LBAC for data sources: PublicPreview and self serve enablement (#102276)
* Publicpreview and self serve of lbac for mimir * update from review
This commit is contained in:
Eric Leijonmarck
@@ -24,10 +24,10 @@ Label-Based Access Control (LBAC) allows fine-grained access control to data sou
|
||||
|
||||
LBAC for data sources is currently generally available for `Loki` and in **experimental** for `Prometheus`. Support for additional data sources may be added in future updates.
|
||||
|
||||
| Data source | [Grafana Cloud](/docs/grafana-cloud) | [Grafana Enterprise](../../../introduction/grafana-enterprise/) |
|
||||
| ----------- | ------------------------------------ | --------------------------------------------------------------- |
|
||||
| Loki | GA | GA |
|
||||
| Prometheus | PrivatePreview | PrivatePreview |
|
||||
| Data source | Grafana Cloud | Grafana Enterprise |
|
||||
| ----------- | ------------- | --------------------------------------------------------- |
|
||||
| Loki | GA | GA (requires GEL - Grafana Enterprise Logs) |
|
||||
| Prometheus | PublicPreview | PublicPreview (requires GEM - Grafana Enterprise Metrics) |
|
||||
|
||||
{{% admonition type="note" %}}
|
||||
For enterprise this feature requires Grafana Enterprise Metrics (GEM) or Grafana Enterprise Logs (GEL) to function.
|
||||
@@ -73,6 +73,7 @@ To be able to use LBAC for data sources metrics, you need to enable the feature
|
||||
- If an administrator is part of a team with LBAC for data sources rules, those rules are applied to the administrator requests.
|
||||
- Cloud Access Policy (CAP) LBAC rules override LBAC for data sources rules.
|
||||
CAP are the access controls from Grafana Cloud.
|
||||
- Note that these data sources must be created manually - provisioning is not yet supported.
|
||||
|
||||
You must remove any label selectors from your Cloud Access Policy that is configured for the data source, otherwise the CAP label selectors override the LBAC for data sources rules. For more information about CAP label selectors, refer to [Use label-based access control (LBAC) with access policies](https://grafana.com/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/label-access-policies/).
|
||||
|
||||
|
||||
+2
-2
@@ -22,7 +22,7 @@ You cannot configure LBAC rules for Grafana-provisioned data sources from the UI
|
||||
|
||||
## Before you begin
|
||||
|
||||
To be able to use LBAC for Prometheus data sources, you need to enable the feature toggle `teamHttpHeadersMimir` on your Grafana instance. Contact support to enable the feature toggle for you.
|
||||
To be able to use LBAC for Prometheus data sources, you need to enable the feature toggle `teamHttpHeadersMimir` on your Grafana instance. Go to the feature toggles page in setting to enable the feature.
|
||||
|
||||
- Be sure that you have the permission setup to create a Prometheus tenant in Grafana Cloud
|
||||
- Be sure that you have admin data source permissions for Grafana.
|
||||
@@ -57,7 +57,7 @@ For more information on how to setup LBAC for data sources rules for a Prometheu
|
||||
|
||||
## Grafana Enterprise
|
||||
|
||||
LBAC for data sources is available in Grafana Enterprise for Prometheus created with basic authentication. Prometheus data sources for LBAC for data sources can only be created.
|
||||
LBAC for data sources is available in Grafana Enterprise for Prometheus connected to GEM created with basic authentication.
|
||||
|
||||
You cannot configure LBAC rules for Grafana-provisioned data sources from the UI. Alternatively, you can replicate the setting of the provisioned data source in a new data source as described in [LBAC Configuration for new Prometheus data source](https://grafana.com/docs/grafana/<GRAFANA_VERSION>/administration/data-source-management/teamlbac/configure-teamlbac-for-prometheus/#task-1-lbac-configuration-for-new-prometheus-data-source) and then add the LBAC configuration to the new data source.
|
||||
|
||||
|
||||
@@ -115,6 +115,7 @@ Most [generally available](https://grafana.com/docs/release-life-cycle/#general-
|
||||
| `improvedExternalSessionHandling` | Enables improved support for OAuth external sessions. After enabling this feature, users might need to re-authenticate themselves. |
|
||||
| `elasticsearchCrossClusterSearch` | Enables cross cluster search in the Elasticsearch datasource |
|
||||
| `improvedExternalSessionHandlingSAML` | Enables improved support for SAML external sessions. Ensure the NameID format is correctly configured in Grafana for SAML Single Logout to function properly. |
|
||||
| `teamHttpHeadersMimir` | Enables LBAC for datasources for Mimir to apply LBAC filtering of metrics to the client requests for users in teams |
|
||||
| `exploreMetricsUseExternalAppPlugin` | Use the externalized Grafana Metrics Drilldown (formerly known as Explore Metrics) app plugin |
|
||||
| `alertRuleRestore` | Enables the alert rule restore feature |
|
||||
|
||||
@@ -215,7 +216,6 @@ Experimental features might be changed or removed without prior notice.
|
||||
| `investigationsBackend` | Enable the investigations backend API |
|
||||
| `k8SFolderCounts` | Enable folder's api server counts |
|
||||
| `k8SFolderMove` | Enable folder's api server move |
|
||||
| `teamHttpHeadersMimir` | Enables LBAC for datasources for Mimir to apply LBAC filtering of metrics to the client requests for users in teams |
|
||||
| `templateVariablesUsesCombobox` | Use new combobox component for template variables |
|
||||
| `grafanaAdvisor` | Enables Advisor app |
|
||||
| `elasticsearchImprovedParsing` | Enables less memory intensive Elasticsearch result parsing |
|
||||
|
||||
@@ -1604,9 +1604,9 @@ var (
|
||||
{
|
||||
Name: "teamHttpHeadersMimir",
|
||||
Description: "Enables LBAC for datasources for Mimir to apply LBAC filtering of metrics to the client requests for users in teams",
|
||||
Stage: FeatureStageExperimental,
|
||||
Stage: FeatureStagePublicPreview,
|
||||
FrontendOnly: false,
|
||||
AllowSelfServe: false,
|
||||
AllowSelfServe: true,
|
||||
Owner: identityAccessTeam,
|
||||
},
|
||||
{
|
||||
|
||||
@@ -212,7 +212,7 @@ investigationsBackend,experimental,@grafana/grafana-app-platform-squad,false,fal
|
||||
k8SFolderCounts,experimental,@grafana/search-and-storage,false,false,false
|
||||
k8SFolderMove,experimental,@grafana/search-and-storage,false,false,false
|
||||
improvedExternalSessionHandlingSAML,preview,@grafana/identity-access-team,false,false,false
|
||||
teamHttpHeadersMimir,experimental,@grafana/identity-access-team,false,false,false
|
||||
teamHttpHeadersMimir,preview,@grafana/identity-access-team,false,false,false
|
||||
ABTestFeatureToggleA,experimental,@grafana/sharing-squad,false,false,false
|
||||
templateVariablesUsesCombobox,experimental,@grafana/grafana-frontend-platform,false,false,true
|
||||
ABTestFeatureToggleB,experimental,@grafana/sharing-squad,false,false,false
|
||||
|
||||
|
@@ -4040,13 +4040,17 @@
|
||||
{
|
||||
"metadata": {
|
||||
"name": "teamHttpHeadersMimir",
|
||||
"resourceVersion": "1736763800062",
|
||||
"creationTimestamp": "2025-01-13T10:42:47Z"
|
||||
"resourceVersion": "1742208227420",
|
||||
"creationTimestamp": "2025-01-13T10:42:47Z",
|
||||
"annotations": {
|
||||
"grafana.app/updatedTimestamp": "2025-03-17 10:43:47.420599 +0000 UTC"
|
||||
}
|
||||
},
|
||||
"spec": {
|
||||
"description": "Enables LBAC for datasources for Mimir to apply LBAC filtering of metrics to the client requests for users in teams",
|
||||
"stage": "experimental",
|
||||
"codeowner": "@grafana/identity-access-team"
|
||||
"stage": "preview",
|
||||
"codeowner": "@grafana/identity-access-team",
|
||||
"allowSelfServe": true
|
||||
}
|
||||
},
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user