{% admonition type="note" %}}
|
||||
If you have specify `cluster`, the value for `url` is ignored.
|
||||
{{% /admonition %}}
|
||||
|
||||
> **Note:** You can enable TLS for cluster mode using the `redis` scheme in Grafana Enterprise v8.5 and later versions.
|
||||
{{% admonition type="note" %}}
|
||||
You can enable TLS for cluster mode using the `redis` scheme in Grafana Enterprise v8.5 and later versions.
|
||||
{{% /admonition %}}
|
||||
|
||||
### prefix
|
||||
|
||||
|
||||
@@ -12,7 +12,9 @@ weight: 500
|
||||
|
||||
# Settings updates at runtime
|
||||
|
||||
> **Note:** Available in Grafana Enterprise version 8.0 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana Enterprise version 8.0 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
By updating settings at runtime, you can update Grafana settings without needing to restart the Grafana server.
|
||||
|
||||
|
||||
@@ -21,7 +21,9 @@ You can configure Grafana to only allow certain IP addresses or hostnames to be
|
||||
|
||||
The request security configuration option allows users to limit requests from the Grafana server. It targets requests that are generated by users. For more information, refer to [Request security]({{< relref "./configure-request-security" >}}).
|
||||
|
||||
> **Note:** Request security is available in Grafana Enterprise v7.4 and later versions.
|
||||
{{% admonition type="note" %}}
|
||||
Request security is available in Grafana Enterprise v7.4 and later versions.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Firewall rules
|
||||
|
||||
|
||||
@@ -21,7 +21,9 @@ Auditing allows you to track important changes to your Grafana instance. By defa
|
||||
|
||||
Only API requests or UI actions that trigger an API request generate an audit log.
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../introduction/grafana-enterprise" >}}) version 7.3 and later, and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
{{% admonition type="note" %}}
|
||||
Available in [Grafana Enterprise]({{< relref "../../introduction/grafana-enterprise" >}}) version 7.3 and later, and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
|
||||
## Audit logs
|
||||
|
||||
@@ -367,7 +369,9 @@ Furthermore, you can also record `GET` requests. See below how to configure it.
|
||||
|
||||
## Configuration
|
||||
|
||||
> **Note:** The auditing feature is disabled by default.
|
||||
{{% admonition type="note" %}}
|
||||
The auditing feature is disabled by default.
|
||||
{{% /admonition %}}
|
||||
|
||||
Audit logs can be saved into files, sent to a Loki instance or sent to the Grafana default logger. By default, only the file exporter is enabled.
|
||||
You can choose which exporter to use in the [configuration file]({{< relref "../configure-grafana" >}}).
|
||||
@@ -414,7 +418,9 @@ max_file_size_mb = 256
|
||||
|
||||
Audit logs are sent to a [Loki](/oss/loki/) service, through HTTP or gRPC.
|
||||
|
||||
> **Note:** The HTTP option for the Loki exporter is available only in Grafana Enterprise version 7.4 and later.
|
||||
{{% admonition type="note" %}}
|
||||
The HTTP option for the Loki exporter is available only in Grafana Enterprise version 7.4 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
```ini
|
||||
[auditing.logs.loki]
|
||||
|
||||
@@ -158,7 +158,9 @@ signout_redirect_url =
|
||||
|
||||
### Protected roles
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced]({{< relref "../../../introduction/grafana-cloud" >}}).
|
||||
{{% admonition type="note" %}}
|
||||
Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced]({{< relref "../../../introduction/grafana-cloud" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
By default, after you configure an authorization provider, Grafana will adopt existing users into the new authentication scheme. For example, if you have created a user with basic authentication having the login `jsmith@example.com`, then set up SAML authentication where `jsmith@example.com` is an account, the user's authentication type will be changed to SAML if they perform a SAML sign-in.
|
||||
|
||||
|
||||
+11
-7
@@ -272,19 +272,23 @@ Grafana checks for the presence of a role using the [JMESPath](http://jmespath.o
|
||||
|
||||
For more information, refer to the [JMESPath examples](#jmespath-examples).
|
||||
|
||||
> **Warning**: Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
> update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
> enable the `skip_org_role_sync` option.
|
||||
> See [Configure Grafana]({{< relref "../../../configure-grafana#authgeneric_oauth" >}}) for more information.
|
||||
{{% admonition type="warning" %}}
|
||||
Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
enable the `skip_org_role_sync` option.
|
||||
See [Configure Grafana]({{< relref "../../../configure-grafana#authgeneric_oauth" >}}) for more information.
|
||||
{{% /admonition %}}
|
||||
|
||||
On first login, if the`role_attribute_path` property does not return a role, then the user is assigned the role
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
You can disable this default role assignment by setting `role_attribute_strict = true`.
|
||||
It denies user access if no role or an invalid role is returned.
|
||||
|
||||
> **Warning**: With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
> then the user is assigned the role specified by
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
{{% admonition type="warning" %}}
|
||||
With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
then the user is assigned the role specified by
|
||||
[the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
### JMESPath examples
|
||||
|
||||
|
||||
+11
-7
@@ -132,19 +132,23 @@ For the path lookup, Grafana uses JSON obtained from querying GitHub's API [`/ap
|
||||
|
||||
The result of evaluating the `role_attribute_path` JMESPath expression must be a valid Grafana role, for example, `Viewer`, `Editor` or `Admin`. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../../administration/roles-and-permissions" >}}).
|
||||
|
||||
> **Warning**: Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
> update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
> enable the `skip_org_role_sync` option in the [auth.github] section.
|
||||
> See [Configure Grafana]({{< relref "../../../configure-grafana#authgithub" >}}) for more information.
|
||||
{{% admonition type="warning" %}}
|
||||
Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
enable the `skip_org_role_sync` option in the [auth.github] section.
|
||||
See [Configure Grafana]({{< relref "../../../configure-grafana#authgithub" >}}) for more information.
|
||||
{{% /admonition %}}
|
||||
|
||||
On first login, if the`role_attribute_path` property does not return a role, then the user is assigned the role
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
You can disable this default role assignment by setting `role_attribute_strict = true`.
|
||||
It denies user access if no role or an invalid role is returned.
|
||||
|
||||
> **Warning**: With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
> then the user is assigned the role specified by
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
{{% admonition type="warning" %}}
|
||||
With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
then the user is assigned the role specified by
|
||||
[the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
An example Query could look like the following:
|
||||
|
||||
|
||||
+11
-7
@@ -157,19 +157,23 @@ You can use GitLab OAuth to map roles. During mapping, Grafana checks for the pr
|
||||
|
||||
For the path lookup, Grafana uses JSON obtained from querying GitLab's API [`/api/v4/user`](https://docs.gitlab.com/ee/api/users.html#list-current-user-for-normal-users) endpoint and a `groups` key containing all of the user's teams. The result of evaluating the `role_attribute_path` JMESPath expression must be a valid Grafana role, for example, `Viewer`, `Editor` or `Admin`. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../../administration/roles-and-permissions" >}}).
|
||||
|
||||
> **Warning**: Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
> update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
> enable the `skip_org_role_sync` option.
|
||||
> See [Configure Grafana]({{< relref "../../../configure-grafana#authgitlab" >}}) for more information.
|
||||
{{% admonition type="warning" %}}
|
||||
Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
enable the `skip_org_role_sync` option.
|
||||
See [Configure Grafana]({{< relref "../../../configure-grafana#authgitlab" >}}) for more information.
|
||||
{{% /admonition %}}
|
||||
|
||||
On first login, if the`role_attribute_path` property does not return a role, then the user is assigned the role
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
You can disable this default role assignment by setting `role_attribute_strict = true`.
|
||||
It denies user access if no role or an invalid role is returned.
|
||||
|
||||
> **Warning**: With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
> then the user is assigned the role specified by
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
{{% admonition type="warning" %}}
|
||||
With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
then the user is assigned the role specified by
|
||||
[the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
An example Query could look like the following:
|
||||
|
||||
|
||||
+3
-1
@@ -125,7 +125,9 @@ signout_redirect_url =
|
||||
|
||||
### Protected roles
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced]({{< relref "../../../../introduction/grafana-cloud" >}}).
|
||||
{{% admonition type="note" %}}
|
||||
Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced]({{< relref "../../../../introduction/grafana-cloud" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
By default, after you configure an authorization provider, Grafana will adopt existing users into the new authentication scheme. For example, if you have created a user with basic authentication having the login `jsmith@example.com`, then set up SAML authentication where `jsmith@example.com` is an account, the user's authentication type will be changed to SAML if they perform a SAML sign-in.
|
||||
|
||||
|
||||
+11
-5
@@ -61,14 +61,18 @@ If `auto_sign_up` is enabled, then the `sub` claim is used as the "external Auth
|
||||
If you want to embed Grafana in an iframe while maintaning user identity and role checks,
|
||||
you can use JWT authentication to authenticate the iframe.
|
||||
|
||||
> **Note**: For Grafana Cloud, or scenarios where verifying viewer identity is not required,
|
||||
> embed [public dashboards]({{< relref "../../../../dashboards/dashboard-public" >}}).
|
||||
{{% admonition type="note" %}}
|
||||
For Grafana Cloud, or scenarios where verifying viewer identity is not required,
|
||||
embed [public dashboards]({{< relref "../../../../dashboards/dashboard-public" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
In this scenario, you will need to configure Grafana to accept a JWT
|
||||
provided in the HTTP header and a reverse proxy should rewrite requests to the
|
||||
Grafana instance to include the JWT in the request's headers.
|
||||
|
||||
> **Note**: For embedding to work, you must enable `allow_embedding` in the [security section]({{< relref "../../../configure-grafana#allow_embedding" >}}). This setting is not available in Grafana Cloud.
|
||||
{{% admonition type="note" %}}
|
||||
For embedding to work, you must enable `allow_embedding` in the [security section]({{< relref "../../../configure-grafana#allow_embedding" >}}). This setting is not available in Grafana Cloud.
|
||||
{{% /admonition %}}
|
||||
|
||||
In a scenario where it is not possible to rewrite the request headers you
|
||||
can use URL login instead.
|
||||
@@ -91,8 +95,10 @@ skip_org_role_sync = true
|
||||
|
||||
**Note**: You need to have enabled JWT before setting this setting see section Enabled JWT
|
||||
|
||||
> **Warning**: this can lead to JWTs being exposed in logs and possible session hijacking if the server is not
|
||||
> using HTTP over TLS.
|
||||
{{% admonition type="warning" %}}
|
||||
this can lead to JWTs being exposed in logs and possible session hijacking if the server is not
|
||||
using HTTP over TLS.
|
||||
{{% /admonition %}}
|
||||
|
||||
```ini
|
||||
# [auth.jwt]
|
||||
|
||||
+10
-4
@@ -43,8 +43,10 @@ role_attribute_path = contains(roles[*], 'admin') && 'Admin' || contains(roles[*
|
||||
As an example, `<PROVIDER_DOMAIN>` can be `keycloak-demo.grafana.org`
|
||||
and `<REALM_NAME>` can be `grafana`.
|
||||
|
||||
> **Note**: api_url is not required if the id_token contains all the necessary user information and can add latency to the login process.
|
||||
> It is useful as a fallback or if the user has more than 150 group memberships.
|
||||
{{% admonition type="note" %}}
|
||||
api_url is not required if the id_token contains all the necessary user information and can add latency to the login process.
|
||||
It is useful as a fallback or if the user has more than 150 group memberships.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Keycloak configuration
|
||||
|
||||
@@ -75,7 +77,9 @@ profile
|
||||
roles
|
||||
```
|
||||
|
||||
> **Warning**: these scopes do not add group claims to the id_token. Without group claims, teamsync will not work. Teamsync is covered further down in this document.
|
||||
{{% admonition type="warning" %}}
|
||||
these scopes do not add group claims to the id_token. Without group claims, teamsync will not work. Teamsync is covered further down in this document.
|
||||
{{% /admonition %}}
|
||||
|
||||
3. For role mapping to work with the example configuration above,
|
||||
you need to create the following roles and assign them to users:
|
||||
@@ -88,7 +92,9 @@ viewer
|
||||
|
||||
## Teamsync
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud/).
|
||||
{{% admonition type="note" %}}
|
||||
Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud/).
|
||||
{{% /admonition %}}
|
||||
|
||||
[Teamsync]({{< relref "../../configure-team-sync" >}}) is a feature that allows you to map groups from your identity provider to Grafana teams. This is useful if you want to give your users access to specific dashboards or folders based on their group membership.
|
||||
|
||||
|
||||
+11
-7
@@ -93,19 +93,23 @@ Grafana can attempt to do role mapping through Okta OAuth. In order to achieve t
|
||||
|
||||
Grafana uses JSON obtained from querying the `/userinfo` endpoint for the path lookup. The result after evaluating the `role_attribute_path` JMESPath expression needs to be a valid Grafana role, i.e. `Viewer`, `Editor` or `Admin`. For more information about roles and permissions in Grafana, refer to [Roles and permissions]({{< relref "../../../../administration/roles-and-permissions" >}}).
|
||||
|
||||
> **Warning**: Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
> update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
> enable the `skip_org_role_sync` option.
|
||||
> See [Configure Grafana]({{< relref "../../../configure-grafana#authokta" >}}) for more information.
|
||||
{{% admonition type="warning" %}}
|
||||
Currently if no organization role mapping is found for a user, Grafana doesn't
|
||||
update the user's organization role. This is going to change in Grafana 10. To avoid overriding manually set roles,
|
||||
enable the `skip_org_role_sync` option.
|
||||
See [Configure Grafana]({{< relref "../../../configure-grafana#authokta" >}}) for more information.
|
||||
{{% /admonition %}}
|
||||
|
||||
On first login, if the`role_attribute_path` property does not return a role, then the user is assigned the role
|
||||
specified by [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
You can disable this default role assignment by setting `role_attribute_strict = true`.
|
||||
It denies user access if no role or an invalid role is returned.
|
||||
|
||||
> **Warning**: With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
> then the user is assigned the role specified by
|
||||
> [the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
{{% admonition type="warning" %}}
|
||||
With Grafana 10, **on every login**, if the`role_attribute_path` property does not return a role,
|
||||
then the user is assigned the role specified by
|
||||
[the `auto_assign_org_role` option]({{< relref "../../../configure-grafana#auto_assign_org_role" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
Read about how to [add custom claims](https://developer.okta.com/docs/guides/customize-tokens-returned-from-okta/add-custom-claim/) to the user info in Okta. Also, check Generic OAuth page for [JMESPath examples]({{< relref "../generic-oauth#jmespath-examples" >}}).
|
||||
|
||||
|
||||
+9
-3
@@ -7,7 +7,9 @@ weight: 1150
|
||||
|
||||
# Configure SAML authentication using the Grafana user interface
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) version 10.0 and later, and [Grafana Cloud Pro and Advanced](/docs/grafana-cloud/).
|
||||
{{% admonition type="note" %}}
|
||||
Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) version 10.0 and later, and [Grafana Cloud Pro and Advanced](/docs/grafana-cloud/).
|
||||
{{% /admonition %}}
|
||||
|
||||
You can configure SAML authentication in Grafana through the user interface (UI) or the Grafana configuration file. For instructions on how to set up SAML using the Grafana configuration file, refer to [Configure SAML authentication using the configuration file]({{< relref "../saml" >}}).
|
||||
|
||||
@@ -18,9 +20,13 @@ The Grafana SAML UI provides the following advantages over configuring SAML in t
|
||||
- It doesn't require Grafana to be restarted after a configuration update
|
||||
- Access to the SAML UI only requires access to authentication settings, so it can be used by users with limited access to Grafana's configuration
|
||||
|
||||
> **Note:** Any configuration changes made through the Grafana user interface (UI) will take precedence over settings specified in the Grafana configuration file or through environment variables. This means that if you modify any configuration settings in the UI, they will override any corresponding settings set via environment variables or defined in the configuration file. For more information on how Grafana determines the order of precedence for its settings, please refer to the [Settings update at runtime]({{< relref "../../../configure-grafana/settings-updates-at-runtime" >}}).
|
||||
{{% admonition type="note" %}}
|
||||
Any configuration changes made through the Grafana user interface (UI) will take precedence over settings specified in the Grafana configuration file or through environment variables. This means that if you modify any configuration settings in the UI, they will override any corresponding settings set via environment variables or defined in the configuration file. For more information on how Grafana determines the order of precedence for its settings, please refer to the [Settings update at runtime]({{< relref "../../../configure-grafana/settings-updates-at-runtime" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
> **Note:** Disabling the UI does not affect any configuration settings that were previously set up through the UI. Those settings will continue to function as intended even with the UI disabled.
|
||||
{{% admonition type="note" %}}
|
||||
Disabling the UI does not affect any configuration settings that were previously set up through the UI. Those settings will continue to function as intended even with the UI disabled.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Before you begin
|
||||
|
||||
|
||||
+39
-13
@@ -20,14 +20,18 @@ weight: 1100
|
||||
|
||||
# Configure SAML authentication using the configuration file
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Pro and Advanced](/docs/grafana-cloud).
|
||||
{{% admonition type="note" %}}
|
||||
Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Pro and Advanced](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
|
||||
SAML authentication integration allows your Grafana users to log in by using an external SAML 2.0 Identity Provider (IdP). To enable this, Grafana becomes a Service Provider (SP) in the authentication flow, interacting with the IdP to exchange user information.
|
||||
|
||||
You can configure SAML authentication in Grafana through the user interface (UI) or the Grafana configuration file. For instructions on how to set up SAML through Grafana's UI, refer to [Configure SAML authentication using the Grafana user interface]({{< relref "../saml-ui" >}}).
|
||||
Both methods offer the same configuration options, but you might prefer using the Grafana configuration file if you want to keep all of Grafana's authentication settings in one place. Grafana Cloud users do not have access to Grafana configuration file, so they should configure SAML through Grafana's UI.
|
||||
|
||||
> **Note:** Configuration in the UI takes precedence over the configuration in the Grafana configuration file. SAML settings from the UI will override any SAML configuration set in the Grafana configuration file.
|
||||
{{% admonition type="note" %}}
|
||||
Configuration in the UI takes precedence over the configuration in the Grafana configuration file. SAML settings from the UI will override any SAML configuration set in the Grafana configuration file.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Supported SAML
|
||||
|
||||
@@ -99,7 +103,9 @@ Grafana supports two ways of specifying both the `certificate` and `private_key`
|
||||
- Without a suffix (`certificate` or `private_key`), the configuration assumes you've supplied the base64-encoded file contents.
|
||||
- With the `_path` suffix (`certificate_path` or `private_key_path`), then Grafana treats the value entered as a file path and attempts to read the file from the file system.
|
||||
|
||||
> **Note:** You can only use one form of each configuration option. Using multiple forms, such as both `certificate` and `certificate_path`, results in an error.
|
||||
{{% admonition type="note" %}}
|
||||
You can only use one form of each configuration option. Using multiple forms, such as both `certificate` and `certificate_path`, results in an error.
|
||||
{{% /admonition %}}
|
||||
|
||||
---
|
||||
|
||||
@@ -201,7 +207,9 @@ The table below describes all SAML configuration options. Continue reading below
|
||||
|
||||
### Signature algorithm
|
||||
|
||||
> **Note:** Available in Grafana version 7.3 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana version 7.3 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
The SAML standard recommends using a digital signature for some types of messages, like authentication or logout requests. If the `signature_algorithm` option is configured, Grafana will put a digital signature into SAML requests. Supported signature types are `rsa-sha1`, `rsa-sha256`, `rsa-sha512`. This option should match your IdP configuration, otherwise, signature validation will fail. Grafana uses key and certificate configured with `private_key` and `certificate` options for signing SAML requests.
|
||||
|
||||
@@ -251,7 +259,9 @@ The integration provides two key endpoints as part of Grafana:
|
||||
|
||||
### IdP-initiated Single Sign-On (SSO)
|
||||
|
||||
> **Note:** Available in Grafana version 7.3 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana version 7.3 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
By default, Grafana allows only service provider (SP) initiated logins (when the user logs in with SAML via Grafana’s login page). If you want users to log in into Grafana directly from your identity provider (IdP), set the `allow_idp_initiated` configuration option to `true` and configure `relay_state` with the same value specified in the IdP configuration.
|
||||
|
||||
@@ -259,7 +269,9 @@ IdP-initiated SSO has some security risks, so make sure you understand the risks
|
||||
|
||||
### Single logout
|
||||
|
||||
> **Note:** Available in Grafana version 7.3 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana version 7.3 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
SAML's single logout feature allows users to log out from all applications associated with the current IdP session established via SAML SSO. If the `single_logout` option is set to `true` and a user logs out, Grafana requests IdP to end the user session which in turn triggers logout from all other applications the user is logged into using the same IdP session (applications should support single logout). Conversely, if another application connected to the same IdP logs out using single logout, Grafana receives a logout request from IdP and ends the user session.
|
||||
|
||||
@@ -305,11 +317,15 @@ auto_login = true
|
||||
|
||||
### Configure team sync
|
||||
|
||||
> **Note:** Team sync support for SAML is available in Grafana version 7.0 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Team sync support for SAML is available in Grafana version 7.0 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
To use SAML Team sync, set [`assertion_attribute_groups`]({{< relref "../../../configure-grafana/enterprise-configuration#assertion_attribute_groups" >}}) to the attribute name where you store user groups. Then Grafana will use attribute values extracted from SAML assertion to add user into the groups with the same name configured on the External group sync tab.
|
||||
|
||||
> **Note:** Teamsync allows you sync users from SAML to Grafana teams. It does not automatically create teams in Grafana. You need to create teams in Grafana before you can use this feature.
|
||||
{{% admonition type="note" %}}
|
||||
Teamsync allows you sync users from SAML to Grafana teams. It does not automatically create teams in Grafana. You need to create teams in Grafana before you can use this feature.
|
||||
{{% /admonition %}}
|
||||
|
||||
Given the following partial SAML assertion:
|
||||
|
||||
@@ -347,7 +363,9 @@ The following `External Group ID`s would be valid for input in the desired team'
|
||||
|
||||
### Configure role sync
|
||||
|
||||
> **Note:** Available in Grafana version 7.0 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana version 7.0 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
Role sync allows you to map user roles from an identity provider to Grafana. To enable role sync, configure role attribute and possible values for the Editor, Admin, and Grafana Admin roles. For more information about user roles, refer to [Roles and permissions]({{< relref "../../../../administration/roles-and-permissions" >}}).
|
||||
|
||||
@@ -372,7 +390,9 @@ role_values_grafana_admin = superadmin
|
||||
|
||||
**Important**: When role sync is configured, any changes of user roles and organization membership made manually in Grafana will be overwritten on next user login. Assign user organizations and roles in the IdP instead.
|
||||
|
||||
> **Note:** Available in Grafana version 9.2 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana version 9.2 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
If you don't want user organizations and roles to be synchronized with the IdP, you can use the `skip_org_role_sync` configuration option.
|
||||
|
||||
@@ -385,7 +405,9 @@ skip_org_role_sync = true
|
||||
|
||||
### Configure organization mapping
|
||||
|
||||
> **Note:** Available in Grafana version 7.0 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana version 7.0 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
Organization mapping allows you to assign users to particular organization in Grafana depending on attribute value obtained from identity provider.
|
||||
|
||||
@@ -409,7 +431,9 @@ You can use `*` as the SAML Organization if you want all your users to be in som
|
||||
|
||||
- `org_mapping = *:2:Editor` to map all users to `2` in Grafana as Editors.
|
||||
|
||||
> **Note:** Available in Grafana version 9.2 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana version 9.2 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
You can use `*` as the Grafana organization in the mapping if you want all users from a given SAML Organization to be added to all existing Grafana organizations.
|
||||
|
||||
@@ -418,7 +442,9 @@ You can use `*` as the Grafana organization in the mapping if you want all users
|
||||
|
||||
### Configure allowed organizations
|
||||
|
||||
> **Note:** Available in Grafana version 7.0 and later.
|
||||
{{% admonition type="note" %}}
|
||||
Available in Grafana version 7.0 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
With the [`allowed_organizations`]({{< relref "../../../configure-grafana/enterprise-configuration#allowed_organizations" >}}) option you can specify a list of organizations where the user must be a member of at least one of them to be able to log in to Grafana.
|
||||
|
||||
|
||||
+14
-6
@@ -14,15 +14,21 @@ Grafana’s database contains secrets, which are used to query data sources, sen
|
||||
|
||||
Grafana encrypts these secrets before they are written to the database, by using a symmetric-key encryption algorithm called Advanced Encryption Standard (AES). These secrets are signed using a [secret key]({{< relref "../../configure-grafana#secret_key" >}}) that you can change when you configure a new Grafana instance.
|
||||
|
||||
> **Note:** Grafana v9.0 and newer use [envelope encryption](#envelope-encryption) by default, which adds a layer of indirection to the encryption process that introduces an [**implicit breaking change**](#implicit-breaking-change) for older versions of Grafana.
|
||||
{{% admonition type="note" %}}
|
||||
Grafana v9.0 and newer use [envelope encryption](#envelope-encryption) by default, which adds a layer of indirection to the encryption process that introduces an [**implicit breaking change**](#implicit-breaking-change) for older versions of Grafana.
|
||||
{{% /admonition %}}
|
||||
|
||||
For further details about how to operate a Grafana instance with envelope encryption, see the [Operational work]({{< relref "#operational-work" >}}) section.
|
||||
|
||||
> **Note:** In Grafana Enterprise, you can also [encrypt secrets in AES-GCM (Galois/Counter Mode)]({{< relref "#changing-your-encryption-mode-to-aes-gcm" >}}) instead of the default AES-CFB (Cipher FeedBack mode).
|
||||
{{% admonition type="note" %}}
|
||||
In Grafana Enterprise, you can also [encrypt secrets in AES-GCM (Galois/Counter Mode)]({{< relref "#changing-your-encryption-mode-to-aes-gcm" >}}) instead of the default AES-CFB (Cipher FeedBack mode).
|
||||
{{% /admonition %}}
|
||||
|
||||
## Envelope encryption
|
||||
|
||||
> **Note:** Since Grafana v9.0, you can turn envelope encryption off by adding the feature toggle `disableEnvelopeEncryption` to your [Grafana configuration]({{< relref "../../configure-grafana#feature_toggles" >}}).
|
||||
{{% admonition type="note" %}}
|
||||
Since Grafana v9.0, you can turn envelope encryption off by adding the feature toggle `disableEnvelopeEncryption` to your [Grafana configuration]({{< relref "../../configure-grafana#feature_toggles" >}}).
|
||||
{{% /admonition %}}
|
||||
|
||||
Instead of encrypting all secrets with a single key, Grafana uses a set of keys called data encryption keys (DEKs) to encrypt them. These data encryption keys are themselves encrypted with a single key encryption key (KEK), configured through the `secret_key` attribute in your
|
||||
[Grafana configuration]({{< relref "../../configure-grafana#secret_key" >}}) or by [Encrypting your database with a key from a key management service (KMS)](#encrypting-your-database-with-a-key-from-a-key-management-service-kms).
|
||||
@@ -69,9 +75,11 @@ You can rotate data keys to disable the active data key and therefore stop using
|
||||
|
||||
New data keys for encryption operations are generated on demand.
|
||||
|
||||
> **Note:** Data key rotation does **not** implicitly re-encrypt secrets. Grafana will continue to use rotated data keys to decrypt
|
||||
> secrets still encrypted with them. To completely stop using
|
||||
> rotated data keys for both encryption and decryption, see [secrets re-encryption](#re-encrypt-secrets).
|
||||
{{% admonition type="note" %}}
|
||||
Data key rotation does **not** implicitly re-encrypt secrets. Grafana will continue to use rotated data keys to decrypt
|
||||
secrets still encrypted with them. To completely stop using
|
||||
rotated data keys for both encryption and decryption, see [secrets re-encryption](#re-encrypt-secrets).
|
||||
{{% /admonition %}}
|
||||
|
||||
To rotate data keys, use the `/encryption/rotate-data-keys` endpoint of the Grafana [Admin API]({{< relref "../../../developers/http_api/admin#rotate-data-encryption-keys" >}}). It's safe to call more than once, more recommended under maintenance mode.
|
||||
|
||||
|
||||
+7
-3
@@ -11,10 +11,14 @@ weight: 500
|
||||
|
||||
If you manage your secrets with [Hashicorp Vault](https://www.hashicorp.com/products/vault), you can use them for [Configuration]({{< relref "../../../configure-grafana" >}}) and [Provisioning]({{< relref "../../../../administration/provisioning" >}}).
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
{{% admonition type="note" %}}
|
||||
Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
|
||||
> **Note:** If you have Grafana [set up for high availability]({{< relref "../../../set-up-for-high-availability" >}}), then we advise not to use dynamic secrets for provisioning files.
|
||||
> Each Grafana instance is responsible for renewing its own leases. Your data source leases might expire when one of your Grafana servers shuts down.
|
||||
{{% admonition type="note" %}}
|
||||
If you have Grafana [set up for high availability]({{< relref "../../../set-up-for-high-availability" >}}), then we advise not to use dynamic secrets for provisioning files.
|
||||
Each Grafana instance is responsible for renewing its own leases. Your data source leases might expire when one of your Grafana servers shuts down.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Configuration
|
||||
|
||||
|
||||
@@ -19,9 +19,13 @@ Request security allows you to limit requests from the Grafana server by targeti
|
||||
|
||||
This can be used to limit access to internal systems that the server Grafana runs on can access but that users of Grafana should not be able to access. This feature does not affect traffic from the Grafana users browser.
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../introduction/grafana-enterprise" >}}) version 7.4 and later, and [Grafana Cloud Pro and Advanced](/docs/grafana-cloud/).
|
||||
{{% admonition type="note" %}}
|
||||
Available in [Grafana Enterprise]({{< relref "../../introduction/grafana-enterprise" >}}) version 7.4 and later, and [Grafana Cloud Pro and Advanced](/docs/grafana-cloud/).
|
||||
{{% /admonition %}}
|
||||
|
||||
> **Note:** Although request security works with backend plugins, you can create a backend plugin that bypasses this security.
|
||||
{{% admonition type="note" %}}
|
||||
Although request security works with backend plugins, you can create a backend plugin that bypasses this security.
|
||||
{{% /admonition %}}
|
||||
|
||||
## IP and hostname blocking
|
||||
|
||||
|
||||
@@ -9,13 +9,17 @@ title: Configure security hardening
|
||||
|
||||
Security hardening enables you to apply additional security, which can help stop certain vulnerabilities from being exploited by a malicious attacker.
|
||||
|
||||
> **Note:** These settings are available in the [grafana.ini configuration file]({{< relref "../../configure-grafana#configuration-file-location" >}}). To apply changes to the configuration file, restart the Grafana server.
|
||||
{{% admonition type="note" %}}
|
||||
These settings are available in the [grafana.ini configuration file]({{< relref "../../configure-grafana#configuration-file-location" >}}). To apply changes to the configuration file, restart the Grafana server.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Additional security for cookies
|
||||
|
||||
If Grafana uses HTTPS, you can further secure the cookie that the system uses to authenticate access to the web UI. By applying additional security to the cookie, you might mitigate certain attacks that result from an attacker obtaining the cookie value.
|
||||
|
||||
> **Note:** Grafana must use HTTPS for the following configurations to work properly.
|
||||
{{% admonition type="note" %}}
|
||||
Grafana must use HTTPS for the following configurations to work properly.
|
||||
{{% /admonition %}}
|
||||
|
||||
### Add a secure attribute to cookies
|
||||
|
||||
@@ -39,7 +43,9 @@ Example:
|
||||
cookie_samesite = strict
|
||||
```
|
||||
|
||||
> **Note:** By setting the SameSite attribute to "strict," only the user clicks within a Grafana instance work. The default option, "lax," does not produce this behavior.
|
||||
{{% admonition type="note" %}}
|
||||
By setting the SameSite attribute to "strict," only the user clicks within a Grafana instance work. The default option, "lax," does not produce this behavior.
|
||||
{{% /admonition %}}
|
||||
|
||||
### Add a prefix to cookie names
|
||||
|
||||
|
||||
@@ -17,7 +17,9 @@ weight: 900
|
||||
|
||||
# Export logs of usage insights
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../introduction/grafana-enterprise" >}}) version 7.4 and later, and [Grafana Cloud Pro and Advanced](/docs/grafana-cloud/).
|
||||
{{% admonition type="note" %}}
|
||||
Available in [Grafana Enterprise]({{< relref "../../introduction/grafana-enterprise" >}}) version 7.4 and later, and [Grafana Cloud Pro and Advanced](/docs/grafana-cloud/).
|
||||
{{% /admonition %}}
|
||||
|
||||
By exporting usage logs to Loki, you can directly query them and create dashboards of the information that matters to you most, such as dashboard errors, most active organizations, or your top-10 most-used queries. This configuration is done for you in Grafana Cloud, with provisioned dashboards. Read about them in the [Grafana Cloud documentation](/docs/grafana-cloud/usage-insights/).
|
||||
|
||||
|
||||
@@ -20,7 +20,9 @@ Grafana instances, whether on-premises or on the cloud, can use this service to
|
||||
|
||||
If the service detects a leaked token, it immediately revokes it, making it useless, and logs the event.
|
||||
|
||||
> **Note:** If the `revoke` option is disabled, the service only sends a notification to the configured webhook URL and logs the event. The token is not automatically revoked.
|
||||
{{% admonition type="note" %}}
|
||||
If the `revoke` option is disabled, the service only sends a notification to the configured webhook URL and logs the event. The token is not automatically revoked.
|
||||
{{% /admonition %}}
|
||||
|
||||
You can also configure the service to send an outgoing webhook notification to a webhook URL.
|
||||
|
||||
@@ -38,7 +40,9 @@ Grafana has revoked this token",
|
||||
}
|
||||
```
|
||||
|
||||
> **Note:** Secret scanning is disabled by default. Outgoing connections are made once you enable it.
|
||||
{{% admonition type="note" %}}
|
||||
Secret scanning is disabled by default. Outgoing connections are made once you enable it.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Before you begin
|
||||
|
||||
|
||||
@@ -30,7 +30,9 @@ Alert notifications can include images, but rendering many images at the same ti
|
||||
|
||||
## Install Grafana Image Renderer plugin
|
||||
|
||||
> **Note:** Starting from Grafana v7.0.0, all PhantomJS support has been removed. Please use the Grafana Image Renderer plugin or remote rendering service.
|
||||
{{% admonition type="note" %}}
|
||||
Starting from Grafana v7.0.0, all PhantomJS support has been removed. Please use the Grafana Image Renderer plugin or remote rendering service.
|
||||
{{% /admonition %}}
|
||||
|
||||
To install the plugin, refer to the [Grafana Image Renderer Installation instructions](/grafana/plugins/grafana-image-renderer#installation).
|
||||
|
||||
@@ -56,7 +58,9 @@ You can see a docker-compose example using a custom configuration file [here](ht
|
||||
|
||||
### Security
|
||||
|
||||
> **Note:** This feature is available in Image Renderer v3.6.1 and later.
|
||||
{{% admonition type="note" %}}
|
||||
This feature is available in Image Renderer v3.6.1 and later.
|
||||
{{% /admonition %}}
|
||||
|
||||
You can restrict access to the rendering endpoint by specifying a secret token. The token should be configured in the Grafana configuration file and the renderer configuration file. This token is important when you run the plugin in remote rendering mode.
|
||||
|
||||
@@ -90,7 +94,9 @@ You can instruct how headless browser instances are created by configuring a ren
|
||||
|
||||
Default mode will create a new browser instance on each request. When handling multiple concurrent requests, this mode increases memory usage as it will launch multiple browsers at the same time. If you want to set a maximum number of browser to open, you'll need to use the [clustered mode](#clustered).
|
||||
|
||||
> **Note:** When using the `default` mode, it's recommended to not remove the default Chromium flag `--disable-gpu`. When receiving a lot of concurrent requests, not using this flag can cause Puppeteer `newPage` function to freeze, causing request timeouts and leaving browsers open.
|
||||
{{% admonition type="note" %}}
|
||||
When using the `default` mode, it's recommended to not remove the default Chromium flag `--disable-gpu`. When receiving a lot of concurrent requests, not using this flag can cause Puppeteer `newPage` function to freeze, causing request timeouts and leaving browsers open.
|
||||
{{% /admonition %}}
|
||||
|
||||
```bash
|
||||
RENDERING_MODE=default
|
||||
@@ -161,7 +167,9 @@ To achieve better performance, monitor the machine on which your service is runn
|
||||
|
||||
### Other available settings
|
||||
|
||||
> **Note:** Please note that not all settings are available using environment variables. If there is no example using environment variable below, it means that you need to update the configuration file.
|
||||
{{% admonition type="note" %}}
|
||||
Please note that not all settings are available using environment variables. If there is no example using environment variable below, it means that you need to update the configuration file.
|
||||
{{% /admonition %}}
|
||||
|
||||
#### HTTP host
|
||||
|
||||
@@ -279,7 +287,9 @@ RENDERING_DUMPIO=true
|
||||
If you already have [Chrome](https://www.google.com/chrome/) or [Chromium](https://www.chromium.org/)
|
||||
installed on your system, then you can use this instead of the pre-packaged version of Chromium.
|
||||
|
||||
> **Note:** Please note that this is not recommended, since you may encounter problems if the installed version of Chrome/Chromium is not compatible with the [Grafana Image renderer plugin](/grafana/plugins/grafana-image-renderer).
|
||||
{{% admonition type="note" %}}
|
||||
Please note that this is not recommended, since you may encounter problems if the installed version of Chrome/Chromium is not compatible with the [Grafana Image renderer plugin](/grafana/plugins/grafana-image-renderer).
|
||||
{{% /admonition %}}
|
||||
|
||||
You need to make sure that the Chrome/Chromium executable is available for the Grafana/image rendering service process.
|
||||
|
||||
|
||||
@@ -127,8 +127,10 @@ As a last resort, if you already have [Chrome](https://www.google.com/chrome/) o
|
||||
installed on your system, then you can configure the Grafana Image renderer plugin to use this
|
||||
instead of the pre-packaged version of Chromium.
|
||||
|
||||
> **Note:** Please note that this is not recommended, since you may encounter problems if the installed version of Chrome/Chromium is not
|
||||
> compatible with the [Grafana Image renderer plugin](/grafana/plugins/grafana-image-renderer).
|
||||
{{% admonition type="note" %}}
|
||||
Please note that this is not recommended, since you may encounter problems if the installed version of Chrome/Chromium is not
|
||||
compatible with the [Grafana Image renderer plugin](/grafana/plugins/grafana-image-renderer).
|
||||
{{% /admonition %}}
|
||||
|
||||
To override the path to the Chrome/Chromium executable in plugin mode, set an environment variable and make sure that it's available for the Grafana process. For example:
|
||||
|
||||
|
||||
@@ -29,7 +29,9 @@ Grafana supports the following operating systems:
|
||||
- [macOS]({{< relref "./mac" >}})
|
||||
- [Windows]({{< relref "./windows" >}})
|
||||
|
||||
> **Note:** Installation of Grafana on other operating systems is possible, but is not recommended or supported.
|
||||
{{% admonition type="note" %}}
|
||||
Installation of Grafana on other operating systems is possible, but is not recommended or supported.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Hardware recommendations
|
||||
|
||||
@@ -56,11 +58,15 @@ Grafana supports the following databases:
|
||||
|
||||
By default Grafana uses an embedded SQLite database, which is stored in the Grafana installation location.
|
||||
|
||||
> **Note:** SQLite works well if your environment is small, but is not recommended when your environment starts growing. For more information about the limitations of SQLite, refer to [Appropriate Uses For SQLite](https://www.sqlite.org/whentouse.html). If you want high availability, you must use a MySQL or PostgreSQL database. For information about how to define the database configuration parameters inside the `grafana.ini` file, refer to [[database]](/docs/grafana/latest/setup-grafana/configure-grafana/#database).
|
||||
{{% admonition type="note" %}}
|
||||
SQLite works well if your environment is small, but is not recommended when your environment starts growing. For more information about the limitations of SQLite, refer to [Appropriate Uses For SQLite](https://www.sqlite.org/whentouse.html). If you want high availability, you must use a MySQL or PostgreSQL database. For information about how to define the database configuration parameters inside the `grafana.ini` file, refer to [[database]](/docs/grafana/latest/setup-grafana/configure-grafana/#database).
|
||||
{{% /admonition %}}
|
||||
|
||||
Grafana supports the versions of these databases that are officially supported by the project at the time a version of Grafana is released. When a Grafana version becomes unsupported, Grafana Labs might also drop support for that database version. See the links above for the support policies for each project.
|
||||
|
||||
> **Note:** PostgreSQL versions 10.9, 11.4, and 12-beta2 are affected by a bug (tracked by the PostgreSQL project as [bug #15865](https://www.postgresql.org/message-id/flat/15865-17940eacc8f8b081%40postgresql.org)) which prevents those versions from being used with Grafana. The bug has been fixed in more recent versions of PostgreSQL.
|
||||
{{% admonition type="note" %}}
|
||||
PostgreSQL versions 10.9, 11.4, and 12-beta2 are affected by a bug (tracked by the PostgreSQL project as [bug #15865](https://www.postgresql.org/message-id/flat/15865-17940eacc8f8b081%40postgresql.org)) which prevents those versions from being used with Grafana. The bug has been fixed in more recent versions of PostgreSQL.
|
||||
{{% /admonition %}}
|
||||
|
||||
> Grafana can report errors when relying on read-only MySQL servers, such as in high-availability failover scenarios or serverless AWS Aurora MySQL. This is a known issue; for more information, see [issue #13399](https://github.com/grafana/grafana/issues/13399).
|
||||
|
||||
@@ -68,7 +74,9 @@ Grafana supports the versions of these databases that are officially supported b
|
||||
|
||||
Grafana supports the current version of the following browsers. Older versions of these browsers might not be supported, so you should always upgrade to the latest browser version when using Grafana.
|
||||
|
||||
> **Note:** Enable JavaScript in your browser. Running Grafana without JavaScript enabled in the browser is not supported.
|
||||
{{% admonition type="note" %}}
|
||||
Enable JavaScript in your browser. Running Grafana without JavaScript enabled in the browser is not supported.
|
||||
{{% /admonition %}}
|
||||
|
||||
- Chrome/Chromium
|
||||
- Firefox
|
||||
|
||||
@@ -14,7 +14,9 @@ This topic explains how to install Grafana dependencies, install Grafana on Linu
|
||||
|
||||
There are multiple ways to install Grafana: using the Grafana Labs APT repository, by downloading a `.deb` package, or by downloading a binary `.tar.gz` file. Choose only one of the methods below that best suits your needs.
|
||||
|
||||
> **Note:** If you install via the `.deb` package or `.tar.gz` file, then you must manually update Grafana for each new version.
|
||||
{{% admonition type="note" %}}
|
||||
If you install via the `.deb` package or `.tar.gz` file, then you must manually update Grafana for each new version.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Install from APT repository
|
||||
|
||||
@@ -27,7 +29,9 @@ If you install from the APT repository, Grafana automatically updates when you r
|
||||
| Grafana OSS | grafana | `https://apt.grafana.com stable main` |
|
||||
| Grafana OSS (Beta) | grafana | `https://apt.grafana.com beta main` |
|
||||
|
||||
> **Note:** Grafana Enterprise is the recommended and default edition. It is available for free and includes all the features of the OSS edition. You can also upgrade to the [full Enterprise feature set](/products/enterprise/?utm_source=grafana-install-page), which has support for [Enterprise plugins](/grafana/plugins/?enterprise=1&utcm_source=grafana-install-page).
|
||||
{{% admonition type="note" %}}
|
||||
Grafana Enterprise is the recommended and default edition. It is available for free and includes all the features of the OSS edition. You can also upgrade to the [full Enterprise feature set](/products/enterprise/?utm_source=grafana-install-page), which has support for [Enterprise plugins](/grafana/plugins/?enterprise=1&utcm_source=grafana-install-page).
|
||||
{{% /admonition %}}
|
||||
|
||||
Complete the following steps to install Grafana from the APT repository:
|
||||
|
||||
|
||||
@@ -30,7 +30,9 @@ The default images are based on the popular [Alpine Linux project](http://alpine
|
||||
|
||||
The Alpine variant is highly recommended when security and final image size being as small as possible is desired. The main caveat to note is that it uses [musl libc](http://www.musl-libc.org) instead of [glibc and friends](http://www.etalabs.net/compare_libcs.html), so certain software might run into issues depending on the depth of their libc requirements. However, most software don't have an issue with this, so this variant is usually a very safe choice.
|
||||
|
||||
> **Note:** Grafana docker images were based on [Ubuntu](https://ubuntu.com/) prior to version 6.4.0.
|
||||
{{% admonition type="note" %}}
|
||||
Grafana docker images were based on [Ubuntu](https://ubuntu.com/) prior to version 6.4.0.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Ubuntu image
|
||||
|
||||
@@ -46,7 +48,9 @@ You can run the latest Grafana version, run a specific version, or run an unstab
|
||||
|
||||
### Run the latest stable version of Grafana
|
||||
|
||||
> **Note:** If you are on a Linux system, you might need to add `sudo` before the command or add your user to the `docker` group.
|
||||
{{% admonition type="note" %}}
|
||||
If you are on a Linux system, you might need to add `sudo` before the command or add your user to the `docker` group.
|
||||
{{% /admonition %}}
|
||||
|
||||
```bash
|
||||
docker run -d -p 3000:3000 grafana/grafana-enterprise
|
||||
@@ -54,7 +58,9 @@ docker run -d -p 3000:3000 grafana/grafana-enterprise
|
||||
|
||||
### Run a specific version of Grafana
|
||||
|
||||
> **Note:** If you are on a Linux system, you might need to add `sudo` before the command or add your user to the `docker` group.
|
||||
{{% admonition type="note" %}}
|
||||
If you are on a Linux system, you might need to add `sudo` before the command or add your user to the `docker` group.
|
||||
{{% /admonition %}}
|
||||
|
||||
```bash
|
||||
docker run -d -p 3000:3000 --name grafana grafana/grafana-enterprise:<version number>
|
||||
@@ -90,7 +96,9 @@ docker run -d \
|
||||
grafana/grafana-enterprise
|
||||
```
|
||||
|
||||
> **Note:** If you need to specify the version of a plugin, then you can add it to the `GF_INSTALL_PLUGINS` environment variable. Otherwise, the latest is used. For example: `-e "GF_INSTALL_PLUGINS=grafana-clock-panel 1.0.1,grafana-simple-json-datasource 1.3.5"`.
|
||||
{{% admonition type="note" %}}
|
||||
If you need to specify the version of a plugin, then you can add it to the `GF_INSTALL_PLUGINS` environment variable. Otherwise, the latest is used. For example: `-e "GF_INSTALL_PLUGINS=grafana-clock-panel 1.0.1,grafana-simple-json-datasource 1.3.5"`.
|
||||
{{% /admonition %}}
|
||||
|
||||
### Install plugins from other sources
|
||||
|
||||
|
||||
@@ -140,7 +140,9 @@ kubectl create secret generic ge-license --from-file=/path/to/your/license.jwt
|
||||
|
||||
Create a Grafana configuration file with the name `grafana.ini`. Then paste the content below.
|
||||
|
||||
> **Note:** You will have to update the `root_url` field to the url associated with the license you were given.
|
||||
{{% admonition type="note" %}}
|
||||
You will have to update the `root_url` field to the url associated with the license you were given.
|
||||
{{% /admonition %}}
|
||||
|
||||
```yaml
|
||||
[enterprise]
|
||||
@@ -252,7 +254,9 @@ spec:
|
||||
type: LoadBalancer
|
||||
```
|
||||
|
||||
> **Caution:** If you use `LoadBalancer` in the Service and depending on your cloud platform and network configuration, doing so might expose your Grafana instance to the Internet. To eliminate this risk, use `ClusterIP` to restrict access from within the cluster Grafana is deployed to.
|
||||
{{% admonition type="caution" %}}
|
||||
If you use `LoadBalancer` in the Service and depending on your cloud platform and network configuration, doing so might expose your Grafana instance to the Internet. To eliminate this risk, use `ClusterIP` to restrict access from within the cluster Grafana is deployed to.
|
||||
{{% /admonition %}}
|
||||
|
||||
1. Send manifest to Kubernetes API Server
|
||||
`kubectl apply -f grafana.yaml`
|
||||
|
||||
@@ -22,7 +22,9 @@ If you install from the YUM repository, then Grafana is automatically updated ev
|
||||
| Grafana Enterprise | grafana-enterprise | `https://rpm.grafana.com` |
|
||||
| Grafana OSS | grafana | `https://rpm.grafana.com` |
|
||||
|
||||
> **Note:** Grafana Enterprise is the recommended and default edition. It is available for free and includes all the features of the OSS edition. You can also upgrade to the [full Enterprise feature set](/products/enterprise/?utm_source=grafana-install-page), which has support for [Enterprise plugins](/grafana/plugins/?enterprise=1&utcm_source=grafana-install-page).
|
||||
{{% admonition type="note" %}}
|
||||
Grafana Enterprise is the recommended and default edition. It is available for free and includes all the features of the OSS edition. You can also upgrade to the [full Enterprise feature set](/products/enterprise/?utm_source=grafana-install-page), which has support for [Enterprise plugins](/grafana/plugins/?enterprise=1&utcm_source=grafana-install-page).
|
||||
{{% /admonition %}}
|
||||
|
||||
To install Grafana using a YUM repository, complete the following steps:
|
||||
|
||||
|
||||
@@ -22,7 +22,9 @@ If you install from the YUM repository, then Grafana is automatically updated ev
|
||||
| Grafana Enterprise | grafana-enterprise | `https://rpm.grafana.com` |
|
||||
| Grafana OSS | grafana | `https://rpm.grafana.com` |
|
||||
|
||||
> **Note:** Grafana Enterprise is the recommended and default edition. It is available for free and includes all the features of the OSS edition. You can also upgrade to the [full Enterprise feature set](/products/enterprise/?utm_source=grafana-install-page), which has support for [Enterprise plugins](/grafana/plugins/?enterprise=1&utcm_source=grafana-install-page).
|
||||
{{% admonition type="note" %}}
|
||||
Grafana Enterprise is the recommended and default edition. It is available for free and includes all the features of the OSS edition. You can also upgrade to the [full Enterprise feature set](/products/enterprise/?utm_source=grafana-install-page), which has support for [Enterprise plugins](/grafana/plugins/?enterprise=1&utcm_source=grafana-install-page).
|
||||
{{% /admonition %}}
|
||||
|
||||
To install Grafana using a YUM repository, complete the following steps:
|
||||
|
||||
|
||||
@@ -21,7 +21,9 @@ With Grafana Live, you can push event data to a frontend as soon as an event occ
|
||||
|
||||
This could be notifications about dashboard changes, new frames for rendered data, and so on. Live features can help eliminate a page reload or polling in many places, it can stream Internet of things (IoT) sensors or any other real-time data to panels.
|
||||
|
||||
> **Note:** By `real-time`, we indicate a soft real-time. Due to network latencies, garbage collection cycles, and so on, the delay of a delivered message can be up to several hundred milliseconds or higher.
|
||||
{{% admonition type="note" %}}
|
||||
By `real-time`, we indicate a soft real-time. Due to network latencies, garbage collection cycles, and so on, the delay of a delivered message can be up to several hundred milliseconds or higher.
|
||||
{{% /admonition %}}
|
||||
|
||||
## Concepts
|
||||
|
||||
|
||||
@@ -103,7 +103,9 @@ This section shows you how to use `openssl` tooling to generate all necessary fi
|
||||
|
||||
The examples in this section use LetsEncrypt because it is free.
|
||||
|
||||
> **Note**: The instructions provided in this section are for a Debian-based Linux system. For other distributions and operating systems, please refer to the [certbot instructions](https://certbot.eff.org/instructions). Also, these instructions require you to have a domain name that you are in control of. Dynamic domain names like those from Amazon EC2 or DynDNS providers will not function.
|
||||
{{% admonition type="note" %}}
|
||||
The instructions provided in this section are for a Debian-based Linux system. For other distributions and operating systems, please refer to the [certbot instructions](https://certbot.eff.org/instructions). Also, these instructions require you to have a domain name that you are in control of. Dynamic domain names like those from Amazon EC2 or DynDNS providers will not function.
|
||||
{{% /admonition %}}
|
||||
|
||||
#### Install `snapd` and `certbot`
|
||||
|
||||
|
||||
@@ -58,7 +58,9 @@ To restart the Grafana server, run the following commands:
|
||||
sudo systemctl restart grafana-server
|
||||
```
|
||||
|
||||
> **Note:** SUSE or openSUSE users might need to start the server with the systemd method, then use the init.d method to configure Grafana to start at boot.
|
||||
{{% admonition type="note" %}}
|
||||
SUSE or openSUSE users might need to start the server with the systemd method, then use the init.d method to configure Grafana to start at boot.
|
||||
{{% /admonition %}}
|
||||
|
||||
### Start the Grafana server using init.d
|
||||
|
||||
|
||||
Reference in New Issue
Block a user