Skip to content

Add mysql backend #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add mysql backend #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d41eee9
Move grafana secrets into environment variables
fydai Apr 7, 2020
fe7d4c9
Add mysql datasources
fydai Apr 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 17 additions & 48 deletions kubernetes/grafana.yml.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,51 +34,9 @@ spec:
cpu: 175m
ports:
- containerPort: 3000
volumeMounts:
- mountPath: /etc/secrets
name: secrets
env:
- name: GF_SERVER_ROOT_URL
value: https://grafana.ocf.berkeley.edu/
- name: GF_DATABASE_TYPE
value: mysql
- name: GF_DATABASE_HOST
value: mysql
- name: GF_DATABASE_NAME
value: ocfgrafana
- name: GF_DATABASE_USER
value: ocfgrafana
- name: GF_SESSION_PROVIDER
value: mysql
- name: GF_SESSION_COOKIE_SECURE
value: "true"

- name: GF_DATABASE_PASSWORD__FILE
value: /etc/secrets/mysql-pass
- name: GF_SECURITY_ADMIN_PASSWORD__FILE
value: /etc/secrets/admin-pass
- name: GF_SESSION_PROVIDER_CONFIG__FILE
value: /etc/secrets/provider-config
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET__FILE
value: /etc/secrets/keycloak-secret

- name: PROMETHEUS_AUTH_USER
valueFrom:
secretKeyRef:
name: prometheus-auth
key: username
- name: PROMETHEUS_AUTH_PASSWORD
valueFrom:
secretKeyRef:
name: prometheus-auth
key: password

volumes:
- name: secrets
hostPath:
path: /opt/share/kubernetes/secrets/grafana
type: Directory

envFrom:
- secretRef:
name: grafana-secret
dnsPolicy: ClusterFirst
dnsConfig:
searches:
Expand All @@ -100,8 +58,19 @@ spec:
apiVersion: v1
kind: Secret
metadata:
name: prometheus-auth
name: grafana-secret
type: Opaque
stringData:
username: ocfgrafana
password: "<%= prometheus_pass %>"
GF_SERVER_ROOT_URL: "https://grafana.ocf.berkeley.edu"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't know what the established convention is here, though I have assumed Kubernetes secrets should be reserved for... things that are actually secret.

Grafana makes this even easier for us-- we don't have to use Kubernetes "Secrets" at all, since we can place passwords in individual files in the Puppet private share and point to them with GF_SETTINGNAME__FILE options (see GF_DATABASE_PASSWORD__FILE above for an example). I slightly prefer this because I think our templating code for secrets is a little weird (I don't like how it passes through Jenkins).

It's probably not a huge deal either way, though I'd recommend consolidating on one way instead of the awkward hybrid we have now.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

agree that non-secrets should just be specified in a configmap or directly in the pod template, not in a Secret resource. I don't think there is a problem with templates over files (in fact I like the templating system better, it's more clear what's going on).

GF_DATABASE_TYPE: mysql
GF_DATABASE_HOST: mysql
GF_DATABASE_NAME: ocfgrafana
GF_DATABASE_USER: ocfgrafana
GF_SESSION_PROVIDER: mysql
GF_SESSION_COOKIE_SECURE: "true"
GF_DATABASE_PASSWORD: "<%= mysql_pass %>"
GF_SECURITY_ADMIN_PASSWORD: "<%= admin_pass %>"
GF_SESSION_PROVIDER_CONFIG: "<%= provider_config %>"
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "<%= keycloak_secret %>"
PROMETHEUS_AUTH_USER: ocfgrafana
PROMETHEUS_AUTH_PASSWORD: "<%= prometheus_pass %>"
16 changes: 16 additions & 0 deletions provisioning/datasources/mysql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
apiVersion: 1

datasources:
- name: MySQL Printing
type: mysql
url: mysql
database: ocfprinting
user: $GF_DATABASE_USER
password: $GF_DATABASE_PASSWORD

- name: MySQL Stats
type: mysql
url: mysql
database: ocfstats
user: $GF_DATABASE_USER
password: $GF_DATABASE_PASSWORD