public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[release-11.6.1] Alertmanager: Add Role-Based Access Control via reqAction Field (#103479)

Browse Source 
Alertmanager: Add Role-Based Access Control via reqAction Field (#101543)

* Add reqAction for alert manager routes
* Add endpoints from Prometheus Alertmanager API
* use notifications reader for alertmanager/api/v2/status
* use viewer for GET api/v1/alerts
* add POST DELETE for api/v1/alerts
* duplicate paths to cover upstream Alertmanager
* add fallback rule to catch all GET
* Update reqAction for GET api/v1/alerts
* require Admin for all wildcard paths

---------

Signed-off-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>
Co-authored-by: Yuri Tseretyan <yuriy.tseretyan@grafana.com>
(cherry picked from commit ac7ad27867)

Co-authored-by: Oleg Yevik <olegyevik@canva.com>
This commit is contained in:
Yuri Tseretyan
2025-04-04 22:48:12 +03:00
committed by GitHub
co-authored by Oleg Yevik
parent af423e17a7
commit ac77bc7cbb
1 changed files with 119 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/app/plugins/datasource/alertmanager/plugin.json
+119 -14
View File
@@ -5,40 +5,145 @@
"metrics": false,
"routes": [
{
"method": "POST",
"method": "GET",
"path": "alertmanager/api/v2/silences",
"reqRole": "Editor"
},
{
"method": "DELETE",
"path": "alertmanager/api/v2/silence",
"reqRole": "Editor"
"reqRole": "Viewer",
"reqAction": "alert.instances.external:read"
},
{
"method": "GET",
"path": "alertmanager/api/v2/silences",
"reqRole": "Viewer"
"path": "api/v2/silences",
"reqRole": "Viewer",
"reqAction": "alert.instances.external:read"
},
{
"method": "POST",
"reqRole": "Editor"
"path": "alertmanager/api/v2/silences",
"reqRole": "Editor",
"reqAction": "alert.instances.external:write"
},
{
"method": "PUT",
"reqRole": "Editor"
"method": "POST",
"path": "api/v2/silences",
"reqRole": "Editor",
"reqAction": "alert.instances.external:write"
},
{
"method": "GET",
"path": "alertmanager/api/v2/silence/",
"reqRole": "Viewer",
"reqAction": "alert.instances.external:read"
},
{
"method": "GET",
"path": "api/v2/silence/",
"reqRole": "Viewer",
"reqAction": "alert.instances.external:read"
},
{
"method": "DELETE",
"reqRole": "Editor"
"path": "alertmanager/api/v2/silence/",
"reqRole": "Editor",
"reqAction": "alert.instances.external:write"
},
{
"method": "DELETE",
"path": "api/v2/silence/",
"reqRole": "Editor",
"reqAction": "alert.instances.external:write"
},
{
"method": "GET",
"path": "alertmanager/api/v2/alerts/groups",
"reqRole": "Viewer",
"reqAction": "alert.instances.external:read"
},
{
"method": "GET",
"path": "api/v2/alerts/groups",
"reqRole": "Viewer",
"reqAction": "alert.instances.external:read"
},
{
"method": "GET",
"path": "alertmanager/api/v2/alerts",
"reqRole": "Viewer"
"reqRole": "Viewer",
"reqAction": "alert.instances.external:read"
},
{
"method": "GET",
"path": "api/v2/alerts",
"reqRole": "Viewer",
"reqAction": "alert.instances.external:read"
},
{
"method": "POST",
"path": "alertmanager/api/v2/alerts",
"reqRole": "Editor",
"reqAction": "alert.instances.external:write"
},
{
"method": "POST",
"path": "api/v2/alerts",
"reqRole": "Editor",
"reqAction": "alert.instances.external:write"
},
{
"method": "GET",
"path": "alertmanager/api/v2/status",
"reqRole": "Viewer",
"reqAction": "alert.notifications.external:read"
},
{
"method": "GET",
"path": "api/v2/status",
"reqRole": "Viewer",
"reqAction": "alert.notifications.external:read"
},
{
"method": "GET",
"path": "alertmanager/api/v2/receivers",
"reqRole": "Viewer",
"reqAction": "alert.instances.external:read"
},
{
"method": "GET",
"path": "api/v2/receivers",
"reqRole": "Viewer",
"reqAction": "alert.instances.external:read"
},
{
"method": "GET",
"path": "api/v1/alerts",
"reqRole": "Viewer",
"reqAction": "alert.notifications.external:read"
},
{
"method": "POST",
"path": "api/v1/alerts",
"reqRole": "Editor",
"reqAction": "alert.notifications.external:write"
},
{
"method": "DELETE",
"path": "api/v1/alerts",
"reqRole": "Editor",
"reqAction": "alert.notifications.external:write"
},
{
"method": "POST",
"reqRole": "Admin"
},
{
"method": "PUT",
"reqRole": "Admin"
},
{
"method": "DELETE",
"reqRole": "Admin"
},
{
"method": "GET",
"reqRole": "Admin"
}
],