grafana/grafana-azure-sdk-go

github.com/grafana/grafana-azure-sdk-go

SDK for integration of Grafana datasources with Azure services.

Packages

azsettings

Common Azure configuration. Can be read from either the environment variables of the Grafana instance (if supplied to the plugin) or from the context supplied to the plugin (if available).

This can be achieved by making use of ReadSettings which will determine the settings based on the available context.

Note: If the plugin context contains any Azure related variable then it will be used in place of any environment variables present.

azcredentials

The built-in AzureCredentials:

• AadCurrentUserCredentials
• AzureManagedIdentityCredentials
• AzureClientSecretCredentials
• AzureClientSecretOboCredentials

azhttpclient

Azure authentication middleware for Grafana Plugin SDK httpclient.

Usage

// Initialize the authentication options
authOpts := azhttpclient.NewAuthOptions(azureSettings)

// Configure instance-level scopes
authOpts.Scopes([]string{"https://datasource.example.org/.default"})

// Optionally, register custom token providers
authOpts.AddTokenProvider("custom-auth-type", func (...) (aztokenprovider.AzureTokenProvider, error) {
	return NewCustomTokenProvider(...), nil
})

// Configure the client
clientOpts := httpclient.Options{}
azhttpclient.AddAzureAuthentication(&clientOpts, authOpts, credentials)

httpClient, err := httpclient.NewProvider().New(clientOpts)

azusercontext

Context object CurrentUserContext of the currently signed-in Grafana user which can be passed via context between business layers.

Used by token provider to get information about the current user for user identity authentication.

Read/write functions:

• context = azusercontext.WithCurrentUser(context, currentUser) extends given context with information about the current user.
• currentUser = azusercontext.GetCurrentUser(context) extracts current user from the given context

Helper functions for datasource requests:

• WithUserFromQueryReq extracts current user from query request and adds to context.
• WithUserFromResourceReq extracts current user from resource call and adds to context.
• WithUserFromHealthCheckReq extracts current from health check request and adds to context.

aztokenprovider

util

• maputil

License

Apache 2.0 License

grafana-azure-sdk-go's Issues

Discard access token if resource returned 401

AzureMiddleware and AzureTokenProvider are implemented in a way that tokens being kept in cache until their expiration time regardless whether the token is still accepted or not.

In cases when resource endpoint starts rejecting a token and returns 401, the middleware should invalidate the token and subsequent request should trigger token refresh.

Could be implemented here.

Add a parser of custom Azure cloud configuration

Currently we support only three known clouds: Public, China and US Gov.
To support custom cloud configurations (e.g. Azure Stack), we need a way to pass cloud metadata parse it into collection of available clouds.

az cloud list

Measure performance of token requests via Prometheus metrics

Add metrics to measure performance for different authentication types (cache hits, token request times etc.).

Add support for user identity authentication via custom token endpoint

Similar to how Managed Identity (MSI) authentication uses a token endpoint to request access tokens in the scope of the Grafana instance, a custom configurable token endpoint can be used to request access tokens in the scope of the currently signed in user.

This would allow user identity authentication scenarios where Grafana envrironment configured accordingly.

Configurable Azure authentication middleware for support of custom token providers

Add support for parametrization into the Azure authentication middleware to support custom token providers which are not directly implemented in the SDK.

Please consider renaming this to grafana-azure-sdk-go or grafana-azure-wrapper-go

For example, to avoid confusion with https://github.com/Azure/azure-sdk-for-go

Introduce the new cloud API in Grafana Azure SDK

Design discussion:

• grafana/grafana#61016

Support Client Secret OBO in the SDK

ADX currently implements this authentication method outside of the SDK (see here and here).

This feature has been experimental for some time but there's no reason for this anymore. Additionally, it may be the case that other data sources need to support it in the future so standardising the implementation would be useful.

Add a reader of AzureSettings from plugin environment

azsettings.AzureSettings is a struct which keeps the Azure environment configuration.
Currently it's responsibility of a plugin to fill up and supply this struct.

We need to implement a shared reusable reader of azsettings.AzureSettings which could be used by all Azure plugins.

Support Define Tenant ID and Client ID for Workload Identity

What happened:

At the moment, Grafana fully rely on Environment Variables or grafana.ini for Workload Identity.

What you expected to happen:

I would like to use the same Workload Identity source (token file) in multiple datasource against different Tenant ID. I have multiple Tenants which different Client that trust the OIDC issuer for my AKS cluster. But this requires different Client ID and Tenant ID per datasource settings.

Like the Client ID for Managed Identity, which is also configurable per datasource.

Default database setting has no effect in the query editor

After changing the default database for an ADX data source, new panels still use the first default database.

Support service principal for user-auth

Update the SDK to support a service principal credential when using user-authentication methods. This will allow us to support backend functionality via the service principal credentials which will always be present.

Initialization of custom clouds from config file in Grafana Azure SDK

Design discussion:

• grafana/grafana#61016

Update cache to renew retriever if token is expired

Currently the ID token expiry isn't validated when using user-auth. This leads to unauthorised errors. The ID token expiry should be validated and refreshed if expired.

Update credentials builder for user-auth service credentials

Allow the builder to appropriately build credentials for user-auth.

Initialization of clouds from config file in external datasources

Design discussion:

• grafana/grafana#61016

Support client certificates for App Registration

Extend the Grafana Azure SDK to support Azure credentials with client certificates.

Azure region in AzureSettings

azsettings.AzureSettings already contain information about the current Azure cloud, adding Azure region would be also definitional for authorization and datasources.

Use the cloud API in token provider

Related:

• #24

Design discussion:

• grafana/grafana#61016