Skip to content

Commit 3b0546a

Browse files
authored
Add grafana-auth Kubernetes secret to handle pgsql connection for Grafana securely (#568)
* Adding grafana-auth db secret for grafana to connect to pgsql * Added sslmode key to Helm helper function, for only grafana, but this conditional could be removed and `optional:true` added to allow this for other database connections * Regenerated docs via scripts/helm-docs.sh
1 parent 89c0fa6 commit 3b0546a

File tree

6 files changed

+58
-5
lines changed

6 files changed

+58
-5
lines changed

charts/sourcegraph/README.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,14 @@ In addition to the documented values, all services also support the following va
119119
| gitserver.serviceAccount.name | string | `""` | Name of the ServiceAccount to be created or an existing ServiceAccount |
120120
| gitserver.sshSecret | string | `""` | Name of existing Secret that contains SSH credentials to clone repositories. It usually contains keys, such as `id_rsa` (private key) and `known_hosts`. Learn more from [documentation](https://docs.sourcegraph.com/admin/install/kubernetes/helm#using-ssh-to-clone-repositories) |
121121
| gitserver.storageSize | string | `"200Gi"` | PVC Storage Request for `gitserver` data volume |
122+
| grafana.auth | object | `{"database":"","existingSecret":"","host":"","password":"","port":"","sslmode":"","user":""}` | NOTE: Create a separate user in the pgsql database with read-only perms on the minimum set of tables |
123+
| grafana.auth.database | string | `""` | Sets postgres database name |
124+
| grafana.auth.existingSecret | string | `""` | Name of existing secret to for Grafana to use to connect to the pgsql database The secret must contain the keys `user`, `password`, `database`, `host` and `port`. `auth.user`, `auth.password`, etc. are ignored if this is enabled |
125+
| grafana.auth.host | string | `""` | Sets postgres host |
126+
| grafana.auth.password | string | `""` | Sets postgres password |
127+
| grafana.auth.port | string | `""` | Sets postgres port |
128+
| grafana.auth.sslmode | string | `""` | Sets postgres sslmode |
129+
| grafana.auth.user | string | `""` | Sets postgres username |
122130
| grafana.containerSecurityContext | object | `{"allowPrivilegeEscalation":false,"readOnlyRootFilesystem":true,"runAsGroup":472,"runAsUser":472}` | Security context for the `grafana` container, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |
123131
| grafana.enabled | bool | `true` | Enable `grafana` dashboard (recommended) |
124132
| grafana.existingConfig | string | `""` | Name of existing ConfigMap for `grafana`. It must contain a `datasources.yml` key. |

charts/sourcegraph/templates/_helpers.tpl

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,13 @@ app.kubernetes.io/name: jaeger
211211
secretKeyRef:
212212
key: user
213213
name: {{ $secretName }}
214+
{{- if eq $service "grafana" }}
215+
- name: {{ printf "%sSSLMODE" $prefix }}
216+
valueFrom:
217+
secretKeyRef:
218+
key: sslmode
219+
name: {{ $secretName }}
220+
{{- end }}
214221
{{- end }}
215222

216223
{{- define "sourcegraph.dataSource" -}}

charts/sourcegraph/templates/grafana/grafana.ConfigMap.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,13 @@ data:
1717
url: http://{{ default "jaeger-query" .Values.jaeger.query.name }}:16686/-/debug/jaeger
1818
- name: pgsql
1919
type: postgres
20-
url: $PGHOST:$PGPORT
21-
user: $PGGRAFANAUSER
22-
database: $PGDATABASE
20+
url: $GRAFANA_PGSQL_HOST:$GRAFANA_PGSQL_PORT
21+
user: $GRAFANA_PGSQL_USER
22+
database: $GRAFANA_PGSQL_DATABASE
2323
secureJsonData:
24-
password: $PGGRAFANAPASSWORD
24+
password: $GRAFANA_PGSQL_PASSWORD
2525
jsonData:
26-
sslmode: $PGSSLMODE
26+
sslmode: $GRAFANA_PGSQL_SSLMODE
2727
kind: ConfigMap
2828
metadata:
2929
labels:

charts/sourcegraph/templates/grafana/grafana.StatefulSet.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ spec:
5252
{{- end }}
5353
terminationMessagePolicy: FallbackToLogsOnError
5454
env:
55+
{{- include "sourcegraph.databaseAuth" (list . "grafana" "GRAFANA_PGSQL_") | nindent 8 }}
5556
{{- range $name, $item := .Values.grafana.env}}
5657
- name: {{ $name }}
5758
{{- $item | toYaml | nindent 10 }}
Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- if and .Values.grafana.auth (not .Values.grafana.auth.existingSecret) }}
2+
apiVersion: v1
3+
kind: Secret
4+
metadata:
5+
name: {{ .Values.grafana.name }}-auth
6+
labels:
7+
app: grafana
8+
deploy: sourcegraph
9+
app.kubernetes.io/component: grafana
10+
type: Opaque
11+
data:
12+
database: {{ .Values.grafana.auth.database | toString | b64enc | quote }}
13+
host: {{ .Values.grafana.auth.host | toString | b64enc | quote }}
14+
password: {{ .Values.grafana.auth.password | toString | b64enc | quote }}
15+
port: {{ .Values.grafana.auth.port | toString | b64enc | quote }}
16+
sslmode: {{ .Values.grafana.auth.sslmode | toString | b64enc | quote }}
17+
user: {{ .Values.grafana.auth.user | toString | b64enc | quote }}
18+
{{- end -}}

charts/sourcegraph/values.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -424,6 +424,25 @@ gitserver:
424424
grafana:
425425
# -- Enable `grafana` dashboard (recommended)
426426
enabled: true
427+
# -- Sourcegraph Internal - Enable grafana to query pgsql database
428+
# -- NOTE: Create a separate user in the pgsql database with read-only perms on the minimum set of tables
429+
auth:
430+
# -- Name of existing secret to for Grafana to use to connect to the pgsql database
431+
# The secret must contain the keys `user`, `password`, `database`, `host` and `port`.
432+
# `auth.user`, `auth.password`, etc. are ignored if this is enabled
433+
existingSecret: ""
434+
# -- Sets postgres database name
435+
database: ""
436+
# -- Sets postgres host
437+
host: ""
438+
# -- Sets postgres username
439+
user: ""
440+
# -- Sets postgres password
441+
password: ""
442+
# -- Sets postgres port
443+
port: ""
444+
# -- Sets postgres sslmode
445+
sslmode: ""
427446
# -- Name of existing ConfigMap for `grafana`. It must contain a `datasources.yml` key.
428447
existingConfig: "" # Name of an existing configmap
429448
image:

0 commit comments

Comments
 (0)