diff options
6 files changed, 82 insertions, 1 deletions
diff --git a/ansible/group_vars/all/grafana.yml b/ansible/group_vars/all/grafana.yml index 15f430114..470ac1669 100644 --- a/ansible/group_vars/all/grafana.yml +++ b/ansible/group_vars/all/grafana.yml @@ -9,3 +9,5 @@ grafana_public_endpoint: "{{ grafana_external_fqdn | kolla_url(public_protocol, grafana_server_port: "3000" grafana_server_public_port: "{{ haproxy_single_external_frontend_public_port if haproxy_single_external_frontend | bool else grafana_server_port }}" grafana_server_listen_port: "{{ grafana_server_port }}" + +grafana_ldap_enabled: false diff --git a/ansible/roles/grafana/tasks/config.yml b/ansible/roles/grafana/tasks/config.yml index 9a5ee7dbe..f2852820d 100644 --- a/ansible/roles/grafana/tasks/config.yml +++ b/ansible/roles/grafana/tasks/config.yml @@ -46,6 +46,15 @@ become: true with_dict: "{{ grafana_services | select_services_enabled_and_mapped_to_host }}" +- name: Copying over ldap.toml + template: + src: "{{ node_custom_config }}/grafana/ldap.toml" + dest: "{{ node_config_directory }}/grafana/ldap.toml" + mode: "0660" + become: true + when: + - grafana_ldap_enabled | bool + - name: Copying over extra configuration file become: true template: diff --git a/ansible/roles/grafana/templates/grafana.ini.j2 b/ansible/roles/grafana/templates/grafana.ini.j2 index 1b46f18a4..763915796 100644 --- a/ansible/roles/grafana/templates/grafana.ini.j2 +++ b/ansible/roles/grafana/templates/grafana.ini.j2 @@ -34,3 +34,10 @@ admin_password = {{ grafana_admin_password }} [plugins] plugin_admin_enabled = false public_key_retrieval_disabled = true + +{% if grafana_ldap_enabled | bool %} +[auth.ldap] +enabled = true +config_file = /etc/grafana/ldap.toml +allow_sign_up = true +{% endif %} diff --git a/ansible/roles/grafana/templates/grafana.json.j2 b/ansible/roles/grafana/templates/grafana.json.j2 index b98c53c79..a9d6445bf 100644 --- a/ansible/roles/grafana/templates/grafana.json.j2 +++ b/ansible/roles/grafana/templates/grafana.json.j2 @@ -42,7 +42,14 @@ "owner": "grafana", "perm": "0755", "optional": true - }{% if kolla_copy_ca_into_containers | bool %}, + }{% if grafana_ldap_enabled | bool %}, + { + "source": "{{ container_config_directory }}/ldap.toml", + "dest": "/etc/grafana/ldap.toml", + "owner": "grafana", + "perm": "0600" + }{% endif %} + {% if kolla_copy_ca_into_containers | bool %}, { "source": "{{ container_config_directory }}/ca-certificates", "dest": "/var/lib/kolla/share/ca-certificates", diff --git a/doc/source/reference/logging-and-monitoring/grafana-guide.rst b/doc/source/reference/logging-and-monitoring/grafana-guide.rst index 8622b8e99..6f89c2016 100644 --- a/doc/source/reference/logging-and-monitoring/grafana-guide.rst +++ b/doc/source/reference/logging-and-monitoring/grafana-guide.rst @@ -30,6 +30,55 @@ If you would like to set up Prometheus as a data source, additionally set: Please follow :doc:`Prometheus Guide <prometheus-guide>` for more information. +LDAP Authentication +~~~~~~~~~~~~~~~~~~~ + +Grafana can be configured to use LDAP for user authentication. To enable this +feature, set the following variable in ``/etc/kolla/globals.yml``: + +.. code-block:: yaml + + grafana_ldap_enabled: true + +The configuration for the LDAP server should be provided in a ``ldap.toml`` +file placed in the ``{{ node_custom_config }}/grafana/`` folder on the control +host. + +Example ``ldap.toml`` configuration: + +.. code-block:: ini + + [[servers]] + host = "openstack.org" + port = 389 + use_ssl = false + start_tls = true + + bind_dn = "CN=svc-openstack-grafana,OU=serviceaccounts,DC=openstack,DC=org" + bind_password = "strong_password" + + search_filter = "(sAMAccountName=%s)" + search_base_dns = ["OU=Users,DC=openstack,DC=org"] + + [servers.attributes] + name = "givenName" + surname = "sn" + username = "uid" + member_of = "memberOf" + email = "mail" + + [[servers.group_mappings]] + group_dn = "cn=grafana-admins,ou=groups,dc=openstack,dc=org" + org_role = "Admin" + + [[servers.group_mappings]] + group_dn = "cn=grafana-editors,ou=groups,dc=openstack,dc=org" + org_role = "Editor" + + [[servers.group_mappings]] + group_dn = "*" + org_role = "Viewer" + Custom dashboards provisioning ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/releasenotes/notes/add-grafana-ldap-support-65197904c0c325d1.yaml b/releasenotes/notes/add-grafana-ldap-support-65197904c0c325d1.yaml new file mode 100644 index 000000000..df605bc7e --- /dev/null +++ b/releasenotes/notes/add-grafana-ldap-support-65197904c0c325d1.yaml @@ -0,0 +1,7 @@ +--- +features: + - | + Adds support for LDAP authentication in Grafana. + Users can now enable LDAP by setting ``grafana_ldap_enabled`` to + ``true`` and providing an ``ldap.toml`` configuration file in the + ``{{ node_custom_config }}/grafana/`` directory. |