otomi-core
otomi-core copied to clipboard
redkubes
Grafana/Prometheus multitenancy
At GU we are running 8+ different instances of Grafana corresponding to each team instance of Prometheus - with monitoring now becoming a priority we are looking to implement a SPOG
Describe the solution you'd like
Use Grafana Orgs and/or Teams to separate users from different teams
I will implement this once Grafana 9 is added to kube-prometheus-stack
You are only referring to grafana having access to platform prom source. There is more to this.
We provide prom instances when isMultitenant, so teams can publish serviceMonitors which are then scraped by those instances.
RBAC is not problematic at the moment and changing it does not functionally change anything or gives us anything from architecture/networking perspective.
Implementing RBAC would prevent having to run a separate instance of Grafana for every team, which is a big resource hog. Overall manageability is also much better with RBAC, especially when it comes to dashboard and datasource management, as well as, critically, backups. I think that leveraging Grafana's in-built multi-tenant capabilities is much better than implementing our own multi-tenancy layer.
@staticvoid255 Could you clarify how to setup scope for team in Grafana? So team cannot see metrics from platform and other teams ?
Here you go, so we'd manage access to datasources, dashboard folders etc with those scopes depending on whether dashboards are generic or team-specific. So dashboards with filterable datasources are covered by datasource scope, then team metrics on folder scope.
Note: Available in Grafana Enterprise and Grafana Cloud Advanced.
Did you read this?
We can always revive this once we have in-app upgrades options, but that is a long way for now. Please stick with FOSS until then.
Did you read this?
That wasn't there when I was researching this or I obviously would have seen it. Grafana's release docs for 9.0 implied it would be available for OSS users, and there has been a lot of scrutiny in the community over this.
Regardless, I can still achieve the same result with Teams and Orgs in Grafana, which is how people usually do it in FOSS
Did you read this?
That wasn't there when I was researching this or I obviously would have seen it.
Grafana's release docs for 9.0 implied it would be available for OSS users, and there has been a lot of scrutiny in the community over this.
Let's be sure and maybe ask them if it is FOSS?
Regardless, I can still achieve the same result with Teams and Orgs in Grafana, which is how people usually do it in FOSS
I believe teams and orgs are also not FOSS. We already do use their authz scripting approach, but that does not yet govern access to datasources. If we could publish datasources to be only accessible by teams with that approach we have solved the initial problem (one grafana instance vs multiple).
@staticvoid255 can you edit that link? It is pointing to the wrong issue. (Wrong repo? You can target other org repos like this: redkubes/otomi-console#123)