Grafana 接入 LDAP 认证

Grafana 是一个非常好用的展示数据软件，我一直以为可以直接在设置里增加 ldap 配置，没想到啊没想到必须要修改配置文件才能接入到 LDAP，还是记录一下吧，免得下次部署浪费时间。

我是在 Kubernetes 中部署的，数据存储用的是 MySQL，所以 Grafana 本身可以当作一个无状态服务来看待。也可以不做数据持久化。

先创建 ldap 配置文件

这里包括 ldap 数据的映射关系，可以自己尝试修改调整。

kind: ConfigMap
apiVersion: v1
metadata:
  name: grafana-ldap-config
  namespace: ops
data:
  ldap.toml: |
    [[servers]]
    host = "10.0.0.11"
    port = 389
    use_ssl = false
    start_tls = false
    ssl_skip_verify = false
    bind_dn = "cn=admin,dc=i,dc=com"
    bind_password = "password"
    search_filter = "(uid=%s)"
    search_base_dns = ["dc=i,dc=com"]
    [servers.attributes]
    member_of = "memberOf"
    email =  "uid"
    name = "cn"
    username = "uid"

创建 deployment 和 service


apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: ops
  labels:
    app: grafana
  name: grafana
spec:
  selector:
    matchLabels:
      app: grafana
  template:
    metadata:
      labels:
        app: grafana
    spec:
      securityContext:
        fsGroup: 472
        supplementalGroups:
          - 0
      volumes:
        - name: ldap-config
          configMap:
            name: grafana-ldap-config
            defaultMode: 420
      containers:
        - name: grafana
          image: registry.cn-hangzhou.aliyuncs.com/yaml/images:grafana-11.2.2-ubuntu
          env:
            - name: GF_AUTH_BASIC_ENABLED
              value: 'true'
            - name: GF_AUTH_ANONYMOUS_ENABLED
              value: 'false'
            - name: GF_AUTH_ANONYMOUS_ORG_ROLE
              value: Admin
            - name: GF_DASHBOARDS_JSON_ENABLED
              value: 'true'
            - name: GF_SECURITY_ADMIN_USER
              value: admin
            - name: GF_SECURITY_ADMIN_PASSWORD
              value: admin
            - name: GF_DATABASE_TYPE
              value: mysql
            - name: GF_DATABASE_HOST
              value: 10.0.0.65
            - name: GF_DATABASE_PORT
              value: '3306'
            - name: GF_DATABASE_USER
              value: root
            - name: GF_DATABASE_PASSWORD
              value: password
            - name: GF_DATABASE_NAME
              value: grafana
            - name: GF_AUTH_LDAP_ENABLED
              value: 'true'
            - name: GF_AUTH_LDAP_ALLOW_SIGN_UP
              value: 'true'
            - name: GF_AUTH_LDAP_CONFIG_FILE
              value: /etc/grafana/ldap.toml
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 3000
              name: http-grafana
              protocol: TCP
          readinessProbe:
            failureThreshold: 3
            httpGet:
              path: /robots.txt
              port: 3000
              scheme: HTTP
            initialDelaySeconds: 10
            periodSeconds: 30
            successThreshold: 1
            timeoutSeconds: 2
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 30
            periodSeconds: 10
            successThreshold: 1
            tcpSocket:
              port: 3000
            timeoutSeconds: 1
          resources:
            requests:
              cpu: 250m
              memory: 750Mi
          volumeMounts:
            - name: ldap-config
              mountPath: /etc/grafana/ldap.toml
              subPath: ldap.toml
---
apiVersion: v1
kind: Service
metadata:
  name: grafana
  namespace: ops
spec:
  # type: NodePort
  ports:
    - port: 3000
      protocol: TCP
      targetPort: http-grafana
      # nodePort: 30030
  selector:
    app: grafana
  sessionAffinity: None

创建 ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: grafana
  namespace: ops
  annotations:
    # kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"

spec:
  ingressClassName: internet
  tls:
  - hosts:
    - grafana.i.com
    secretName: i-com
  rules:
  - host: grafana.i.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: grafana
            port:
              number: 3000