linkerd / linkerd-viz

Top-line service metrics dashboard for Linkerd 1.
Apache License 2.0
111 stars 32 forks source link

How to integrate auth? #43

Closed wyaeld closed 4 years ago

wyaeld commented 7 years ago

@siggy The viz looks great. I am deploying a cluster for company on GKE, and really need to be able to secure the public facing Grafana auth to use the same Google Account users.

While I can normally do this from config files and UI, I'm struggling with this setup. It logs in anonymous, but the grafana admin functions are not available. I assume this is a feature of the anonymous logins, which I haven't used before.

Do you have a reference config to get it running with google cloud IAM you could share?

siggy commented 7 years ago

Hi @wyaeld. Good question. I don't have a GKE config handy.

I'd recommend modifying the Grafana config in this repo and rolling your own Docker image.

grafana.ini is written at startup time here: https://github.com/linkerd/linkerd-viz/blob/master/linkerd-viz#L19

Building your own linkerd-viz Docker image: https://github.com/linkerd/linkerd-viz#build-docker-image

Let me know if you have additional questions, cheers.

wyaeld commented 7 years ago

I have it the google auth now. Some feedback.

Using the native Grafana capability to use ENV vars seems to work nicer than updating an image with a grafana.ini

Once you add in some auth, the api calls being used to bootstrap the prometheus datasource fail, which took me a while to work out and troubleshoot.

Anyway, a huge thanks. This project works great as a starter. The only thing really missing is some more elaboration on how you'd do a production-grade setup. However its probable that anyone who understands enough about k8s and prometheus to use this stuff knows how to make the required changes.

Where I'm trying to go is:

wmorgan commented 7 years ago

@wyaeld that seems like a great set of goals. Please post some notes as you figure out the productionization story; I'm sure others would be interested too!

wyaeld commented 4 years ago

Ultimately we moved away from Linkerd and towards the full suite of Stackdriver services for tracing etc.