grafana-image-renderer
grafana-image-renderer copied to clipboard
grafana
Secure grafana-image-renderer
What would you like to be added: Secure http access to grafana-image-render docker
Why is this needed: I run grafana-image-renderer successfully externally to grafana I run it in a docker by Google Cloud Run. I want to secure access to docker http output . Can i add user/password or IP/DNS sources to access grafana-image-renderer ? How to modify rendering section of grafana.ini if i can add user/password access ?
I haven't tried, but think you should be able to do this:
[rendering]
server_url = http://<user>:<password>@<host>:<port>/render
Only Basic Authentication is possible ? Basic Authentication isn't deprecated ? A argument (with user/password) is possible when we launch grafana-image-renderer docker ?
Yeah currently. To validate basic auth you still have to have a reverse proxy in front, the image renderer doesn't support validating basic auth.
Would a secret sent as HTTP header from Grafana to Image Renderer service and validated solve your problem? Something I've thinking about.
This is what i want (Google Sign-in section) :https://cloud.google.com/run/docs/authenticating/end-users#using_google_sign-in https://developers.google.com/identity/sign-in/web/ Include the ID token in an Authorization: Bearer ID_TOKEN header in the request to the service
@marefr sorry for my english ... not what i want but what you would make please. Perhaps arguments for the docker user=$User and password=$Password can be a first step ? And User/Password in Rendering section of grafana.ini ? Second step with few others authentications (at least Bearer Authentication) in docker's argument and Rendering section of grafana.ini ?
FYI including user and password in the server_url does not work, you still get redirected to /login.
Would a secret sent as HTTP header from Grafana to Image Renderer service and validated solve your problem? Something I've thinking about.
Sorry about resurrecting an old thread, but this is exactly what I need. I can generate an Bearer token from the reverse proxy in front of the Grafana instance that will give the renderer service callback permissions.
