From 9300634113551c98d40f85c9b1b637d69fe3f085 Mon Sep 17 00:00:00 2001 From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com> Date: Thu, 11 Aug 2022 10:30:40 -0400 Subject: [PATCH] Prometheus: Promote Azure auth flag to configuration (#53447) (#53598) (cherry picked from commit a31d96d20a677f66a9c3cf269c987bf117df8677) Co-authored-by: Andres Martinez Gotor --- conf/defaults.ini | 3 +++ conf/sample.ini | 3 +++ packages/grafana-data/src/types/config.ts | 1 + .../src/types/featureToggles.gen.ts | 1 - packages/grafana-runtime/src/config.ts | 1 + pkg/api/frontendsettings.go | 1 + pkg/services/featuremgmt/registry.go | 5 ----- pkg/services/featuremgmt/toggles_gen.go | 4 ---- pkg/services/featuremgmt/toggles_gen_test.go | 1 - pkg/services/featuremgmt/usage_stats_test.go | 16 +++++++------- pkg/setting/setting.go | 6 ++++++ pkg/tsdb/prometheus/buffered/client.go | 11 +++++----- pkg/tsdb/prometheus/buffered/client_test.go | 21 +++++++++++++++++-- pkg/tsdb/prometheus/prometheus.go | 2 +- pkg/tsdb/prometheus/querydata/request_test.go | 4 ++-- .../prometheus/configuration/ConfigEditor.tsx | 2 +- 16 files changed, 50 insertions(+), 32 deletions(-) diff --git a/conf/defaults.ini b/conf/defaults.ini index 51c835d1822..d36a7f910d4 100644 --- a/conf/defaults.ini +++ b/conf/defaults.ini @@ -440,6 +440,9 @@ sigv4_auth_enabled = false # Set to true to enable verbose logging of SigV4 request signing sigv4_verbose_logging = false +# Set to true to enable Azure authentication option for HTTP-based datasources +azure_auth_enabled = false + #################################### Anonymous Auth ###################### [auth.anonymous] # enable anonymous access diff --git a/conf/sample.ini b/conf/sample.ini index f062397ae97..a7239e9cf26 100644 --- a/conf/sample.ini +++ b/conf/sample.ini @@ -440,6 +440,9 @@ # Set to true to enable verbose logging of SigV4 request signing ;sigv4_verbose_logging = false +# Set to true to enable Azure authentication option for HTTP-based datasources. +;azure_auth_enabled = false + #################################### Anonymous Auth ###################### [auth.anonymous] # enable anonymous access diff --git a/packages/grafana-data/src/types/config.ts b/packages/grafana-data/src/types/config.ts index 7fccea958bb..61c474b65e6 100644 --- a/packages/grafana-data/src/types/config.ts +++ b/packages/grafana-data/src/types/config.ts @@ -177,6 +177,7 @@ export interface GrafanaConfig { profileEnabled: boolean; ldapEnabled: boolean; sigV4AuthEnabled: boolean; + azureAuthEnabled: boolean; samlEnabled: boolean; autoAssignOrg: boolean; verifyEmailEnabled: boolean; diff --git a/packages/grafana-data/src/types/featureToggles.gen.ts b/packages/grafana-data/src/types/featureToggles.gen.ts index 8347dab90db..e890d70144b 100644 --- a/packages/grafana-data/src/types/featureToggles.gen.ts +++ b/packages/grafana-data/src/types/featureToggles.gen.ts @@ -27,7 +27,6 @@ export interface FeatureToggles { queryOverLive?: boolean; panelTitleSearch?: boolean; tempoApmTable?: boolean; - prometheus_azure_auth?: boolean; prometheusAzureOverrideAudience?: boolean; influxdbBackendMigration?: boolean; showFeatureFlagsInUI?: boolean; diff --git a/packages/grafana-runtime/src/config.ts b/packages/grafana-runtime/src/config.ts index 3adcfbc58a6..b22f47f1504 100644 --- a/packages/grafana-runtime/src/config.ts +++ b/packages/grafana-runtime/src/config.ts @@ -55,6 +55,7 @@ export class GrafanaBootConfig implements GrafanaConfig { jwtHeaderName = ''; jwtUrlLogin = false; sigV4AuthEnabled = false; + azureAuthEnabled = false; samlEnabled = false; samlName = ''; autoAssignOrg = true; diff --git a/pkg/api/frontendsettings.go b/pkg/api/frontendsettings.go index a1df871d90a..1d4ba7342be 100644 --- a/pkg/api/frontendsettings.go +++ b/pkg/api/frontendsettings.go @@ -108,6 +108,7 @@ func (hs *HTTPServer) getFrontendSettingsMap(c *models.ReqContext) (map[string]i "autoAssignOrg": setting.AutoAssignOrg, "verifyEmailEnabled": setting.VerifyEmailEnabled, "sigV4AuthEnabled": setting.SigV4AuthEnabled, + "azureAuthEnabled": setting.AzureAuthEnabled, "rbacEnabled": hs.Cfg.RBACEnabled, "rbacBuiltInRoleAssignmentEnabled": hs.Cfg.RBACBuiltInRoleAssignmentEnabled, "exploreEnabled": setting.ExploreEnabled, diff --git a/pkg/services/featuremgmt/registry.go b/pkg/services/featuremgmt/registry.go index 9f212954fe8..473e3448f20 100644 --- a/pkg/services/featuremgmt/registry.go +++ b/pkg/services/featuremgmt/registry.go @@ -68,11 +68,6 @@ var ( State: FeatureStateAlpha, FrontendOnly: true, }, - { - Name: "prometheus_azure_auth", - Description: "Experimental. Azure authentication for Prometheus datasource", - State: FeatureStateBeta, - }, { Name: "prometheusAzureOverrideAudience", Description: "Experimental. Allow override default AAD audience for Azure Prometheus endpoint", diff --git a/pkg/services/featuremgmt/toggles_gen.go b/pkg/services/featuremgmt/toggles_gen.go index 5039e1064f8..140a58863b9 100644 --- a/pkg/services/featuremgmt/toggles_gen.go +++ b/pkg/services/featuremgmt/toggles_gen.go @@ -51,10 +51,6 @@ const ( // Show APM table FlagTempoApmTable = "tempoApmTable" - // FlagPrometheusAzureAuth - // Experimental. Azure authentication for Prometheus datasource - FlagPrometheusAzureAuth = "prometheus_azure_auth" - // FlagPrometheusAzureOverrideAudience // Experimental. Allow override default AAD audience for Azure Prometheus endpoint FlagPrometheusAzureOverrideAudience = "prometheusAzureOverrideAudience" diff --git a/pkg/services/featuremgmt/toggles_gen_test.go b/pkg/services/featuremgmt/toggles_gen_test.go index dc72fa4aaaa..4bd9961a586 100644 --- a/pkg/services/featuremgmt/toggles_gen_test.go +++ b/pkg/services/featuremgmt/toggles_gen_test.go @@ -24,7 +24,6 @@ func TestFeatureToggleFiles(t *testing.T) { "live-config": true, "live-pipeline": true, "live-service-web-worker": true, - "prometheus_azure_auth": true, } t.Run("verify files", func(t *testing.T) { diff --git a/pkg/services/featuremgmt/usage_stats_test.go b/pkg/services/featuremgmt/usage_stats_test.go index be25a8f54ba..7e655a653c1 100644 --- a/pkg/services/featuremgmt/usage_stats_test.go +++ b/pkg/services/featuremgmt/usage_stats_test.go @@ -10,7 +10,6 @@ import ( func TestFeatureUsageStats(t *testing.T) { featureManagerWithAllFeatures := WithFeatures( "trimDefaults", - "httpclientprovider_azure_auth", "database_metrics", "dashboardPreviews", "live-config", @@ -20,13 +19,12 @@ func TestFeatureUsageStats(t *testing.T) { ) require.Equal(t, map[string]interface{}{ - "stats.features.trim_defaults.count": 1, - "stats.features.httpclientprovider_azure_auth.count": 1, - "stats.features.database_metrics.count": 1, - "stats.features.dashboard_previews.count": 1, - "stats.features.live_config.count": 1, - "stats.features.show_feature_flags_in_ui.count": 1, - "stats.features.upper_snake_case.count": 1, - "stats.features.feature_with_a_dot.count": 1, + "stats.features.trim_defaults.count": 1, + "stats.features.database_metrics.count": 1, + "stats.features.dashboard_previews.count": 1, + "stats.features.live_config.count": 1, + "stats.features.show_feature_flags_in_ui.count": 1, + "stats.features.upper_snake_case.count": 1, + "stats.features.feature_with_a_dot.count": 1, }, featureManagerWithAllFeatures.GetUsageStats(context.Background())) } diff --git a/pkg/setting/setting.go b/pkg/setting/setting.go index 41e7b75d790..aae83479bd1 100644 --- a/pkg/setting/setting.go +++ b/pkg/setting/setting.go @@ -115,6 +115,7 @@ var ( // HTTP auth SigV4AuthEnabled bool + AzureAuthEnabled bool AnonymousEnabled bool @@ -287,6 +288,7 @@ type Cfg struct { TokenRotationIntervalMinutes int SigV4AuthEnabled bool SigV4VerboseLogging bool + AzureAuthEnabled bool BasicAuthEnabled bool AdminUser string AdminPassword string @@ -1290,6 +1292,10 @@ func readAuthSettings(iniFile *ini.File, cfg *Cfg) (err error) { cfg.SigV4AuthEnabled = SigV4AuthEnabled cfg.SigV4VerboseLogging = auth.Key("sigv4_verbose_logging").MustBool(false) + // Azure Auth + AzureAuthEnabled = auth.Key("azure_auth_enabled").MustBool(false) + cfg.AzureAuthEnabled = AzureAuthEnabled + // anonymous access AnonymousEnabled = iniFile.Section("auth.anonymous").Key("enabled").MustBool(false) cfg.AnonymousEnabled = AnonymousEnabled diff --git a/pkg/tsdb/prometheus/buffered/client.go b/pkg/tsdb/prometheus/buffered/client.go index b5a60633d96..79a0e619ba3 100644 --- a/pkg/tsdb/prometheus/buffered/client.go +++ b/pkg/tsdb/prometheus/buffered/client.go @@ -5,11 +5,10 @@ import ( "net/http" "strings" - "github.com/grafana/grafana-azure-sdk-go/azsettings" "github.com/grafana/grafana-plugin-sdk-go/backend" sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient" "github.com/grafana/grafana/pkg/infra/log" - "github.com/grafana/grafana/pkg/services/featuremgmt" + "github.com/grafana/grafana/pkg/setting" "github.com/grafana/grafana/pkg/tsdb/prometheus/buffered/azureauth" "github.com/grafana/grafana/pkg/tsdb/prometheus/middleware" "github.com/grafana/grafana/pkg/tsdb/prometheus/utils" @@ -20,7 +19,7 @@ import ( // CreateTransportOptions creates options for the http client. Probably should be shared and should not live in the // buffered package. -func CreateTransportOptions(settings backend.DataSourceInstanceSettings, azureSettings *azsettings.AzureSettings, features featuremgmt.FeatureToggles, logger log.Logger) (*sdkhttpclient.Options, error) { +func CreateTransportOptions(settings backend.DataSourceInstanceSettings, cfg *setting.Cfg, logger log.Logger) (*sdkhttpclient.Options, error) { opts, err := settings.HTTPClientOptions() if err != nil { return nil, err @@ -39,9 +38,9 @@ func CreateTransportOptions(settings backend.DataSourceInstanceSettings, azureSe opts.SigV4.Service = "aps" } - // Azure authentication is experimental (#35857) - if features.IsEnabled(featuremgmt.FlagPrometheusAzureAuth) { - err = azureauth.ConfigureAzureAuthentication(settings, azureSettings, &opts) + // Set Azure authentication + if cfg.AzureAuthEnabled { + err = azureauth.ConfigureAzureAuthentication(settings, cfg.Azure, &opts) if err != nil { return nil, fmt.Errorf("error configuring Azure auth: %v", err) } diff --git a/pkg/tsdb/prometheus/buffered/client_test.go b/pkg/tsdb/prometheus/buffered/client_test.go index 5dc96a904a3..105803503be 100644 --- a/pkg/tsdb/prometheus/buffered/client_test.go +++ b/pkg/tsdb/prometheus/buffered/client_test.go @@ -6,7 +6,7 @@ import ( "github.com/grafana/grafana-azure-sdk-go/azsettings" "github.com/grafana/grafana-plugin-sdk-go/backend" "github.com/grafana/grafana/pkg/infra/log/logtest" - "github.com/grafana/grafana/pkg/services/featuremgmt" + "github.com/grafana/grafana/pkg/setting" "github.com/stretchr/testify/require" ) @@ -20,8 +20,25 @@ func TestCreateTransportOptions(t *testing.T) { "httpHeaderValue1": "bar", }, } - opts, err := CreateTransportOptions(settings, &azsettings.AzureSettings{}, featuremgmt.WithFeatures(), &logtest.Fake{}) + opts, err := CreateTransportOptions(settings, &setting.Cfg{}, &logtest.Fake{}) require.NoError(t, err) require.Equal(t, map[string]string{"foo": "bar"}, opts.Headers) + require.Equal(t, 2, len(opts.Middlewares)) + }) + + t.Run("add azure credentials if configured", func(t *testing.T) { + settings := backend.DataSourceInstanceSettings{ + BasicAuthEnabled: false, + BasicAuthUser: "", + JSONData: []byte(`{ + "azureCredentials": { + "authType": "msi" + } + }`), + DecryptedSecureJSONData: map[string]string{}, + } + opts, err := CreateTransportOptions(settings, &setting.Cfg{AzureAuthEnabled: true, Azure: &azsettings.AzureSettings{}}, &logtest.Fake{}) + require.NoError(t, err) + require.Equal(t, 3, len(opts.Middlewares)) }) } diff --git a/pkg/tsdb/prometheus/prometheus.go b/pkg/tsdb/prometheus/prometheus.go index ad096f26290..48d4b417c5f 100644 --- a/pkg/tsdb/prometheus/prometheus.go +++ b/pkg/tsdb/prometheus/prometheus.go @@ -48,7 +48,7 @@ func ProvideService(httpClientProvider httpclient.Provider, cfg *setting.Cfg, fe func newInstanceSettings(httpClientProvider httpclient.Provider, cfg *setting.Cfg, features featuremgmt.FeatureToggles, tracer tracing.Tracer) datasource.InstanceFactoryFunc { return func(settings backend.DataSourceInstanceSettings) (instancemgmt.Instance, error) { // Creates a http roundTripper. Probably should be used for both buffered and streaming/querydata instances. - opts, err := buffered.CreateTransportOptions(settings, cfg.Azure, features, plog) + opts, err := buffered.CreateTransportOptions(settings, cfg, plog) if err != nil { return nil, fmt.Errorf("error creating transport options: %v", err) } diff --git a/pkg/tsdb/prometheus/querydata/request_test.go b/pkg/tsdb/prometheus/querydata/request_test.go index 1092fc8e2e8..07be1753810 100644 --- a/pkg/tsdb/prometheus/querydata/request_test.go +++ b/pkg/tsdb/prometheus/querydata/request_test.go @@ -10,12 +10,12 @@ import ( "testing" "time" - "github.com/grafana/grafana-azure-sdk-go/azsettings" "github.com/grafana/grafana-plugin-sdk-go/backend" sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient" "github.com/grafana/grafana-plugin-sdk-go/data" "github.com/grafana/grafana/pkg/infra/httpclient" "github.com/grafana/grafana/pkg/infra/tracing" + "github.com/grafana/grafana/pkg/setting" "github.com/grafana/grafana/pkg/tsdb/prometheus/buffered" "github.com/grafana/grafana/pkg/tsdb/prometheus/models" "github.com/grafana/grafana/pkg/tsdb/prometheus/querydata" @@ -415,7 +415,7 @@ func setup(wideFrames bool) (*testContext, error) { features := &fakeFeatureToggles{flags: map[string]bool{"prometheusStreamingJSONParser": true, "prometheusWideSeries": wideFrames}} - opts, err := buffered.CreateTransportOptions(settings, &azsettings.AzureSettings{}, features, &fakeLogger{}) + opts, err := buffered.CreateTransportOptions(settings, &setting.Cfg{}, &fakeLogger{}) if err != nil { return nil, err } diff --git a/public/app/plugins/datasource/prometheus/configuration/ConfigEditor.tsx b/public/app/plugins/datasource/prometheus/configuration/ConfigEditor.tsx index 82d80b12a65..f2f90f14e54 100644 --- a/public/app/plugins/datasource/prometheus/configuration/ConfigEditor.tsx +++ b/public/app/plugins/datasource/prometheus/configuration/ConfigEditor.tsx @@ -18,7 +18,7 @@ export const ConfigEditor = (props: Props) => { const alertmanagers = getAllAlertmanagerDataSources(); const azureAuthSettings = { - azureAuthSupported: !!config.featureToggles.prometheus_azure_auth, + azureAuthSupported: config.azureAuthEnabled, getAzureAuthEnabled: (config: DataSourceSettings): boolean => hasCredentials(config), setAzureAuthEnabled: (config: DataSourceSettings, enabled: boolean) => enabled ? setDefaultCredentials(config) : resetCredentials(config),