m-lab / prometheus-support

Prometheus configuration for M-Lab running on GKE
Apache License 2.0
19 stars 11 forks source link

Max Grafana user role through auth.proxy/Github is currently "Admin" #1048

Open nkinkade opened 1 month ago

nkinkade commented 1 month ago

The Admin role only gives users authorization to modify the assigned org, but nobody has "super" admin privileges to manage the entire Grafana instance. There is currently no way to get around this because our k8s Ingress sends everything to oauth2-proxy and it is impossible to access the Grafana login page to login any other way with any other role.

Without "super" admin privileges we cannot, for example, easily install or remove plugins. It is also impossible to get instance-wide properties through the Web UI.