public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Docs: Add http docs for lbac for datasources (#93399)

Browse Source 
* Add: http docs for lbac for datasources

* spelling

* update with only cloud loki

* rename to lbac for datasources

* moved it

* Update _index.md

This commit fixes minor style and punctuation issus

* change datasource to data source

* replace datasource with data source

minor updates and style fixes

* minor style changes

* prettier

---------

Co-authored-by: Irene Rodriguez <irene.rodriguez@grafana.com>
This commit is contained in:
Eric Leijonmarck
2024-09-18 11:54:21 +01:00
committed by GitHub
co-authored by Irene Rodriguez
parent af42f31fe6
commit 6ee7f7dc79
4 changed files with 166 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/administration/data-source-management/teamlbac/create-teamlbac-rules/index.md
+19 -20
View File
@@ -1,42 +1,41 @@
---
description: Learn how to create Team LBAC rules for the Loki data source.
description: Learn how to create LBAC for data sources rules for the Loki data source.
keywords:
- loki
- lbac
- team
labels:
products:
- enterprise
- cloud
title: Create Team LBAC rules for the Loki data source
title: Create LBAC for data sources rules for the Loki data source
weight: 250
---
# Create Team LBAC rules for the Loki data source
# Create LBAC for data sources rules for the Loki data source
Team LBAC is available on Cloud for data sources created with basic authentication. Any managed Loki data source can **NOT** be configured with Team LBAC rules.
LBAC for data sources is available on Cloud for Loki data sources created with basic authentication. Managed/Provisioned Loki data source can **NOT** be configured with LBAC for data sources as of now.
## Before you begin
To be able to use Team LBAC rules, you need to enable the feature toggle `teamHttpHeaders` on your Grafana instance. Contact support to enable the feature toggle for you.
To be able to use LBAC for data sources rules, you need to enable the feature toggle `teamHttpHeaders` on your Grafana instance. Contact support to enable the feature toggle for you.
- Be sure that you are running Grafana Enterprise.
- Be sure that you have the permission setup to create a Loki tenant in Grafana Cloud.
- Be sure that you have admin data source permissions for Grafana.
- Be sure that you have a team setup in Grafana.
### Create a Team LBAC Rule for a team
### Create a LBAC for data sources Rule for a team
1. Navigate to your Loki datasource
1. Navigate to your Loki data source
1. Navigate to the permissions tab
- Here, you'll find the Team LBAC rules section.
1. Add a Team LBAC Rule
- Add a new rule for the team in the Team LBAC rules section.
1. Define Label Selector for the Rule
- Here, you'll find the LBAC for data sources rules section.
1. Add a LBAC for data sources Rule
- Add a new rule for the team in the LBAC for data sources rules section.
1. Define a label selector for the rule
- Add a label selector to the rule. Refer to Loki query documentation for guidance on the types of log selections you can specify.
### LBAC rule
A LBAC rule is a `logql` query that runs as a query to the loki instance for your logs. Each rule is it's own filtering operating independently from the other rules within a team. For example, you can create a label policy that includes all log lines with the label.
A LBAC rule is a `logql` query that runs as a query to the Loki instance for your logs. Each rule operates independently as its own filter, separate from other rules within a team. For example, you can create a label policy that includes all log lines with a specific label.
One rule `{namespace="dev", cluster="us-west-0"}` created with multiple namespaces will be seen as `namespace="dev"` **AND** `cluster="us-west-0"`.
Two rules `{namespace="dev"}`, `{cluster="us-west-0"}` created for a team will be seen as `namespace="dev"` **OR** `cluster="us-west-0"`.
@@ -47,11 +46,11 @@ We recommend you only add `query` permissions for teams that should use the data
We recommend for a first setup, setting up as few rules as possible for each team and make them additive for simplicity.
For validating the rules, we recommend testing the rules in the Loki Explore view. This will allow you to see the logs that would be returned for the rule.
To validate the rules, we recommend testing the rules in the Loki Explore view. This will allow you to see the logs that would be returned for the rule.
#### Tasks
### Task 1: One rule setup for each team
### Task 1: One rule set up for each team
One common use case for creating an LBAC policy is to have specific access to logs that have a specific label. For example, you can create a label policy that includes all log lines with the label.
@@ -67,9 +66,9 @@ A user that is part of Team B will have access to logs that match `namespace="pr
A user that is part of Team A and Team B will have access to logs that match `namespace="dev"` OR `namespace="prod"`.
### Task 2: One rule setup for a team Exclude a label
### Task 2: Set up a rule to exclude a label for a team
One common use case for creating an LBAC policy is to exclude logs that have a specific label. For example, you can create a label policy that excludes all log lines with the label secret=true by adding a selector with `secret!="true"` when you create an access policy:
One common use case for creating an LBAC policy is to exclude logs that have a specific label. For example, you can create a label policy that excludes all log lines with the label `secret=true` by adding a selector with `secret!="true"` when you create an access policy:
We have one team, Team A `Query` permissions. Loki access is setup with `Admin` roles to have `Admin` permission only.
@@ -77,7 +76,7 @@ We have one team, Team A `Query` permissions. Loki access is setup with `Admin`
A user that is part of Team A will **NOT** have access to logs that match `secret!="true"`.
### Task 3: Multiple rules setup for one team
### Task 3: Set up multiple rules for a team
We have two teams, Team A and Team B with `Query` permissions. Loki access is setup with `Admin` roles having `Admin` permission.
@@ -113,7 +112,7 @@ A user in Team B will have access to logs that match `namespace!="dev"`.
> _NOTE:_ A user that is part of Team A and Team B will have access to all logs that match `namespace="dev"` `OR` `namespace!="dev"`.
### Task 5: One rule setup for a Team
### Task 5: Single rule setup for a team
We have two teams, Team A and Team B. Loki access is setup with `Editor`, `Viewer` roles to have `Query` permission.