public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Azure: Settings for Azure AD Workload Identity (#75283)

Browse Source 
* Settings for Azure AD Workload Identity

* Update dependency on Grafana Azure SDK

* Documentation

* Fix JS code

* Cleanup Prometheus backend code

* Making prettier happy
This commit is contained in:
Sergey Kostrukov
2023-09-28 12:05:16 +01:00
committed by GitHub
parent 969e6a17ba
commit 3ee40d3a5a
11 changed files with 101 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/dtos/frontend_settings.go
+4 -3
View File
@@ -44,9 +44,10 @@ type FrontendSettingsLicenseInfoDTO struct {
}
type FrontendSettingsAzureDTO struct {
Cloud string `json:"cloud"`
ManagedIdentityEnabled bool `json:"managedIdentityEnabled"`
UserIdentityEnabled bool `json:"userIdentityEnabled"`
Cloud string `json:"cloud"`
ManagedIdentityEnabled bool `json:"managedIdentityEnabled"`
WorkloadIdentityEnabled bool `json:"workloadIdentityEnabled"`
UserIdentityEnabled bool `json:"userIdentityEnabled"`
}
type FrontendSettingsCachingDTO struct {
pkg/api/frontendsettings.go
+4 -3
View File
@@ -206,9 +206,10 @@ func (hs *HTTPServer) getFrontendSettings(c *contextmodel.ReqContext) (*dtos.Fro
SupportBundlesEnabled: isSupportBundlesEnabled(hs),
Azure: dtos.FrontendSettingsAzureDTO{
Cloud: hs.Cfg.Azure.Cloud,
ManagedIdentityEnabled: hs.Cfg.Azure.ManagedIdentityEnabled,
UserIdentityEnabled: hs.Cfg.Azure.UserIdentityEnabled,
Cloud: hs.Cfg.Azure.Cloud,
ManagedIdentityEnabled: hs.Cfg.Azure.ManagedIdentityEnabled,
WorkloadIdentityEnabled: hs.Cfg.Azure.WorkloadIdentityEnabled,
UserIdentityEnabled: hs.Cfg.Azure.UserIdentityEnabled,
},
Caching: dtos.FrontendSettingsCachingDTO{
pkg/setting/setting_azure.go
+18
View File
@@ -17,6 +17,24 @@ func (cfg *Cfg) readAzureSettings() {
azureSettings.ManagedIdentityEnabled = azureSection.Key("managed_identity_enabled").MustBool(false)
azureSettings.ManagedIdentityClientId = azureSection.Key("managed_identity_client_id").String()
// Workload Identity authentication
if azureSection.Key("workload_identity_enabled").MustBool(false) {
azureSettings.WorkloadIdentityEnabled = true
workloadIdentitySettings := &azsettings.WorkloadIdentitySettings{}
if val := azureSection.Key("workload_identity_tenant_id").String(); val != "" {
workloadIdentitySettings.TenantId = val
}
if val := azureSection.Key("workload_identity_client_id").String(); val != "" {
workloadIdentitySettings.ClientId = val
}
if val := azureSection.Key("workload_identity_token_file").String(); val != "" {
workloadIdentitySettings.TokenFile = val
}
azureSettings.WorkloadIdentitySettings = workloadIdentitySettings
}
// User Identity authentication
if azureSection.Key("user_identity_enabled").MustBool(false) {
azureSettings.UserIdentityEnabled = true
pkg/tsdb/prometheus/azureauth/azure.go
+1 -24
View File
@@ -77,7 +77,7 @@ func getOverriddenScopes(jsonData map[string]any) ([]string, error) {
func getPrometheusScopes(settings *azsettings.AzureSettings, credentials azcredentials.AzureCredentials) ([]string, error) {
// Extract cloud from credentials
azureCloud, err := getAzureCloudFromCredentials(settings, credentials)
azureCloud, err := azcredentials.GetAzureCloud(settings, credentials)
if err != nil {
return nil, err
}
@@ -90,26 +90,3 @@ func getPrometheusScopes(settings *azsettings.AzureSettings, credentials azcrede
return scopes, nil
}
}
// To be part of grafana-azure-sdk-go
func getAzureCloudFromCredentials(settings *azsettings.AzureSettings, credentials azcredentials.AzureCredentials) (string, error) {
switch c := credentials.(type) {
case *azcredentials.AzureManagedIdentityCredentials:
// In case of managed identity, the cloud is always same as where Grafana is hosted
return getDefaultAzureCloud(settings), nil
case *azcredentials.AzureClientSecretCredentials:
return c.AzureCloud, nil
default:
err := fmt.Errorf("the Azure credentials of type '%s' not supported by Prometheus datasource", c.AzureAuthType())
return "", err
}
}
// To be part of grafana-azure-sdk-go
func getDefaultAzureCloud(settings *azsettings.AzureSettings) string {
cloudName := settings.Cloud
if cloudName == "" {
return azsettings.AzurePublic
}
return cloudName
}