Fix all the old usage of admonition syntax (#107098)
This commit is contained in:
Jack Baldry
@@ -31,9 +31,9 @@ You can configure data source permissions to allow or deny certain users the abi
|
||||
- The `edit` permission allows users to query the data source, edit the data source’s configuration and delete the data source.
|
||||
- The `admin` permission allows users to query and edit the data source, change permissions on the data source and enable or disable query caching for the data source.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](../../introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
By default, data sources in an organization can be queried by any user in that organization. For example, a user with the `Viewer` role can issue any possible query to a data source, not just queries that exist on dashboards to which they have access. Additionally, by default, data sources can be edited by the user who created the data source, as well as users with the `Admin` role.
|
||||
|
||||
@@ -82,15 +82,15 @@ When using Grafana, a query pertains to a request for data frames to be modified
|
||||
|
||||
The caching feature works for **all** backend data sources. You can enable the cache globally in Grafana's [configuration](../../setup-grafana/configure-grafana/enterprise-configuration/#caching), and configure a cache duration (also called Time to Live, or TTL) for each data source individually.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](../../introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud/).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
The following cache backend options are available: in-memory, Redis, and Memcached.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Storing cached queries in-memory can increase Grafana's memory footprint. In production environments, a Redis or Memcached backend is highly recommended.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
When a panel queries a data source with cached data, it will either fetch fresh data or use cached data depending on the panel's **interval.** The interval is used to round the query time range to a nearby cached time range, increasing the likelihood of cache hits. Therefore, wider panels and dashboards with shorter time ranges fetch new data more often than narrower panels and dashboards with longer time ranges.
|
||||
|
||||
@@ -110,15 +110,15 @@ By reducing the number of queries and requests sent to data sources, caching can
|
||||
|
||||
Query caching works for Grafana's [built-in data sources](../../datasources/#built-in-core-data-sources), and [backend data source plugins](https://grafana.com/grafana/plugins/?type=datasource) that extend the `DataSourceWithBackend` class in the plugins SDK.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Logs Insights for the CloudWatch data source does not support query caching due to the way logs are requested from AWS.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
To verify that a data source works with query caching, follow the [instructions below](#enable-and-configure-query-caching) to **Enable and Configure query caching**. If caching is enabled in Grafana but the Caching tab is not visible for the given data source, then query caching is not available for that data source.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Some data sources, such as Elasticsearch, Prometheus, and Loki, cache queries themselves, so Grafana _query_ caching does not significantly improve performance. However, _resource_ caching may help. Refer to [plugin resources](https://grafana.com/developers/plugin-tools/key-concepts/backend-plugins/) for details.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
### Enable and configure query caching
|
||||
|
||||
@@ -137,9 +137,9 @@ You can optionally override a data source's configured TTL for individual dashbo
|
||||
|
||||
{{< figure max-width="500px" src="/media/docs/grafana/per-panel-cache-ttl-9-4.png" caption="Set Cache TTL for a single panel" >}}
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
If query caching is enabled and the Cache tab is not visible in a data source's settings, then query caching is not available for that data source.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
To configure global settings for query caching, refer to the `caching` section of [Configure Grafana Enterprise](../../setup-grafana/configure-grafana/enterprise-configuration/#caching).
|
||||
|
||||
@@ -158,9 +158,9 @@ To disable query caching for an entire Grafana instance, set the `enabled` flag
|
||||
|
||||
If you experience performance issues or repeated queries become slower to execute, consider clearing your cache.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
This action impacts all cache-enabled data sources. If you are using Memcached, the system clears all data from the Memcached instance.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
1. Click **Connections** in the left-side menu.
|
||||
1. Under Your Connections, click **Data sources**.
|
||||
|
||||
@@ -29,9 +29,9 @@ LBAC for data sources is currently generally available for `Loki` and in **exper
|
||||
| Loki | GA | GA |
|
||||
| Prometheus | PrivatePreview | PrivatePreview |
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
For enterprise this feature requires Grafana Enterprise Metrics (GEM) or Grafana Enterprise Logs (GEL) to function.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
**LBAC for data sources offers:**
|
||||
|
||||
|
||||
@@ -52,13 +52,13 @@ To download your Grafana Enterprise license:
|
||||
|
||||
You must install a Grafana Enterprise build to use the enterprise features, which you can [download](https://grafana.com/grafana/download?edition=enterprise).
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
|
||||
If you already use Grafana OSS, you can replace it with the same version of Grafana Enterprise.
|
||||
Ensure that you back up the configuration and database before proceeding.
|
||||
For more information, refer to [Back up Grafana](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/administration/back-up-grafana/).
|
||||
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
There is more than one way to add the license to a Grafana instance:
|
||||
|
||||
|
||||
@@ -88,9 +88,9 @@ For more information about adding users to an organization, refer to [Add a user
|
||||
|
||||
This action permanently removes an organization from your Grafana server.
|
||||
|
||||
{{% admonition type="warning" %}}
|
||||
{{< admonition type="warning" >}}
|
||||
Deleting the organization also deletes all teams and dashboards associated the organization.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
### Before you begin
|
||||
|
||||
|
||||
@@ -202,9 +202,9 @@ Users with the Grafana Server Admin flag on their account or access to the confi
|
||||
default_home_dashboard_path = data/main-dashboard.json
|
||||
```
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
On Linux, Grafana uses `/usr/share/grafana/public/dashboards/home.json` as the default home dashboard location.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
### Set the home dashboard for your organization
|
||||
|
||||
|
||||
@@ -222,7 +222,7 @@ All plugins are signed under a _signature level_. The signature level determines
|
||||
|
||||
{{< admonition type="note" >}}
|
||||
Unsigned plugins are not supported in Grafana Cloud.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
We strongly recommend that you don't run unsigned plugins in your Grafana instance. However, if you're aware of the risks and you still want to load an unsigned plugin, refer to [Configuration](../../setup-grafana/configure-grafana/#allow_loading_unsigned_plugins).
|
||||
|
||||
|
||||
@@ -21,15 +21,15 @@ Recorded queries allow you to see trends over time by taking a snapshot of a dat
|
||||
|
||||
For our plugins that do not return time series, it might be useful to plot historical data. For example, you might want to query ServiceNow to see a history of request response times but it can only return current point-in-time metrics.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](https://grafana.com/docs/grafana-cloud/).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
## How recorded queries work
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
An administrator must configure a Prometheus data source and associate it with a [Remote write target](#remote-write-target) before recorded queries can be used.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
Recorded queries only work with backend data source plugins. Refer to [Backend data source plugin](/tutorials/build-a-data-source-backend-plugin/) for more information about backend data source plugins. You can recorded four types of queries:
|
||||
|
||||
|
||||
@@ -25,17 +25,17 @@ You can assign a user one of three types of permissions:
|
||||
- Organization permissions: Manage access to dashboards, alerts, plugins, teams, playlists, and other resources for an entire organization. The available roles are Viewer, Editor, and Admin.
|
||||
- Dashboard and folder permission: Manage access to dashboards and folders
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
If you are running Grafana Enterprise, you can also control access to data sources and use role-based access control to grant user access to read and write permissions to specific Grafana resources. For more information about access control options available with Grafana Enterprise, refer to [Grafana Enterprise user permissions features](#grafana-enterprise-user-permissions-features).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
## Grafana server administrators
|
||||
|
||||
A Grafana server administrator manages server-wide settings and access to resources such as organizations, users, and licenses. Grafana includes a default server administrator that you can use to manage all of Grafana, or you can divide that responsibility among other server administrators that you create.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
The server administrator role does not mean that the user is also a Grafana [organization administrator](#organization-roles).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
A server administrator can perform the following tasks:
|
||||
|
||||
@@ -45,9 +45,9 @@ A server administrator can perform the following tasks:
|
||||
- View Grafana server statistics, including total users and active sessions
|
||||
- Upgrade the server to Grafana Enterprise.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
The server administrator role does not exist in Grafana Cloud.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
To assign or remove server administrator privileges, see [Server user management](../user-management/server-user-management/assign-remove-server-admin-privileges/).
|
||||
|
||||
|
||||
@@ -102,9 +102,9 @@ refs:
|
||||
|
||||
# Role-based access control (RBAC)
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
RBAC provides a standardized way of granting, changing, and revoking access when it comes to viewing and modifying Grafana resources, such as dashboards, reports, and administrative settings.
|
||||
|
||||
@@ -151,9 +151,9 @@ Each basic role is comprised of a number of _permissions_. For example, the view
|
||||
- `Action: annotations:write, Scope: annotations:type:dashboard`: Enables the viewer to modify annotations of a dashboard.
|
||||
- `Action: annotations:delete, Scope: annotations:type:dashboard`: Enables the viewer to remove annotations from a dashboard.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
You can't have a Grafana user without a basic role assigned. The `None` role contains no permissions.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
#### Basic role modification
|
||||
|
||||
@@ -165,9 +165,9 @@ For example, if you modify Viewer basic role and grant additional permission, Ed
|
||||
For more information about the permissions associated with each basic role, refer to [Basic role definitions](ref:rbac-role-definitions-basic-role-assignments).
|
||||
To interact with the API and view or modify basic roles permissions, refer to [the table](ref:rbac-basic-role-uid-mapping) that maps basic role names to the associated UID.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
You cannot use a service account to modify basic roles via the RBAC API. To update basic roles, you must be a Grafana administrator and use basic authentication with the request.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
### Fixed roles
|
||||
|
||||
|
||||
+2
-2
@@ -41,9 +41,9 @@ refs:
|
||||
|
||||
# Assign RBAC roles
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
In this topic you'll learn how to use the role picker, provisioning, and the HTTP API to assign fixed and custom roles to users and teams.
|
||||
|
||||
|
||||
+2
-2
@@ -13,9 +13,9 @@ weight: 30
|
||||
|
||||
# Configure RBAC in Grafana
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
The table below describes all RBAC configuration options. Like any other Grafana configuration, you can apply these options as [environment variables](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/#override-configuration-with-environment-variables).
|
||||
|
||||
|
||||
+8
-8
@@ -72,9 +72,9 @@ refs:
|
||||
|
||||
# Manage RBAC roles
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
This section includes instructions for how to view permissions associated with roles, create custom roles, and update and delete roles.
|
||||
|
||||
@@ -255,9 +255,9 @@ roles:
|
||||
|
||||
The following examples show you how to create a custom role using the Grafana HTTP API. For more information about the HTTP API, refer to [Create a new custom role](ref:api-rbac-create-a-new-custom-role).
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
You cannot create a custom role with permissions that you do not have. For example, if you only have `users:create` permissions, then you cannot create a role that includes other permissions.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
The following example creates a `custom:users:admin` role and assigns the `users:create` action to it.
|
||||
|
||||
@@ -314,9 +314,9 @@ If the default basic role definitions do not meet your requirements, you can cha
|
||||
|
||||
- Determine the permissions you want to add or remove from a basic role. For more information about the permissions associated with basic roles, refer to [RBAC role definitions](ref:rbac-fixed-basic-role-definitions-basic-role-assignments).
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
You cannot modify the `No Basic Role` permissions.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
**To change permissions from a basic role:**
|
||||
|
||||
@@ -371,10 +371,10 @@ roles:
|
||||
scope: 'folder:*'
|
||||
```
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
You can add multiple `fixed`, `basic` or `custom` roles to the `from` section. Their permissions will be copied and added to the basic role.
|
||||
Make sure to **increment** the role version for the changes to be accounted for.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
You can also change basic roles' permissions using the API. Refer to the [RBAC HTTP API](ref:api-rbac-update-a-role) for more details.
|
||||
|
||||
|
||||
+8
-8
@@ -41,9 +41,9 @@ refs:
|
||||
|
||||
# Plan your RBAC rollout strategy
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
An RBAC rollout strategy helps you determine _how_ you want to implement RBAC prior to assigning RBAC roles to users and teams.
|
||||
|
||||
@@ -92,13 +92,13 @@ Consider the following guidelines when you determine if you should modify basic
|
||||
|
||||
- **Modify basic roles** when Grafana's definitions of what viewers, editors, and admins can do does not match your definition of these roles. You can add or remove permissions from any basic role.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Changes that you make to basic roles impact the role definition for all [organizations](/docs/grafana/<GRAFANA_VERSION>/administration/organization-management/) in the Grafana instance. For example, when you add the `fixed:users:writer` role's permissions to the viewer basic role, all viewers in any org in the Grafana instance can create users within that org.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
You cannot modify the `No Basic Role` permissions.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
- **Create custom roles** when fixed role definitions don't meet you permissions requirements. For example, the `fixed:dashboards:writer` role allows users to delete dashboards. If you want some users or teams to be able to create and update but not delete dashboards, you can create a custom role with a name like `custom:dashboards:creator` that lacks the `dashboards:delete` permission.
|
||||
|
||||
@@ -115,9 +115,9 @@ Use any of the following methods to assign RBAC roles to users and teams.
|
||||
|
||||
We've compiled the following permissions rollout scenarios based on current Grafana implementations.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
If you have a use case that you'd like to share, feel free to contribute to this docs page. We'd love to hear from you!
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
### Provide internal viewer employees with the ability to use Explore, but prevent external viewer contractors from using Explore
|
||||
|
||||
|
||||
+6
-6
@@ -46,9 +46,9 @@ refs:
|
||||
|
||||
# RBAC role definitions
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
The following tables list permissions associated with basic and fixed roles.
|
||||
|
||||
@@ -167,14 +167,14 @@ For more information about the permissions required to access alert rules, refer
|
||||
|
||||
### Grafana OnCall roles (beta)
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available from Grafana 9.4 in early access.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
This feature is behind the `accessControlOnCall` feature toggle.
|
||||
You can enable feature toggles through configuration file or environment variables. See configuration [docs](/docs/grafana/<GRAFANA_VERSION>/setup-grafana/configure-grafana/#feature_toggles) for details.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
If you are using [Grafana OnCall](ref:oncall), you can try out the integration between Grafana OnCall and RBAC.
|
||||
For a detailed list of the available OnCall RBAC roles, refer to the table in [Available Grafana OnCall RBAC roles and granted actions](ref:available-grafana-oncall-rbac-roles--granted-actions).
|
||||
|
||||
+2
-2
@@ -33,9 +33,9 @@ refs:
|
||||
|
||||
# RBAC for app plugins
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Cloud](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
RBAC can be used to manage access to [app plugins](https://grafana.com/docs/grafana/latest/administration/plugin-management/#app-plugins).
|
||||
Each app plugin grants the basic Viewer, Editor and Admin organization roles a default set of plugin permissions.
|
||||
|
||||
+2
-2
@@ -51,9 +51,9 @@ refs:
|
||||
|
||||
# Provisioning RBAC with Grafana
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
You can create, change or remove [Custom roles](ref:manage-rbac-roles-create-custom-roles-using-provisioning) and create or remove [basic role assignments](ref:assign-rbac-roles-assign-a-fixed-role-to-a-basic-role-using-provisioning), by adding one or more YAML configuration files in the `provisioning/access-control/` directory.
|
||||
|
||||
|
||||
+2
-2
@@ -45,9 +45,9 @@ refs:
|
||||
|
||||
# Provisioning RBAC with Terraform
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
You can create, change or remove [Custom roles](https://registry.terraform.io/providers/grafana/grafana/latest/docs/resources/role) and create or remove [basic and custom role assignments](https://registry.terraform.io/providers/grafana/grafana/latest/docs/resources/role_assignment), by using [Terraform's Grafana provider](https://registry.terraform.io/providers/grafana/grafana/latest/docs).
|
||||
|
||||
|
||||
+4
-4
@@ -26,9 +26,9 @@ filters = accesscontrol:debug accesscontrol.evaluator:debug dashboard.permission
|
||||
|
||||
## Enable audit logging
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Available in [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/) and [Grafana Cloud](/docs/grafana-cloud).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
You can enable auditing in the Grafana configuration file.
|
||||
|
||||
@@ -46,10 +46,10 @@ Learn more about [access control audit logs](/docs/grafana/<GRAFANA_VERSION>/set
|
||||
This happens when an instance is downgraded from a version that uses RBAC to a version that uses the legacy access control, and dashboard, folder or data source permissions are updated.
|
||||
These permission updates will not be applied to RBAC, so permissions will be out of sync when the instance is next upgraded to a version with RBAC.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
the steps provided below will set all dashboard, folder and data source permissions to what they are set to with the legacy access control.
|
||||
If you have made dashboard, folder or data source permission updates with RBAC enabled, these updates will be wiped.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
To resynchronize the permissions:
|
||||
|
||||
|
||||
@@ -76,11 +76,11 @@ A common use case for creating a service account is to perform operations on aut
|
||||
|
||||
In [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/), you can also use service accounts in combination with [role-based access control](ref:rbac) to grant very specific permissions to applications that interact with Grafana.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Service accounts can only act in the organization they are created for. If you have the same task that is needed for multiple organizations, we recommend creating service accounts in each organization.
|
||||
|
||||
Service accounts can't be used for instance-wide operations, such as global user management and organization management. For these tasks, you need to use a user with [Grafana server administrator permissions](ref:roles-and-permissions).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
{{< vimeo 742056367 >}}
|
||||
|
||||
@@ -166,9 +166,9 @@ You can assign organization roles to a service account using the Grafana UI or v
|
||||
|
||||
In [Grafana Enterprise](/docs/grafana/<GRAFANA_VERSION>/introduction/grafana-enterprise/), you can also [assign RBAC roles](ref:rbac-assign-rbac-roles) to grant very specific permissions to applications that interact with Grafana.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Since Grafana 10.2.0, the `No Basic Role` is available for organization users or service accounts. This role has no permissions. Permissions can be granted with RBAC.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
### Before you begin
|
||||
|
||||
@@ -235,10 +235,10 @@ To list your token's permissions, use the `/api/access-control/user/permissions`
|
||||
|
||||
#### Example
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
The following command output is shortened to show only the relevant content.
|
||||
Authorize your request with the token whose permissions you want to check.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
```bash
|
||||
curl -H "Authorization: Bearer glsa_HOruNAb7SOiCdshU9algkrq7FDsNSLAa_54e2f8be" -X GET '<grafana_url>/api/access-control/user/permissions' | jq
|
||||
|
||||
@@ -40,9 +40,9 @@ refs:
|
||||
|
||||
# Migrate API keys to service account tokens
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
API keys are deprecated. [Service accounts](ref:service-accounts) now replace API keys for authenticating with the **HTTP APIs** and interacting with Grafana.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
API keys specify a role—either **Admin**, **Editor**, or **Viewer**—that determine the permissions associated with interacting with Grafana.
|
||||
|
||||
@@ -252,9 +252,9 @@ This section shows you how to migrate your Terraform configuration for Grafana c
|
||||
|
||||
For migration your cloud stack api keys, use the `grafana_cloud_stack_service_account` and `gafana_cloud_stack_service_account_token` resources. For additional information, refer to [Grafana Cloud Stack Service Accounts in Terraform](https://registry.terraform.io/providers/grafana/grafana/latest/docs/resources/cloud_stack_service_account).
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
This is only relevant for Grafana Cloud **Stack** API keys `grafana_cloud_stack_api_key`. Grafana Cloud API keys resource `grafana_cloud_api_key` are not deprecated and should be used for authentication for managing your Grafana cloud.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
#### Steps
|
||||
|
||||
|
||||
@@ -41,9 +41,9 @@ When you grant folder permissions, that setting applies to all dashboards and su
|
||||
|
||||
For example, if a user with the viewer organization role requires editor (or admin) access to a dashboard, you can assign those elevated permissions on an individual basis.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
If you have assigned a user dashboard folder permissions, you cannot also assign the user permission to dashboards contained in the folder.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
Grant dashboard permissions when you want to restrict or enhance dashboard access for users who do not have permissions defined in the associated folder.
|
||||
|
||||
|
||||
@@ -21,9 +21,9 @@ Organization administrators can invite users to join their organization. Organiz
|
||||
|
||||
For more information about organization user permissions, refer to [Organization users and permissions](../../roles-and-permissions/#organization-users-and-permissions).
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Users added at the organization level will have access to all stacks and services by default, without the ability to be filtered by stack unless Single Sign-On (SSO) or Role-Based Access Control (RBAC) is implemented.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
{{< section >}}
|
||||
|
||||
@@ -40,17 +40,17 @@ You can see a list of users with accounts in your Grafana organization. If neces
|
||||
1. Sign in to Grafana as an organization administrator.
|
||||
1. Navigate to **Administration > Users and access > Users**.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
If you have [server administrator](../../roles-and-permissions/#grafana-server-administrators) permissions, you can also [view a global list of users](../server-user-management/#view-a-list-of-users) in the Server Admin section of Grafana.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
## Change a user's organization permissions
|
||||
|
||||
Update user permissions when you want to enhance or restrict a user's access to organization resources. For more information about organization permissions, refer to [Organization roles](../../roles-and-permissions/#organization-roles).
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Organization roles sync from the authentication provider on user sign-in. To prevent synchronization of organization roles from the authentication provider regardless of their role in the authentication provider, then refer to the `skip_org_role_sync` setting in your Grafana configuration. Refer to [skip org role sync](../../../setup-grafana/configure-grafana/#authgrafana_com-skip_org_role_sync) for more information.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
### Before you begin
|
||||
|
||||
@@ -68,9 +68,9 @@ Organization roles sync from the authentication provider on user sign-in. To pre
|
||||
1. Select the role that you want to assign.
|
||||
1. Click **Update**.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
If you have [server administrator](../../roles-and-permissions/#grafana-server-administrators) permissions, you can also [change a user's organization permissions](../server-user-management/change-user-org-permissions/) in the Server Admin section.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
## Invite a user to join an organization
|
||||
|
||||
@@ -79,9 +79,9 @@ When you invite users to join an organization, you assign the **Admin**, **Edito
|
||||
- If you know that the user already has access Grafana and you know their user name, then you issue an invitation by entering their user name.
|
||||
- If the user is new to Grafana, then use their email address to issue an invitation. The system automatically creates the user account on first sign in.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
If you have [server administrator](../../roles-and-permissions/#grafana-server-administrators) permissions, you can also manually [add a user to an organization](../server-user-management/add-remove-user-to-org/).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
### Before you begin
|
||||
|
||||
@@ -116,9 +116,9 @@ If the invitee is not already a user, the system adds them.
|
||||
|
||||
Periodically review invitations you have sent so that you can see a list of users that have not yet accepted the invitation or cancel a pending invitation.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
The **Pending Invites** button is only visible if there are unanswered invitations.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
### Before you begin
|
||||
|
||||
|
||||
@@ -41,9 +41,9 @@ You can see a list of users with accounts on your Grafana server. This action mi
|
||||
1. Sign in to Grafana as a server administrator.
|
||||
1. Click **Administration** in the left-side menu, **Users and access**, and then **Users**.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
If you have [organization administrator](../../roles-and-permissions/#organization-roles) permissions and _not_ [server administrator](../../roles-and-permissions/#grafana-server-administrators) permissions, you can still [view of list of users in a given organization](../manage-org-users/#view-a-list-of-organization-users).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
## View user details
|
||||
|
||||
@@ -121,9 +121,9 @@ When you configure advanced authentication using Oauth, SAML, LDAP, or the Auth
|
||||
|
||||
When you create a user, the system assigns the user viewer permissions in a default organization, which you can change. You can now [add a user to a second organization](add-remove-user-to-org/).
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
If you have [organization administrator](../../roles-and-permissions/#organization-roles) permissions and _not_ [server administrator](../../roles-and-permissions/#grafana-server-administrators) permissions, you can still add users by [inviting a user to join an organization](../manage-org-users/#invite-a-user-to-join-an-organization).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
## Force a user to log out of Grafana
|
||||
|
||||
|
||||
+2
-2
@@ -42,9 +42,9 @@ You are required to specify an Admin role for each organization. The first user
|
||||
|
||||
The next time the user signs in, they will be able to navigate to their new organization using the Switch Organizations option in the user profile menu.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
If you have [organization administrator](../../../roles-and-permissions/#organization-roles) permissions and _not_ [server administrator](../../../roles-and-permissions/#grafana-server-administrators) permissions, you can still [invite a user to join an organization](../../manage-org-users/#invite-a-user-to-join-an-organization).
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
## Remove a user from an organization
|
||||
|
||||
|
||||
+2
-2
@@ -15,9 +15,9 @@ weight: 20
|
||||
|
||||
Grafana server administrators are responsible for creating users, organizations, and managing permissions. For more information about the server administration role, refer to [Grafana server administrators](../../../roles-and-permissions/#grafana-server-administrators).
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
Server administrators are "super-admins" with full permissions to create, read, update, and delete all resources and users in all organizations, as well as update global settings such as licenses. Only grant this permission to trusted users.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
## Before you begin
|
||||
|
||||
|
||||
@@ -26,9 +26,9 @@ You can also view important information about your account, such as the organiza
|
||||
|
||||
You can change your Grafana password at any time.
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
{{< admonition type="note" >}}
|
||||
If your Grafana instance uses an external authentication provider, then you might not be able to change your password in Grafana. Contact your Grafana administrator for more information.
|
||||
{{% /admonition %}}
|
||||
{{< /admonition >}}
|
||||
|
||||
**To change your password**:
|
||||
|
||||
|
||||
Reference in New Issue
Block a user