Repository navigation
rvn-eks-addons 0.25.0: username and password as a Grafana sign-in provider - #238
Merged
Merged
Conversation
…vider Co-Authored-By: brandon <brandon@flightcontrol.dev>
Contributor
Author
|
I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…op stale grafana_auth docs Co-Authored-By: brandon <brandon@flightcontrol.dev>
flybayer
approved these changes
Oct 25, 2026
Contributor
|
Resolved: this PR is in the merge queue at ffaf29f. |
devin-ai-integration
Bot
changed the base branch from
devin/1792862973-eks-addons-cert-manager-copy
to
main
October 25, 2026 16:30
Ravion Module Publish PlanDry run only. No Ravion API mutations were made.
Diffsrvn-eks-addons 0.24.1 -> 0.25.0--- remote
+++ compiled
- id: section_grafana_sign_in
label: Grafana sign-in
type: section
- - default: true
- description: Grafana's built-in sign-in for local users, including the generated admin. Turning it off removes the login form and password access to the API, so only the providers below can sign in.
- id: grafana_login_form_enabled
- label: Username and password
- show_when:
- grafana_enabled: true
- type: boolean
- default: Viewer
- description: Grafana role an account gets the first time it signs in through a provider, unless the provider's role mapping says otherwise.
+ description: Grafana role an account gets the first time it signs in through an OAuth provider, unless the provider's role mapping says otherwise.
id: grafana_default_role
label: Role for new accounts
show_when:
@@
value: Editor
- label: Admin
value: Admin
- - description: Grafana's OAuth providers people can sign in with, each a button on Grafana's sign-in page. Google, GitHub and gitlab.com need allowed domains, organizations, teams or groups, since anyone with an account there could otherwise sign in.
+ - default:
+ - provider: basic
+ description: How people sign in to Grafana. Without Username and password there is no login form and no password works, including the generated admin's. Google, GitHub and gitlab.com need allowed domains, organizations, teams or groups, since anyone with an account there could otherwise sign in.
id: grafana_auth_providers
item_description: Client ID {client_id}
item_inputs:
- - description: Which of Grafana's OAuth providers this is.
+ - description: Username and password, or one of Grafana's OAuth providers.
id: provider
label: Provider
required: true
type: string
values:
+ - description: Grafana's login form for local users, including the generated admin
+ label: Username and password
+ value: basic
- label: Google
value: google
- label: GitHub
@@
- description: Client ID of the OAuth application. Leave blank when Secrets below gives it as GF_AUTH_<PROVIDER>_CLIENT_ID. Its redirect URI is https://<hostname>/login/<provider>, for example /login/google or /login/generic_oauth.
id: client_id
label: Client ID
+ show_when:
+ provider:
+ not: basic
type: string
- description: Secrets Manager ARN containing the client secret as plain text. External Secrets reads it into the cluster; it is never a Helm value. Leave blank when Secrets below gives it as GF_AUTH_<PROVIDER>_CLIENT_SECRET.
id: client_secret_arn
label: Client secret ARN
placeholder: arn:aws:secretsmanager:us-east-2:111122223333:secret:grafana-oauth-client-secret
+ show_when:
+ provider:
+ not: basic
type: string
- description: Directory (tenant) ID of the app registration. Roles come from the app registration's app roles.
id: tenant_id
@@
id: scopes
label: Scopes
placeholder: openid email profile
+ show_when:
+ provider:
+ not: basic
type: string
- add_button_label: Add domain
description: Email domains whose accounts can sign in. For Google, your Google Workspace domains.
id: allowed_domains
label: Allowed domains
placeholder: example.com
+ show_when:
+ provider:
+ not: basic
type: string_array
- add_button_label: Add organization
description: GitHub organizations, Entra ID tenant IDs, or the provider's organizations whose members can sign in.
@@
placeholder: contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'
show_when:
provider:
- not: azuread
+ not:
+ - azuread
+ - basic
type: string
- collapsible: true
default: {}
description: "Any other key of Grafana's [auth.<provider>] section, as JSON, passed through verbatim, such as {\"auto_login\": \"true\"}. The client secret goes in the ARN above, never here."
id: settings
label: Other Grafana settings
+ show_when:
+ provider:
+ not: basic
type: object
item_label: Sign-in provider
item_title:
@@
- **Shared load balancer** routes the hostname on the HTTPS listener of the shared private or public ALB. The private ALB keeps Grafana inside the VPC and the networks connected to it, such as a VPN or a Tailscale subnet router; the public ALB puts its sign-in page on the internet. Point the hostname's DNS at `private_alb_dns_name` or `public_alb_dns_name`.
- **Kubernetes Ingress** gives Grafana an Ingress for the hostname with TLS, served by the controller of the ingress class you name, with any annotations it needs. With the Tailscale Kubernetes operator's `tailscale` class and a `<name>.<tailnet>.ts.net` hostname, Grafana becomes one device on the tailnet with a Let's Encrypt certificate, and nothing else in the VPC is reachable through it. Install the class's controller first: the AWS Load Balancer Controller refuses an Ingress whose class does not exist yet.
- **Grafana sign-in** is Grafana's own: username and password for local users, and any of Grafana's OAuth providers side by side (Google, GitHub, GitLab, Microsoft Entra ID, Okta, or any OpenID Connect provider through generic OAuth), each configured under Grafana's own setting names. Each provider's client secret is a Secrets Manager ARN that External Secrets reads into the cluster. Register `https://<hostname>/login/<provider>` as the OAuth application's redirect URI.
+ **Grafana sign-in** is Grafana's own: a list of sign-in providers, username and password for local users (the default) and any of Grafana's OAuth providers side by side (Google, GitHub, GitLab, Microsoft Entra ID, Okta, or any OpenID Connect provider through generic OAuth), each configured under Grafana's own setting names. Without username and password, Grafana has no login form and accepts no password, including the generated admin's. Each provider's client secret is a Secrets Manager ARN that External Secrets reads into the cluster. Register `https://<hostname>/login/<provider>` as the OAuth application's redirect URI.
**Several destinations that render are a fallback chain, not a merge.** Ravion reads the first one that can answer right now - the in-cluster store, then CloudWatch Logs; Amazon Managed Prometheus when selected, then Prometheus through Thanos, then Container Insights - and says which store it is showing. It never merges two of them for the same service, which would show every line twice.
@@
- Each load balancer's security group is automatically allowed to reach pods through the EKS cluster security group (all TCP ports).
- Because `TargetGroupBinding` depends on the controller, enabling any load balancer automatically installs the **load balancer controller** - there is nothing extra to configure.
- Terraform source: [ravionhq/modules/compute/eks/addons](https://github.com/ravionhq/modules/tree/rvn-eks-addons@0.24.1/compute/eks/addons)
+ Terraform source: [ravionhq/modules/compute/eks/addons](https://github.com/ravionhq/modules/tree/rvn-eks-addons@0.25.0/compute/eks/addons)
## Prerequisites
@@
| Existing log bucket | No | Creates one | Store logs in an existing bucket instead of `ravion-loki-<cluster>-<account>` |
| In-cluster Grafana | No | `false` | Grafana in the cluster, wired to the selected logs, metrics and traces stores |
| Access | No | `false` | Grafana over HTTPS at a hostname, on the private (default) or public ALB, or through a Kubernetes Ingress |
- | Username and password | No | `true` | Grafana's built-in sign-in; off leaves only the providers |
- | Sign-in providers | No | None | Any of Google, GitHub, GitLab, Microsoft Entra ID, Okta and generic OAuth |
+ | Sign-in providers | No | Username and password | Username and password, and any of Google, GitHub, GitLab, Microsoft Entra ID, Okta and generic OAuth |
| Grafana read access | No | `false` | Read-only IAM role for Amazon Managed Grafana over the AMP workspace |
| Ravion EKS Management | No | `true` | Registers the cluster, installs Operator, and enables in-cluster deployments |
| Public ALB | No | `true` | Shared internet-facing ALB (HTTPS with ACM certificate) |
@@
execution_environment_overrides:
security_group: << module.input.ravion_runner_security_group_id >>
plan_permissions: '<< module.input.terraform_plan_default_policies_enabled == false ? {"replace": module.input.terraform_plan_iam_policy_arns} : (module.input.terraform_plan_iam_policy_arns ? {"attach": module.input.terraform_plan_iam_policy_arns} : nil) >>'
- ref: rvn-eks-addons@0.24.1
+ ref: rvn-eks-addons@0.25.0
repo: https://github.com/ravionhq/modules
stack_id: <<stack.id>>
terraform_variables:
@@
listener_rule_priority: << module.input.grafana_listener_rule_priority >>
load_balancer: << module.input.grafana_load_balancer || "private" >>
method: << module.input.grafana_access_method || "load_balancer" >>
- grafana_auth:
- default_role: << module.input.grafana_default_role || "Viewer" >>
- login_form_enabled: "<< module.input.grafana_login_form_enabled != nil ? module.input.grafana_login_form_enabled : true >>"
- grafana_auth_providers: "<< module.input.grafana_auth_providers != nil ? module.input.grafana_auth_providers : [] >>"
+ grafana_auth_providers: '<< module.input.grafana_auth_providers != nil ? module.input.grafana_auth_providers : [{"provider": "basic"}] >>'
+ grafana_default_role: << module.input.grafana_default_role || "Viewer" >>
grafana_enabled: << module.input.grafana_enabled >>
grafana_environment_variables: "<< module.input.grafana_environment_variables != nil ? module.input.grafana_environment_variables : [] >>"
grafana_role_creation_enabled: << module.input.grafana_role_creation_enabled >> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Username and password is now an entry in Grafana's Sign-in providers list, next to the OAuth providers. The separate "Username and password" toggle is gone. This is a deliberate breaking change with no compatibility shim, since no customer uses Grafana sign-in yet. It is stacked on #237, which owns the 0.24.1 bump, so this PR takes the combined 0.25.0.
Terraform
basictakes onlyprovider. A validation rejects clients, endpoints, scopes, restrictions, role mapping or settings on it, and the duplicate-provider validation stops it appearing twice.basic,grafana.inigetsauth.disable_login_form = trueand[auth.basic] enabled = false, exactly aslogin_form_enabled = falsedid.basicnever becomes an[auth.basic]section of its own; only OAuth entries go throughgrafana_auth_by_provider.length(grafana_auth_providers) > 0.Form
grafana_login_form_enabledinput is removed.grafana_auth_providersdefaults to one "Username and password" card (value: basic, listed first under Provider).show_when: {provider: {not: basic}}hides every OAuth field on that card. The card shows no "Client ID" line, because the description template renders nothing whenclient_idis empty.Upgrading prod: root
ravion.yamlin flightcontrol pins 0.24.0 withgrafana_login_form_enabled: falseand Google only. When it bumps to 0.25.0, delete that line and nothing else. Its provider list has nobasicentry, so passwords stay off as they are today.Tests:
tofu test -filter=tests/grafana_auth.tftest.hclpasses 38/38, including new runs for basic beside Google, an empty list, OAuth fields on basic, and basic twice.validate,npm test(178) andreadme --checkalso pass. I didn't run the local-dev publish because there's no local Ravion API on this VM.Link to Devin session: https://app.devin.ai/sessions/b66c5f56571c4ea486860ba193e2bec6
Open in Devin Desktop: https://app.devin.ai/desktop/session/b66c5f56571c4ea486860ba193e2bec6?variant=devin
The PR appears safe to merge, with non-blocking fixes for the default fallback and stale role instructions.
Findings
Fix with agent prompt
Summary
This release moves username-and-password sign-in into
grafana_auth_providersasbasicand replacesgrafana_authwithgrafana_default_role.Removing compatibility with
grafana_authandgrafana_login_form_enabledis intentional. devin-ai-integration[bot] explicitly described this as a breaking change with no compatibility shim because no customer uses Grafana sign-in yet.Checks were based on source inspection; tests and the external form were not run.
Diagram
%%{init: {'theme': 'neutral'}}%% flowchart TD A[grafana_auth_providers] --> B{Contains basic?} B -->|Yes| C[Keep password sign-in] B -->|No| D[Disable login form and HTTP basic auth] A --> E[Exclude basic from OAuth entries] E --> F[OAuth settings and secret references] C --> G[grafana.ini] D --> G F --> G H[grafana_default_role] --> GReviews (1) · Last reviewed commit: "rvn-eks-addons 0.25.0: username and pass..." · Reviewed by Greptile