public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v11.0.x] Prometheus: Reintroduce Azure audience override feature flag (#90558)

Browse Source 
Prometheus: Reintroduce Azure audience override feature flag (#90339)

* Re-add feature flag with deprecation note

* Hide the field in frontend if ff disabled

* Block scope overriding if ff is disabled in backend

- Update promlib to forward logger to extendOptions
- Add warning
- Update tests

* Default toggle to true for now

* Update description

* Update prom tests

* Fix lint

(cherry picked from commit 2616366a0a)

# Conflicts:
#	packages/grafana-data/src/types/featureToggles.gen.ts
#	pkg/services/featuremgmt/registry.go
#	pkg/services/featuremgmt/toggles_gen.csv
#	pkg/services/featuremgmt/toggles_gen.go
#	pkg/services/featuremgmt/toggles_gen.json
#	pkg/tsdb/prometheus/prometheus.go
This commit is contained in:
Andreas Christou
2024-07-23 11:31:22 +01:00
committed by GitHub
parent d6e53930bc
commit ee76613eae
13 changed files with 126 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/tsdb/prometheus/azureauth/azure.go
+9 -3
View File
@@ -10,12 +10,13 @@ import (
"github.com/grafana/grafana-azure-sdk-go/v2/azsettings"
"github.com/grafana/grafana-plugin-sdk-go/backend"
sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
"github.com/grafana/grafana-plugin-sdk-go/backend/log"
"github.com/grafana/grafana-plugin-sdk-go/data/utils/maputil"
"github.com/grafana/grafana/pkg/promlib/utils"
)
func ConfigureAzureAuthentication(settings backend.DataSourceInstanceSettings, azureSettings *azsettings.AzureSettings, clientOpts *sdkhttpclient.Options) error {
func ConfigureAzureAuthentication(settings backend.DataSourceInstanceSettings, azureSettings *azsettings.AzureSettings, clientOpts *sdkhttpclient.Options, audienceOverride bool, log log.Logger) error {
jsonData, err := utils.GetJsonData(settings)
if err != nil {
return fmt.Errorf("failed to get jsonData: %w", err)
@@ -29,7 +30,7 @@ func ConfigureAzureAuthentication(settings backend.DataSourceInstanceSettings, a
if credentials != nil {
var scopes []string
if scopes, err = getOverriddenScopes(jsonData); err != nil {
if scopes, err = getOverriddenScopes(jsonData, audienceOverride, log); err != nil {
return err
}
@@ -47,7 +48,7 @@ func ConfigureAzureAuthentication(settings backend.DataSourceInstanceSettings, a
return nil
}
func getOverriddenScopes(jsonData map[string]any) ([]string, error) {
func getOverriddenScopes(jsonData map[string]any, audienceOverride bool, log log.Logger) ([]string, error) {
resourceIdStr, err := maputil.GetStringOptional(jsonData, "azureEndpointResourceId")
if err != nil {
err = fmt.Errorf("overridden resource ID (audience) invalid")
@@ -56,6 +57,11 @@ func getOverriddenScopes(jsonData map[string]any) ([]string, error) {
return nil, nil
}
if !audienceOverride {
log.Warn("Specifying an audience override requires the prometheusAzureOverrideAudience feature toggle to be enabled. This functionality is deprecated and will be removed in a future release.")
return nil, nil
}
resourceId, err := url.Parse(resourceIdStr)
if err != nil || resourceId.Scheme == "" || resourceId.Host == "" {
err = fmt.Errorf("overridden endpoint resource ID (audience) '%s' invalid", resourceIdStr)
pkg/tsdb/prometheus/azureauth/azure_test.go
+54 -6
View File
@@ -1,18 +1,39 @@
package azureauth
import (
"bytes"
"context"
"testing"
"github.com/grafana/grafana-azure-sdk-go/v2/azcredentials"
"github.com/grafana/grafana-azure-sdk-go/v2/azsettings"
"github.com/grafana/grafana-plugin-sdk-go/backend"
sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
"github.com/grafana/grafana-plugin-sdk-go/backend/log"
"github.com/hashicorp/go-hclog"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
type fakeLogger struct {
hclog.Logger
level log.Level
}
func (l fakeLogger) Level() log.Level {
return l.level
}
func (l fakeLogger) FromContext(ctx context.Context) log.Logger {
return fakeLogger{}
}
func (l fakeLogger) With(args ...interface{}) log.Logger {
return fakeLogger{}
}
func TestConfigureAzureAuthentication(t *testing.T) {
azureSettings := &azsettings.AzureSettings{}
testLogger := backend.Logger
t.Run("should set Azure middleware when JsonData contains valid credentials", func(t *testing.T) {
settings := backend.DataSourceInstanceSettings{
@@ -26,7 +47,7 @@ func TestConfigureAzureAuthentication(t *testing.T) {
var opts = &sdkhttpclient.Options{CustomOptions: map[string]any{}}
err := ConfigureAzureAuthentication(settings, azureSettings, opts)
err := ConfigureAzureAuthentication(settings, azureSettings, opts, false, testLogger)
require.NoError(t, err)
require.NotNil(t, opts.Middlewares)
@@ -40,7 +61,7 @@ func TestConfigureAzureAuthentication(t *testing.T) {
var opts = &sdkhttpclient.Options{CustomOptions: map[string]any{}}
err := ConfigureAzureAuthentication(settings, azureSettings, opts)
err := ConfigureAzureAuthentication(settings, azureSettings, opts, false, testLogger)
require.NoError(t, err)
assert.NotContains(t, opts.CustomOptions, "_azureCredentials")
@@ -55,7 +76,7 @@ func TestConfigureAzureAuthentication(t *testing.T) {
}
var opts = &sdkhttpclient.Options{CustomOptions: map[string]any{}}
err := ConfigureAzureAuthentication(settings, azureSettings, opts)
err := ConfigureAzureAuthentication(settings, azureSettings, opts, false, testLogger)
assert.Error(t, err)
})
@@ -71,7 +92,7 @@ func TestConfigureAzureAuthentication(t *testing.T) {
}
var opts = &sdkhttpclient.Options{CustomOptions: map[string]any{}}
err := ConfigureAzureAuthentication(settings, azureSettings, opts)
err := ConfigureAzureAuthentication(settings, azureSettings, opts, true, testLogger)
require.NoError(t, err)
require.NotNil(t, opts.Middlewares)
@@ -87,7 +108,7 @@ func TestConfigureAzureAuthentication(t *testing.T) {
}
var opts = &sdkhttpclient.Options{CustomOptions: map[string]any{}}
err := ConfigureAzureAuthentication(settings, azureSettings, opts)
err := ConfigureAzureAuthentication(settings, azureSettings, opts, true, testLogger)
require.NoError(t, err)
if opts.Middlewares != nil {
@@ -108,9 +129,36 @@ func TestConfigureAzureAuthentication(t *testing.T) {
var opts = &sdkhttpclient.Options{CustomOptions: map[string]any{}}
err := ConfigureAzureAuthentication(settings, azureSettings, opts)
err := ConfigureAzureAuthentication(settings, azureSettings, opts, true, testLogger)
assert.Error(t, err)
})
t.Run("should warn if an audience is specified and the feature toggle is not enabled", func(t *testing.T) {
settings := backend.DataSourceInstanceSettings{
JSONData: []byte(`{
"httpMethod": "POST",
"azureCredentials": {
"authType": "msi"
},
"azureEndpointResourceId": "https://api.example.com/abd5c4ce-ca73-41e9-9cb2-bed39aa2adb5"
}`),
}
var opts = &sdkhttpclient.Options{CustomOptions: map[string]any{}}
var buf bytes.Buffer
testLogger := hclog.New(&hclog.LoggerOptions{
Name: "test",
Output: &buf,
})
log := fakeLogger{
Logger: testLogger,
}
err := ConfigureAzureAuthentication(settings, azureSettings, opts, false, log)
str := buf.String()
t.Log(str)
assert.NoError(t, err)
assert.Contains(t, str, "Specifying an audience override requires the prometheusAzureOverrideAudience feature toggle to be enabled. This functionality is deprecated and will be removed in a future release.")
})
}
func TestGetPrometheusScopes(t *testing.T) {
pkg/tsdb/prometheus/prometheus.go
+5 -2
View File
@@ -7,6 +7,7 @@ import (
"github.com/grafana/grafana-azure-sdk-go/v2/azsettings"
"github.com/grafana/grafana-plugin-sdk-go/backend"
sdkhttpclient "github.com/grafana/grafana-plugin-sdk-go/backend/httpclient"
"github.com/grafana/grafana-plugin-sdk-go/backend/log"
"github.com/grafana/grafana/pkg/promlib"
"github.com/grafana/grafana/pkg/tsdb/prometheus/azureauth"
@@ -45,7 +46,7 @@ func (s *Service) CheckHealth(ctx context.Context, req *backend.CheckHealthReque
return s.lib.CheckHealth(ctx, req)
}
func extendClientOpts(ctx context.Context, settings backend.DataSourceInstanceSettings, clientOpts *sdkhttpclient.Options) error {
func extendClientOpts(ctx context.Context, settings backend.DataSourceInstanceSettings, clientOpts *sdkhttpclient.Options, plog log.Logger) error {
// Set SigV4 service namespace
if clientOpts.SigV4 != nil {
clientOpts.SigV4.Service = "aps"
@@ -56,9 +57,11 @@ func extendClientOpts(ctx context.Context, settings backend.DataSourceInstanceSe
return fmt.Errorf("failed to read Azure settings from Grafana: %v", err)
}
audienceOverride := backend.GrafanaConfigFromContext(ctx).FeatureToggles().IsEnabled("prometheusAzureOverrideAudience")
// Set Azure authentication
if azureSettings.AzureAuthEnabled {
err = azureauth.ConfigureAzureAuthentication(settings, azureSettings, clientOpts)
err = azureauth.ConfigureAzureAuthentication(settings, azureSettings, clientOpts, audienceOverride, plog)
if err != nil {
return fmt.Errorf("error configuring Azure auth: %v", err)
}
pkg/tsdb/prometheus/prometheus_test.go
+2 -2
View File
@@ -28,7 +28,7 @@ func TestExtendClientOpts(t *testing.T) {
}
ctx := backend.WithGrafanaConfig(context.Background(), cfg)
opts := &sdkhttpclient.Options{}
err := extendClientOpts(ctx, settings, opts)
err := extendClientOpts(ctx, settings, opts, backend.Logger)
require.NoError(t, err)
require.Equal(t, 1, len(opts.Middlewares))
})
@@ -47,7 +47,7 @@ func TestExtendClientOpts(t *testing.T) {
SecretKey: "secretkey",
},
}
err := extendClientOpts(context.Background(), settings, opts)
err := extendClientOpts(context.Background(), settings, opts, backend.Logger)
require.NoError(t, err)
require.Equal(t, "aps", opts.SigV4.Service)
})