public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: make apiserver work behind a feature toggle (#73891)

Browse Source 
Co-authored-by: Charandas Batra <charandas.batra@grafana.com>
This commit is contained in:
Serge Zaitsev
2023-09-01 22:31:51 +03:00
committed by GitHub
co-authored by Charandas Batra
parent 5b28e0b57c
commit 32defdb6bf
2 changed files with 45 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/services/grafana-apiserver/service.go
+31 -7
View File
@@ -9,8 +9,8 @@ import (
"github.com/go-logr/logr"
"github.com/grafana/dskit/services"
"github.com/grafana/grafana-apiserver/pkg/certgenerator"
grafanaapiserveroptions "github.com/grafana/grafana-apiserver/pkg/cmd/server/options"
"github.com/grafana/grafana/pkg/modules"
"k8s.io/apiserver/pkg/authentication/authenticator"
"k8s.io/apiserver/pkg/authentication/request/headerrequest"
"k8s.io/apiserver/pkg/authentication/user"
@@ -21,7 +21,7 @@ import (
clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
"k8s.io/klog/v2"
"github.com/grafana/grafana/pkg/modules"
"github.com/grafana/grafana-apiserver/pkg/certgenerator"
)
const (
@@ -78,7 +78,6 @@ func (s *service) start(ctx context.Context) error {
o.RecommendedOptions.Authorization.AlwaysAllowPaths = []string{"*"}
o.RecommendedOptions.Authorization.AlwaysAllowGroups = []string{user.SystemPrivilegedGroup, "grafana"}
o.RecommendedOptions.Etcd = nil
// TODO: setting CoreAPI to nil currently segfaults in grafana-apiserver
o.RecommendedOptions.CoreAPI = nil
// Get the util to get the paths to pre-generated certs
@@ -86,13 +85,11 @@ func (s *service) start(ctx context.Context) error {
K8sDataPath: s.dataPath,
}
err := certUtil.InitializeCACertPKI()
if err != nil {
if err := certUtil.InitializeCACertPKI(); err != nil {
return err
}
err = certUtil.EnsureApiServerPKI(certgenerator.DefaultAPIServerIp)
if err != nil {
if err := certUtil.EnsureApiServerPKI(certgenerator.DefaultAPIServerIp); err != nil {
return err
}
@@ -140,6 +137,33 @@ func (s *service) start(ctx context.Context) error {
prepared := server.GenericAPIServer.PrepareRun()
// TODO: not sure if we can still inject RouteRegister with the new module server setup
// Disabling the /k8s endpoint until we have a solution
/* handler := func(c *contextmodel.ReqContext) {
req := c.Req
req.URL.Path = strings.TrimPrefix(req.URL.Path, "/k8s")
if req.URL.Path == "" {
req.URL.Path = "/"
}
ctx := req.Context()
signedInUser := appcontext.MustUser(ctx)
req.Header.Set("X-Remote-User", strconv.FormatInt(signedInUser.UserID, 10))
req.Header.Set("X-Remote-Group", "grafana")
req.Header.Set("X-Remote-Extra-token-name", signedInUser.Name)
req.Header.Set("X-Remote-Extra-org-role", string(signedInUser.OrgRole))
req.Header.Set("X-Remote-Extra-org-id", strconv.FormatInt(signedInUser.OrgID, 10))
req.Header.Set("X-Remote-Extra-user-id", strconv.FormatInt(signedInUser.UserID, 10))
resp := responsewriter.WrapForHTTP1Or2(c.Resp)
prepared.GenericAPIServer.Handler.ServeHTTP(resp, req)
}
/* s.rr.Group("/k8s", func(k8sRoute routing.RouteRegister) {
k8sRoute.Any("/", middleware.ReqSignedIn, handler)
k8sRoute.Any("/*", middleware.ReqSignedIn, handler)
}) */
go func() {
s.stoppedCh <- prepared.Run(s.stopCh)
}()