Promethues-Operator对接ldap

Promethues-Operator对接ldap

1、创建ldap配置文件configmap

apiVersion: v1
kind: ConfigMap
metadata:
  name: ldap-config
  namespace: monitoring
data:
  ldap.toml: |-
      [[servers]]
      # Ldap server host (specify multiple hosts space separated)
      host = "ldap服务器"
      # Default port is 389 or 636 if use_ssl = true
      port = ldap服务器端口
      # Set to true if ldap server supports TLS
      use_ssl = false
      start_tls = false
      # set to true if you want to skip ssl cert validation
      ssl_skip_verify = false
      
      # Search user bind dn
      bind_dn = "uid=公司ldap某个账户,ou=People,dc=公司ldap的dc名称,dc=cn"
      bind_password = '密码'
      
      # User search filter, for example "(cn=%s)" or "(sAMAccountName=%s)" or "(uid=%s)"
      search_filter = "(cn=%s)"
      
      # An array of base dns to search through
      search_base_dns = ["ou=People,dc=公司ldap的dc名称,dc=cn"]
      
      [servers.attributes]
      name = "givenName"
      surname = "sn"
      username = "cn"
      member_of = "memberOf"
      email =  "email"
      
      # Map ldap groups to grafana org roles
      [[servers.group_mappings]]
      group_dn = "ou=admins,dc=公司ldap的dc名称,dc=cn"
      org_role = "Admin"
      
      [[servers.group_mappings]]
      group_dn = "ou=People,dc=公司ldap的dc名称,dc=cn"
      org_role = "Editor"
      
      [[servers.group_mappings]]
      group_dn = "*"
      org_role = "Editor"

2、创建grafana.ini配置文件configmap

因为Prometheus-Operator默认的注释了ldap的配置，所以需要把修改好的grafana.ini挂载至grafana,修改的部分如下所示：

[auth.ldap]
enabled = true
config_file = /etc/grafana/ldap.toml
allow_sign_up = true

注意每个版本的grafana.ini配置文件可能不一样，进入grafana容器里拷贝一份即可

apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-config-ini
  namespace: monitoring
data:
  grafana.ini: |
    ##################### Grafana Configuration Example #####################
    #
    # Everything has defaults so you only need to uncomment things you want to
    # change
    
    # possible values : production, development
    ;app_mode = production
    
    # instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty
    ;instance_name = ${HOSTNAME}
    
    #################################### Paths ####################################
    [paths]
    # Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used)
    ;data = /var/lib/grafana
    
    # Temporary files in `data` directory older than given duration will be removed
    ;temp_data_lifetime = 24h
    
    # Directory where grafana can store logs
    ;logs = /var/log/grafana
    
    # Directory where grafana will automatically scan and look for plugins
    ;plugins = /var/lib/grafana/plugins
    
    # folder that contains provisioning config files that grafana will apply on startup and while running.
    ;provisioning = conf/provisioning
    
    #################################### Server ####################################
    [server]
    # Protocol (http, https, h2, socket)
    ;protocol = http
    
    # The ip address to bind to, empty will bind to all interfaces
    ;http_addr =
    
    # The http port  to use
    ;http_port = 3000
    
    # The public facing domain name used to access grafana from a browser
    ;domain = localhost
    
    # Redirect to correct domain if host header does not match domain
    # Prevents DNS rebinding attacks
    ;enforce_domain = false
    
    # The full public facing url you use in browser, used for redirects and emails
    # If you use reverse proxy and sub path specify full url (with sub path)
    ;root_url = %(protocol)s://%(domain)s:%(http_port)s/
    
    # Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons.
    ;serve_from_sub_path = false
    
    # Log web requests
    ;router_logging = false
    
    # the path relative working path
    ;static_root_path = public
    
    # enable gzip
    ;enable_gzip = false
    
    # https certs & key file
    ;cert_file =
    ;cert_key =
    
    # Unix socket path
    ;socket =
    
    #################################### Database ####################################
    [database]
    # You can configure the database connection by specifying type, host, name, user and password
    # as separate properties or as on string using the url properties.
    
    # Either "mysql", "postgres" or "sqlite3", it's your choice
    ;type = sqlite3
    ;host = 127.0.0.1:3306
    ;name = grafana
    ;user = root
    # If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
    ;password =
    
    # Use either URL or the previous fields to configure the database
    # Example: mysql://user:secret@host:port/database
    ;url =
    
    # For "postgres" only, either "disable", "require" or "verify-full"
    ;ssl_mode = disable
    
    ;ca_cert_path =
    ;client_key_path =
    ;client_cert_path =
    ;server_cert_name =
    
    # For "sqlite3" only, path relative to data_path setting
    ;path = grafana.db
    
    # Max idle conn setting default is 2
    ;max_idle_conn = 2
    
    # Max conn setting default is 0 (mean not set)
    ;max_open_conn =
    
    # Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours)
    ;conn_max_lifetime = 14400
    
    # Set to true to log the sql calls and execution times.
    ;log_queries =
    
    # For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared)
    ;cache_mode = private
    
    #################################### Cache server #############################
    [remote_cache]
    # Either "redis", "memcached" or "database" default is "database"
    ;type = database
    
    # cache connectionstring options
    # database: will use Grafana primary database.
    # redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'.
    # memcache: 127.0.0.1:11211
    ;connstr =
    
    #################################### Data proxy ###########################
    [dataproxy]
    
    # This enables data proxy logging, default is false
    ;logging = false
    
    # How long the data proxy waits before timing out, default is 30 seconds.
    # This setting also applies to core backend HTTP data sources where query requests use an HTTP client with timeout set.
    ;timeout = 30
    
    # If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false.
    ;send_user_header = false
    
    #################################### Analytics ####################################
    [analytics]
    # Server reporting, sends usage counters to stats.grafana.org every 24 hours.
    # No ip addresses are being tracked, only simple counters to track
    # running instances, dashboard and error counts. It is very helpful to us.
    # Change this option to false to disable reporting.
    ;reporting_enabled = true
    
    # Set to false to disable all checks to https://grafana.net
    # for new versions (grafana itself and plugins), check is used
    # in some UI views to notify that grafana or plugin update exists
    # This option does not cause any auto updates, nor send any information
    # only a GET request to http://grafana.com to get latest versions
    ;check_for_updates = true
    
    # Google Analytics universal tracking code, only enabled if you specify an id here
    ;google_analytics_ua_id =
    
    # Google Tag Manager ID, only enabled if you specify an id here
    ;google_tag_manager_id =
    
    #################################### Security ####################################
    [security]
    # disable creation of admin user on first start of grafana
    ;disable_initial_admin_creation = false
    
    # default admin user, created on startup
    ;admin_user = admin
    
    # default admin password, can be changed before first start of grafana,  or in profile settings
    ;admin_password = admin
    
    # used for signing
    ;secret_key = SW2YcwTIb9zpOOhoPsMm
    
    # disable gravatar profile images
    ;disable_gravatar = false
    
    # data source proxy whitelist (ip_or_domain:port separated by spaces)
    ;data_source_proxy_whitelist =
    
    # disable protection against brute force login attempts
    ;disable_brute_force_login_protection = false
    
    # set to true if you host Grafana behind HTTPS. default is false.
    ;cookie_secure = false
    
    # set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled"
    ;cookie_samesite = lax
    
    # set to true if you want to allow browsers to render Grafana in a ,