Admin user (in Dex) is not admin on Grafana

[gdemonet]

Component: grafana

What happened:

When logging into Grafana, with the default [email protected] static user in Dex, we get read-only access.

What was expected:

This user should have super-admin access.

Steps to reproduce: (affects all 2.5+ versions)

Resolution proposal (optional):

Not clear: see https://grafana.com/docs/grafana/latest/auth/generic-oauth/#role-mapping

[Ebaneck]

It seems like the Dex static user does not support groups and from upstream discussions, Dex will not support this feature for static users. Connector based settings like LDAP, SAML and others seem to support this.

2020-07-10T09:10:47.776792798Z stderr F time="2020-07-10T09:10:47Z" level=info msg="login successful: connector \"local\", username=\"admin\", preferred_username=\"\", email=\"[email protected]\", groups=[]"

This means that we cannot use the role-mapping feature from Grafana since the user info endpoint has no entries for groups.

Alternatively, we could fix this by using the below hack. We should, however, remove the below settings when we implement role-mapping with non-static users

diff --git a/charts/prometheus-operator.yaml b/charts/prometheus-operator.yaml
index e9072631..14c2d24d 100644
--- a/charts/prometheus-operator.yaml
+++ b/charts/prometheus-operator.yaml
@@ -164,6 +164,8 @@ grafana:
       auth_url: '__escape__(https://{{ grains.metalk8s.control_plane_ip }}:8443/oidc/auth)'
       token_url:  '__escape__(https://{{ grains.metalk8s.control_plane_ip }}:8443/oidc/token)'
       api_url: '__escape__(https://{{ grains.metalk8s.control_plane_ip }}:8443/oidc/userinfo)'
+    users:
+      auto_assign_org_role: "Admin"
 

[gdemonet]

Oh no we can't deploy Grafana with this "hack". Instead, we could use role-mapping to map this special username (no need to rely on groups) to the Admin role.

[Ebaneck]

Reading the Grafana role mapping docs, here is a fix proposal

role_attribute_path: contains(email, '[email protected]') && 'Admin'

[Ebaneck]

Instead of simply hard-coding this value like proposed above, we could indeed obtain the value from a read service configuration.

Why?
We expose the OIDC admin user via a metalk8s-dex-config Service Config(SC) which is editable by users. Meaning some users might edit the SC and the changes will not be evaluated on Grafana side since it will continue to use the hard-coded value.

Now if we read from an SC, then the above issue is solved is partly solved, since users will only need to restart the grafana deployments.

Given how we render charts per namespace, simply re-rendering the Prometheus-operator charts with --service-config dex metalk8s-dex-config will not work out great.

• We need to add a new arg to the render script e.g (--external-service-config chart_name SC_name, namespace)
• Then fix the render to include the values passed.

We ideally should end with something like this in the Prometheus-operator charts

{% import_yaml 'metalk8s/addons/dex/config/dex.yaml' as dex_defaults with context %}
{% import_yaml 'metalk8s/addons/prometheus-operator/config/grafana.yaml' as grafana_defaults with context %}
{% import_yaml 'metalk8s/addons/prometheus-operator/config/prometheus.yaml' as prometheus_defaults with context %}
{% import_yaml 'metalk8s/addons/prometheus-operator/config/alertmanager.yaml' as alertmanager_defaults with context %}

{%- set grafana = salt.metalk8s_service_configuration.get_service_conf('metalk8s-monitoring', 'metalk8s-grafana-config', grafana_defaults) %}
{%- set prometheus = salt.metalk8s_service_configuration.get_service_conf('metalk8s-monitoring', 'metalk8s-prometheus-config', prometheus_defaults) %}
{%- set alertmanager = salt.metalk8s_service_configuration.get_service_conf('metalk8s-monitoring', 'metalk8s-alertmanager-config', alertmanager_defaults) %}
{%- set dex = salt.metalk8s_service_configuration.get_service_conf('metalk8s-auth', 'metalk8s-dex-config', dex_defaults) %}

With value looking like:

role_attribute_path = contains(email, '{% endraw -%}{{ dex.spec.localuserstore.userlist[0]['email'] }}{%- raw %}') && 'Admin'