public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prometheus: Predefined scopes for Azure authentication (#49557)

Browse Source 
* Predefined scopes for Azure Prometheus

* Allow override of audience
This commit is contained in:
Sergey Kostrukov
2022-05-30 17:43:32 +02:00
committed by GitHub
parent f87c1b0eb9
commit 2b83cf4618
9 changed files with 153 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/datasources/service/datasource_service.go
+10 -13
View File
@@ -6,8 +6,6 @@ import (
"encoding/json"
"fmt"
"net/http"
"net/url"
"path"
"strconv"
"strings"
"sync"
@@ -27,6 +25,7 @@ import (
"github.com/grafana/grafana/pkg/services/secrets/kvstore"
"github.com/grafana/grafana/pkg/services/sqlstore"
"github.com/grafana/grafana/pkg/setting"
"github.com/grafana/grafana/pkg/tsdb/prometheus/buffered/promclient"
)
type Service struct {
@@ -402,7 +401,8 @@ func (s *Service) httpClientOptions(ctx context.Context, ds *models.DataSource)
}
}
if ds.JsonData != nil && s.features.IsEnabled(featuremgmt.FlagHttpclientproviderAzureAuth) {
// TODO: #35857 Required for templating queries in Prometheus datasource when Azure authentication enabled
if ds.JsonData != nil && s.features.IsEnabled(featuremgmt.FlagPrometheusAzureAuth) {
credentials, err := azcredentials.FromDatasourceData(ds.JsonData.MustMap(), decryptedValues)
if err != nil {
err = fmt.Errorf("invalid Azure credentials: %s", err)
@@ -410,21 +410,18 @@ func (s *Service) httpClientOptions(ctx context.Context, ds *models.DataSource)
}
if credentials != nil {
resourceIdStr := ds.JsonData.Get("azureEndpointResourceId").MustString()
if resourceIdStr == "" {
err := fmt.Errorf("endpoint resource ID (audience) not provided")
var scopes []string
if scopes, err = promclient.GetOverriddenScopes(ds.JsonData.MustMap()); err != nil {
return nil, err
}
resourceId, err := url.Parse(resourceIdStr)
if err != nil || resourceId.Scheme == "" || resourceId.Host == "" {
err := fmt.Errorf("endpoint resource ID (audience) '%s' invalid", resourceIdStr)
return nil, err
if scopes == nil {
if scopes, err = promclient.GetPrometheusScopes(s.cfg.Azure, credentials); err != nil {
return nil, err
}
}
resourceId.Path = path.Join(resourceId.Path, ".default")
scopes := []string{resourceId.String()}
azhttpclient.AddAzureAuthentication(opts, s.cfg.Azure, credentials, scopes)
}
}
pkg/services/datasources/service/datasource_service_test.go
+1 -2
View File
@@ -561,7 +561,7 @@ func TestService_HTTPClientOptions(t *testing.T) {
t.Run("Azure authentication", func(t *testing.T) {
t.Run("given feature flag enabled", func(t *testing.T) {
features := featuremgmt.WithFeatures(featuremgmt.FlagHttpclientproviderAzureAuth)
features := featuremgmt.WithFeatures(featuremgmt.FlagPrometheusAzureAuth)
t.Run("should set Azure middleware when JsonData contains valid credentials", func(t *testing.T) {
t.Cleanup(func() { ds.JsonData = emptyJsonData; ds.SecureJsonData = emptySecureJsonData })
@@ -571,7 +571,6 @@ func TestService_HTTPClientOptions(t *testing.T) {
"azureCredentials": map[string]interface{}{
"authType": "msi",
},
"azureEndpointResourceId": "https://api.example.com/abd5c4ce-ca73-41e9-9cb2-bed39aa2adb5",
})
secretsStore := kvstore.SetupTestService(t)
pkg/services/featuremgmt/registry.go
+5 -5
View File
@@ -18,11 +18,6 @@ var (
Description: "Disable envelope encryption (emergency only)",
State: FeatureStateStable,
},
{
Name: "httpclientprovider_azure_auth",
Description: "Experimental. Allow datasources to configure Azure authentication directly via JsonData",
State: FeatureStateBeta,
},
{
Name: "serviceAccounts",
Description: "support service accounts",
@@ -100,6 +95,11 @@ var (
Description: "Experimental. Azure authentication for Prometheus datasource",
State: FeatureStateBeta,
},
{
Name: "prometheusAzureOverrideAudience",
Description: "Experimental. Allow override default AAD audience for Azure Prometheus endpoint",
State: FeatureStateBeta,
},
{
Name: "influxdbBackendMigration",
Description: "Query InfluxDB InfluxQL without the proxy",
pkg/services/featuremgmt/toggles_gen.go
+4 -4
View File
@@ -15,10 +15,6 @@ const (
// Disable envelope encryption (emergency only)
FlagDisableEnvelopeEncryption = "disableEnvelopeEncryption"
// FlagHttpclientproviderAzureAuth
// Experimental. Allow datasources to configure Azure authentication directly via JsonData
FlagHttpclientproviderAzureAuth = "httpclientprovider_azure_auth"
// FlagServiceAccounts
// support service accounts
FlagServiceAccounts = "serviceAccounts"
@@ -75,6 +71,10 @@ const (
// Experimental. Azure authentication for Prometheus datasource
FlagPrometheusAzureAuth = "prometheus_azure_auth"
// FlagPrometheusAzureOverrideAudience
// Experimental. Allow override default AAD audience for Azure Prometheus endpoint
FlagPrometheusAzureOverrideAudience = "prometheusAzureOverrideAudience"
// FlagInfluxdbBackendMigration
// Query InfluxDB InfluxQL without the proxy
FlagInfluxdbBackendMigration = "influxdbBackendMigration"
pkg/tsdb/prometheus/buffered/promclient/provider_azure.go
+76 -13
View File
@@ -7,12 +7,21 @@ import (
"github.com/grafana/grafana-azure-sdk-go/azcredentials"
"github.com/grafana/grafana-azure-sdk-go/azhttpclient"
"github.com/grafana/grafana-azure-sdk-go/azsettings"
sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/util/maputil"
)
var (
azurePrometheusScopes = map[string][]string{
azsettings.AzurePublic: {"https://prometheus.monitor.azure.com/.default"},
azsettings.AzureChina: {"https://prometheus.monitor.chinacloudapp.cn/.default"},
azsettings.AzureUSGovernment: {"https://prometheus.monitor.usgovcloudapi.net/.default"},
}
)
func (p *Provider) configureAzureAuthentication(opts *sdkhttpclient.Options) error {
// Azure authentication is experimental (#35857)
if !p.features.IsEnabled(featuremgmt.FlagPrometheusAzureAuth) {
@@ -21,30 +30,84 @@ func (p *Provider) configureAzureAuthentication(opts *sdkhttpclient.Options) err
credentials, err := azcredentials.FromDatasourceData(p.jsonData, p.settings.DecryptedSecureJSONData)
if err != nil {
err = fmt.Errorf("invalid Azure credentials: %s", err)
err = fmt.Errorf("invalid Azure credentials: %w", err)
return err
}
if credentials != nil {
resourceIdStr, err := maputil.GetStringOptional(p.jsonData, "azureEndpointResourceId")
if err != nil {
return err
} else if resourceIdStr == "" {
err := fmt.Errorf("endpoint resource ID (audience) not provided")
var scopes []string
if scopes, err = GetOverriddenScopes(p.jsonData); err != nil {
return err
}
resourceId, err := url.Parse(resourceIdStr)
if err != nil || resourceId.Scheme == "" || resourceId.Host == "" {
err := fmt.Errorf("endpoint resource ID (audience) '%s' invalid", resourceIdStr)
return err
if scopes == nil {
if scopes, err = GetPrometheusScopes(p.cfg.Azure, credentials); err != nil {
return err
}
}
resourceId.Path = path.Join(resourceId.Path, ".default")
scopes := []string{resourceId.String()}
azhttpclient.AddAzureAuthentication(opts, p.cfg.Azure, credentials, scopes)
}
return nil
}
func GetOverriddenScopes(jsonData map[string]interface{}) ([]string, error) {
resourceIdStr, err := maputil.GetStringOptional(jsonData, "azureEndpointResourceId")
if err != nil {
err = fmt.Errorf("overridden resource ID (audience) invalid")
return nil, err
} else if resourceIdStr == "" {
return nil, nil
}
resourceId, err := url.Parse(resourceIdStr)
if err != nil || resourceId.Scheme == "" || resourceId.Host == "" {
err = fmt.Errorf("overridden endpoint resource ID (audience) '%s' invalid", resourceIdStr)
return nil, err
}
resourceId.Path = path.Join(resourceId.Path, ".default")
scopes := []string{resourceId.String()}
return scopes, nil
}
func GetPrometheusScopes(settings *azsettings.AzureSettings, credentials azcredentials.AzureCredentials) ([]string, error) {
// Extract cloud from credentials
azureCloud, err := getAzureCloudFromCredentials(settings, credentials)
if err != nil {
return nil, err
}
// Get scopes for the given cloud
if scopes, ok := azurePrometheusScopes[azureCloud]; !ok {
err := fmt.Errorf("the Azure cloud '%s' not supported by Prometheus datasource", azureCloud)
return nil, err
} else {
return scopes, nil
}
}
// To be part of grafana-azure-sdk-go
func getAzureCloudFromCredentials(settings *azsettings.AzureSettings, credentials azcredentials.AzureCredentials) (string, error) {
switch c := credentials.(type) {
case *azcredentials.AzureManagedIdentityCredentials:
// In case of managed identity, the cloud is always same as where Grafana is hosted
return getDefaultAzureCloud(settings), nil
case *azcredentials.AzureClientSecretCredentials:
return c.AzureCloud, nil
default:
err := fmt.Errorf("the Azure credentials of type '%s' not supported by Prometheus datasource", c.AzureAuthType())
return "", err
}
}
// To be part of grafana-azure-sdk-go
func getDefaultAzureCloud(settings *azsettings.AzureSettings) string {
cloudName := settings.Cloud
if cloudName == "" {
return azsettings.AzurePublic
}
return cloudName
}
pkg/tsdb/prometheus/buffered/promclient/provider_azure_test.go
+5 -2
View File
@@ -3,8 +3,10 @@ package promclient
import (
"testing"
"github.com/grafana/grafana-azure-sdk-go/azsettings"
"github.com/grafana/grafana-plugin-sdk-go/backend"
sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
"github.com/grafana/grafana/pkg/services/featuremgmt"
"github.com/grafana/grafana/pkg/setting"
"github.com/stretchr/testify/assert"
@@ -12,7 +14,9 @@ import (
)
func TestConfigureAzureAuthentication(t *testing.T) {
cfg := &setting.Cfg{}
cfg := &setting.Cfg{
Azure: &azsettings.AzureSettings{},
}
settings := backend.DataSourceInstanceSettings{}
t.Run("given feature flag enabled", func(t *testing.T) {
@@ -24,7 +28,6 @@ func TestConfigureAzureAuthentication(t *testing.T) {
"azureCredentials": map[string]interface{}{
"authType": "msi",
},
"azureEndpointResourceId": "https://api.example.com/abd5c4ce-ca73-41e9-9cb2-bed39aa2adb5",
}
var p = NewProvider(settings, jsonData, nil, cfg, features, nil)