Loading sources and dashboards from resources path doesn't work with OAuth

[JanekLehr]

After turning on OAuth (Google provider) I can no longer use predefined resources from the file system, configured with RESOURCES_PATH. I don't see any error in the logs. When I turn off the OAuth settings Chronograf successfully starts with my predefined source and dashboard.

This is the resources feature I'm referring to, introduced in release v1.4.0.0-rc1 [2017-12-19]: https://github.com/influxdata/chronograf/pull/2593

When I have OAuth turned on I first go to the log in screen, and after successful login I'm directed to the "Add a New InfluxDB Connection" screen.

After completing the new source set up (even if I have a influx.src in my resources path), I still don't see the predefined dashboard that is in my resources path.

Configuration I have the following env vars set for OAuth (values omitted for obvious reasons):

GOOGLE_CLIENT_ID
GOOGLE_CLIENT_SECRET
GOOGLE_DOMAINS
PUBLIC_URL
TOKEN_SECRET

And the following:

RESOURCES_PATH=/usr/share/chronograf/resources
REPORTING_DISABLED=true

I used the integration test data file, and it worked without OAuth but failed with OAuth.

Operating System/Version info Using the chronograf:1.4.4.2 Docker image from DockerHub running on a GKE node with:

 Kernel Version:             4.4.111+
 OS Image:                   Container-Optimized OS from Google
 Operating System:           linux
 Architecture:               amd64
 Container Runtime Version:  docker://17.3.2

[JanekLehr]

@goller I'm tagging you because you're the author of this feature, which I really want to use, since I also can't get the API to work after enabling OAuth :).

[ellieayla]

I believe I have also run into this, though with GENERIC_*. I found that I had to specify at least one source in "organization": "default" to avoid this Default-has-no-connections interstitial form.

Operating System/Version info Using docker.io/library/chronograf:alpine at sha256:b9c21b620f623300ed9f3a1795d3c78396d4f2203b8792cc6d948a7baec5d1f2 on AKS

Kernel Version:             4.15.0-1021-azure
OS Image:                   Ubuntu 16.04.5 LTS (/proc/version=Ubuntu 5.4.0-6ubuntu1~16.04.10)
Operating System:           linux
Architecture:               amd64
Container Runtime Version:  docker://1.13.1
Kubelet Version:            v1.9.9

If I amend whatever.src to contain "organization": "default" then I am not prompted for a source, and the "My InfluxDB" source works.

orgdefault.src
{
  "id": "10000",
  "name": "My InfluxDB",
  "username": "test",
  "password": "test",
  "url": "http://influxdb:8086",
  "type": "influx",
  "insecureSkipVerify": false,
  "default": true,
  "telegraf": "telegraf",
  "organization": "default"
}

If instead I create a new organization (like all the example docs suggest) I again see the introductory you-have-no-sources form, and am forced to create a source (eg Foo) interactively. However afterward I see two orgs (Default+Awesome) and two sources (Foo+MyInfluxDB).

awesome.org
{
  "id": "Awesome",
  "name": "SuperCool",
  "defaultRole": "viewer",
}
explicit.src
{
  "id": "10000",
  "name": "My InfluxDB",
  "username": "test",
  "password": "test",
  "url": "http://influxdb:8086",
  "type": "influx",
  "insecureSkipVerify": false,
  "default": true,
  "telegraf": "telegraf",
  "organization": "Awesome"
}

I want to enable all users from AzureAD to view metric data from this influxdb source. But no users from the GENERIC_NAME provider have a role in this new "Awesome" organization, presumably due to a lack of an Mapping ala #2217 and #2699. I don't see any code reading Mappings from a file in resources/ - I would expect a MappingStore implementation under filestore/. Nor do I see a way to change the default role to viewer for the Default org (via environment variables, config files, command line options).

My use case for specifying the source/org/mapping in a ConfigMap is to run Chronograf in a container with an ephemeral (and mostly blank) bolt.db. That doesn't seem viable right now.

[ceastman-ibm]

is there a way to inject a src file during a kubernetes helm chart install?

i have a similar need to the original poster, soon as i turn on oauth the env variables are now ignored and i get the add source dialog:

Extra environment variables that will be passed onto deployment pods

env: INFLUXDB_URL: http://influxdb-influxdb:8086 KAPACITOR_URL: http://kapacitor-kapacitor:9092

[russorat]

@JanekLehr did adding the "organization" key as described by from @alanjcastonguay solve this issue?

@ceastman-ibm as long as you configure the .src file to be located in the RESOURCES_PATH in the pod, you should be good to go.

[kramik1]

I know this is closed but I am mainly putting this here to help other people having an issue with resource files since it is a google search result. You need to explicitly set the resources directory as an environment variable or the image will never see it. There are a number of forums and documentation that never explicitly highlight this. Hopefully this will save some people some time.

[lixiaomei-git]

@kramik1 Hi, I have set the environment, and the .src file seems correct, but the connection wasn't loaded, could you give me some advice?

10:09:19 ❯ k exec -it chronograf-644dfd8648-dxklz -- /bin/bash
I have no name!@chronograf-644dfd8648-dxklz:/$ printenv|grep resource
RESOURCES_PATH=/usr/share/chronograf/resources
I have no name!@chronograf-644dfd8648-dxklz:/$ cat /usr/share/chronograf/resources/default.src 
{
  "id": "10000",
  "name": "My InfluxDB",
  "username": "{{ .INFLUXDB_USER }}",
  "password": "{{ .INFLUXDB_PASSWORD }}",
  "url": "{{ .INFLUXDB_URL }}",
  "type": "influx",
  "insecureSkipVerify": true,
  "default": true,
  "telegraf": "telegraf",
  "organization": "default"
}