Open ChrisMcGowan opened 6 months ago
So prometheus is setup to allow any opsuaa authed user to access - we need to scope down that access.
prometheus-support
with comment Support members access to prometheus
here: https://github.com/cloud-gov/cg-deploy-opslogin/blob/05e96ba9245149e0cb41ac5a96a2eb4d9bec2736/manifest.yml#L318prometheus-support
, concourse.pages
, and concourse.admin
here: https://github.com/cloud-gov/cg-deploy-opslogin/blob/05e96ba9245149e0cb41ac5a96a2eb4d9bec2736/manifest.yml#L440-L449prometheus-support
, concourse.pages
, and concourse.admin
here: https://github.com/cloud-gov/cg-deploy-prometheus/blob/803e0b099335d84bcf64edac07a6cc8bc50e3c3c/bosh/manifest.yml#L313make-pages-ops-admin
to addd user to group prometheus-support
: https://github.com/cloud-gov/cg-scripts/blob/main/make-pages-ops-admin.sh#L42make-ops-viewer
script in cg-scripts and make a new script file called make-prometheus-support
and replace here https://github.com/cloud-gov/cg-scripts/blob/main/make-ops-viewer.sh#L42 with prometheus-support
. Remember to run chmod +x
on the script before commit to the repoFor testing all this, you can do the following to make sure all the pieces work manually:
cg-scrips/uaa/login
uaac
to create the prometheus-support
groupuaac
to modify the prometheus-staging
client to add the scopebosh manifest
command to get the prometheus-staging
manifest, make the changes there and manual bosh deploy
concourse-admin
or pages-admin
to see if they can auth/get in to the stage envirnment and if not add them to the group using uaac
and test to validate they get inThis work is on-hold until this ticket is done: https://github.com/cloud-gov/oauth2-proxy-boshrelease/issues/17
@rcgottlieb
Check/verify if the new Concourse Viewer access gives Prometheus/Grafana access