mirror of
https://github.com/grafana/grafana.git
synced 2024-11-24 09:50:29 -06:00
Christopher Moyer
GitHub
parent
dc2ca80f4d
commit
3d8890453f
@ -10,4 +10,4 @@ This section includes information for Grafana administrators, team administrator
|
||||
|
||||
{{< section >}}
|
||||
|
||||
For information about authorization and authentication for your Grafana Cloud Stack and Grafana Cloud Portal, refer to [Grafana Cloud Access Policies](https://grafana.com/docs/grafana-cloud/authentication-and-permissions/access-policies/).
|
||||
For information about authorization and authentication for your Grafana Cloud Stack and Grafana Cloud Portal, refer to [Grafana Cloud Access Policies](/docs/grafana-cloud/authentication-and-permissions/access-policies/).
|
||||
|
||||
@ -642,6 +642,7 @@ The following sections detail the supported settings and secure settings for eac
|
||||
|
||||
## Grafana Enterprise
|
||||
|
||||
Grafana Enterprise supports provisioning for the following resources:
|
||||
Grafana Enterprise supports:
|
||||
|
||||
- [Role-based access control provisioning]({{< relref "../roles-and-permissions/access-control/rbac-provisioning/" >}})
|
||||
- [Provisioning role-based access control with Grafana]({{< relref "../roles-and-permissions/access-control/rbac-grafana-provisioning/" >}})
|
||||
- [Provisioning role-based access control with Terraform]({{< relref "../roles-and-permissions/access-control/rbac-terraform-provisioning/" >}})
|
||||
|
||||
@ -13,7 +13,7 @@ weight: 120
|
||||
|
||||
# Role-based access control (RBAC)
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
|
||||
RBAC provides a standardized way of granting, changing, and revoking access when it comes to viewing and modifying Grafana resources, such as dashboards, reports, and administrative settings.
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ weight: 40
|
||||
|
||||
# Assign RBAC roles
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
|
||||
In this topic you'll learn how to use the role picker, provisioning, and the HTTP API to assign fixed and custom roles to users and teams.
|
||||
|
||||
@ -65,7 +65,7 @@ Instead of using the Grafana role picker, you can use file-based provisioning to
|
||||
|
||||
**Before you begin:**
|
||||
|
||||
- Refer to [Role provisioning]({{< relref "./rbac-provisioning/#rbac-provisioning" >}})
|
||||
- Refer to [Role provisioning]({{< relref "./rbac-grafana-provisioning/" >}})
|
||||
- Ensure that the team to which you are adding the fixed role exists. For more information about creating teams, refer to [Manage teams]({{< relref "../../../team-management/" >}})
|
||||
|
||||
**To assign a role to a team:**
|
||||
|
||||
@ -9,7 +9,7 @@ weight: 30
|
||||
|
||||
# Configure RBAC in Grafana
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
|
||||
The table below describes all RBAC configuration options. Like any other Grafana configuration, you can apply these options as [environment variables]({{< relref "../../../../setup-grafana/configure-grafana/#configure-with-environment-variables" >}}).
|
||||
|
||||
|
||||
@ -10,7 +10,7 @@ weight: 80
|
||||
|
||||
# RBAC permissions, actions, and scopes
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
|
||||
A permission is comprised of an action and a scope. When creating a custom role, consider the actions the user can perform and the resource(s) on which they can perform those actions.
|
||||
|
||||
@ -159,7 +159,7 @@ The following list contains role-based access control scopes.
|
||||
| `orgs:*` <br> `orgs:id:*` | Restrict an action to a set of organizations. For example, `orgs:*` matches any organization and `orgs:id:1` matches the organization whose ID is `1`. |
|
||||
| `permissions:type:delegate` | The scope is only applicable for roles associated with the Access Control itself and indicates that you can delegate your permissions only, or a subset of it, by creating a new role or making an assignment. |
|
||||
| `permissions:type:escalate` | The scope is required to trigger the reset of basic roles permissions. It indicates that users might acquire additional permissions they did not previously have. |
|
||||
| `provisioners:*` | Restrict an action to a set of provisioners. For example, `provisioners:*` matches any provisioner, and `provisioners:accesscontrol` matches the role-based access control [provisioner]({{< relref "./rbac-provisioning/" >}}). |
|
||||
| `provisioners:*` | Restrict an action to a set of provisioners. For example, `provisioners:*` matches any provisioner, and `provisioners:accesscontrol` matches the role-based access control [provisioner]({{< relref "./rbac-grafana-provisioning/" >}}). |
|
||||
| `reports:*` <br> `reports:id:*` | Restrict an action to a set of reports. For example, `reports:*` matches any report and `reports:id:1` matches the report whose ID is `1`. |
|
||||
| `roles:*` <br> `roles:uid:*` | Restrict an action to a set of roles. For example, `roles:*` matches any role and `roles:uid:randomuid` matches only the role whose UID is `randomuid`. |
|
||||
| `services:accesscontrol` | Restrict an action to target only the role-based access control service. You can use this in conjunction with the `status:accesscontrol` actions. |
|
||||
|
||||
@ -12,7 +12,7 @@ weight: 50
|
||||
|
||||
# Manage RBAC roles
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
|
||||
This section includes instructions for how to view permissions associated with roles, create custom roles, and update and delete roles.
|
||||
|
||||
@ -90,7 +90,7 @@ Create a custom role when basic roles and fixed roles do not meet your permissio
|
||||
|
||||
- [Plan your RBAC rollout strategy]({{< relref "./plan-rbac-rollout-strategy/" >}}).
|
||||
- Determine which permissions you want to add to the custom role. To see a list of actions and scope, refer to [RBAC permissions, actions, and scopes]({{< relref "./custom-role-actions-scopes/" >}}).
|
||||
- [Enable role provisioning]({{< relref "./rbac-provisioning/" >}}).
|
||||
- [Enable role provisioning]({{< relref "./rbac-grafana-provisioning/" >}}).
|
||||
- Ensure that you have permissions to create a custom role.
|
||||
- By default, the Grafana Admin role has permission to create custom roles.
|
||||
- A Grafana Admin can delegate the custom role privilege to another user by creating a custom role with the relevant permissions and adding the `permissions:type:delegate` scope.
|
||||
|
||||
@ -11,7 +11,7 @@ weight: 20
|
||||
|
||||
# Plan your RBAC rollout strategy
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
|
||||
An RBAC rollout strategy helps you determine _how_ you want to implement RBAC prior to assigning RBAC roles to users and teams.
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ weight: 70
|
||||
|
||||
# RBAC role definitions
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
|
||||
The following tables list permissions associated with basic and fixed roles.
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ weight: 60
|
||||
|
||||
# Provisioning RBAC with Grafana
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
|
||||
You can create, change or remove [Custom roles]({{< relref "./manage-rbac-roles/#create-custom-roles-using-provisioning" >}}) and create or remove [basic role assignments]({{< relref "./assign-rbac-roles/#assign-a-fixed-role-to-a-basic-role-using-provisioning" >}}), by adding one or more YAML configuration files in the `provisioning/access-control/` directory.
|
||||
|
||||
|
||||
@ -148,4 +148,4 @@ Similarly, you can look up and use `id`s of users, teams and service accounts th
|
||||
|
||||
[RBAC setup with Grafana provisioning]({{< relref "./rbac-grafana-provisioning">}})
|
||||
|
||||
[Grafana Cloud Terraform provisioning](https://grafana.com/docs/grafana-cloud/infrastructure-as-code/terraform/)
|
||||
[Grafana Cloud Terraform provisioning](/docs/grafana-cloud/infrastructure-as-code/terraform/)
|
||||
|
||||
@ -42,8 +42,8 @@ Currently, provisioning for Grafana Alerting supports alert rules, contact point
|
||||
|
||||
**Useful Links:**
|
||||
|
||||
[Grafana provisioning](https://grafana.com/docs/grafana/latest/administration/provisioning/)
|
||||
[Grafana provisioning](/docs/grafana/latest/administration/provisioning/)
|
||||
|
||||
[Grafana Cloud provisioning](https://grafana.com/docs/grafana-cloud/infrastructure-as-code/terraform/)
|
||||
[Grafana Cloud provisioning](/docs/grafana-cloud/infrastructure-as-code/terraform/)
|
||||
|
||||
[Grafana Alerting provisioning API](https://grafana.com/docs/grafana/latest/developers/http_api/alerting_provisioning)
|
||||
[Grafana Alerting provisioning API](/docs/grafana/latest/developers/http_api/alerting_provisioning)
|
||||
|
||||
@ -29,7 +29,7 @@ When using Prometheus, contact points and notification policies are read-only in
|
||||
## Provision the Alertmanager data source
|
||||
|
||||
You can provision Alertmanager data sources by updating Grafana's configuration files.
|
||||
For more information on provisioning, and common settings available, refer to the [provisioning docs page]({{< relref "../administration/provisioning/#datasources" >}}).
|
||||
For more information on provisioning, and common settings available, refer to the [provisioning docs page]({{< relref "../../administration/provisioning/#datasources" >}}).
|
||||
|
||||
Here is an example for provisioning the Alertmanager data source:
|
||||
|
||||
|
||||
@ -220,7 +220,7 @@ The CloudWatch plugin provides the ability to monitor and troubleshoot applicati
|
||||
|
||||
> **Note:** This feature is currently behind the `cloudWatchCrossAccountQuerying` feature toggle.
|
||||
|
||||
> You can enable feature toggles through configuration file or environment variables. See configuration [docs]({{< relref "../setup-grafana/configure-grafana/#feature_toggles" >}}) for details.
|
||||
> You can enable feature toggles through configuration file or environment variables. See configuration [docs]({{< relref "../../../setup-grafana/configure-grafana/#feature_toggles" >}}) for details.
|
||||
> Grafana Cloud users can access this feature by [opening a support ticket in the Cloud Portal](https://grafana.com/profile/org#support).
|
||||
|
||||
### Getting started
|
||||
|
||||
@ -10,7 +10,7 @@ weight: 500
|
||||
|
||||
# Get started with Grafana and MS SQL Server
|
||||
|
||||
Microsoft SQL Server is a popular relational database management system that is widely used in development and production environments. This topic walks you through the steps to create a series of dashboards in Grafana to display metrics from a MS SQL Server database. You can also configure the MS SQL Server data source on a [Grafana Cloud](https://grafana.com/docs/grafana-cloud/) instance without having to host Grafana yourself.
|
||||
Microsoft SQL Server is a popular relational database management system that is widely used in development and production environments. This topic walks you through the steps to create a series of dashboards in Grafana to display metrics from a MS SQL Server database. You can also configure the MS SQL Server data source on a [Grafana Cloud](/docs/grafana-cloud/) instance without having to host Grafana yourself.
|
||||
|
||||
{{< docs/shared "getting-started/first-step.md" >}}
|
||||
|
||||
|
||||
@ -16,7 +16,7 @@ To learn more about Grafana Enterprise, refer to [our product page](https://graf
|
||||
|
||||
## Enterprise features in Grafana Cloud
|
||||
|
||||
Many Grafana Enterprise features are also available in [Grafana Cloud]({{< ref "/docs/grafana-cloud" >}}) Pro and Advanced accounts. For details, refer to [the Grafana Cloud features table](https://grafana.com/pricing/#featuresTable).
|
||||
Many Grafana Enterprise features are also available in [Grafana Cloud](/docs/grafana-cloud) Pro and Advanced accounts. For details, refer to [the Grafana Cloud features table](https://grafana.com/pricing/#featuresTable).
|
||||
|
||||
## Authentication
|
||||
|
||||
|
||||
@ -53,7 +53,7 @@ For details on a specific data source's unique query editor features, refer to i
|
||||
- For data sources installed as plugins, refer to its own documentation.
|
||||
- Data source plugins in Grafana's [plugin catalog](/grafana/plugins/) link to or include their documentation in their catalog listings.
|
||||
For details about the plugin catalog, refer to [Plugin management]({{< relref "../../administration/plugin-management/" >}}).
|
||||
- For links to [Grafana Enterprise]({{< relref "../../enterprise/" >}}) data source plugin documentation, refer to the [Enterprise plugins index](/docs/plugins/).
|
||||
- For links to Grafana Enterprise data source plugin documentation, refer to the [Enterprise plugins index](/docs/plugins/).
|
||||
|
||||
### Query syntax
|
||||
|
||||
|
||||
@ -19,8 +19,8 @@ _Traces_ are a visualization that enables you to track and log a request as it t
|
||||
|
||||
For more information about traces and how to use them, refer to the following documentation:
|
||||
|
||||
- [What are traces](https://grafana.com/docs/grafana-cloud/traces)
|
||||
- [What are traces](/docs/grafana-cloud/traces)
|
||||
- [Tracing in Explore]({{< relref "../../../explore/trace-integration/" >}})
|
||||
- [Getting started with Tempo](https://grafana.com/docs/tempo/latest/getting-started)
|
||||
- [Getting started with Tempo](/docs/tempo/latest/getting-started)
|
||||
|
||||
{{< figure src="/static/img/docs/explore/explore-trace-view-full-8-0.png" class="docs-image--no-shadow" max-width= "900px" caption="Screenshot of the trace view" >}}
|
||||
|
||||
@ -11,7 +11,7 @@ weight: 300
|
||||
|
||||
Custom branding allows you to replace the Grafana brand and logo with your own corporate brand and logo.
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
|
||||
Grafana Enterprise has custom branding options in the `grafana.ini` file. As with all configuration options, you can also set them with environment variables.
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ weight: 800
|
||||
The LDAP integration in Grafana allows your Grafana users to login with their LDAP credentials. You can also specify mappings between LDAP
|
||||
group memberships and Grafana Organization user roles.
|
||||
|
||||
> [Enhanced LDAP authentication]({{< relref "../enhanced-ldap/" >}}) is available in [Grafana Cloud Advanced](https://grafana.com/docs/grafana-cloud/) and in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}).
|
||||
> [Enhanced LDAP authentication]({{< relref "../enhanced-ldap/" >}}) is available in [Grafana Cloud Advanced](/docs/grafana-cloud/) and in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}).
|
||||
|
||||
> Refer to [Role-based access control]({{< relref "../../../../administration/roles-and-permissions/access-control/" >}}) to understand how you can control access with role-based permissions.
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ SAML authentication integration allows your Grafana users to log in by using an
|
||||
|
||||
The SAML single sign-on (SSO) standard is varied and flexible. Our implementation contains a subset of features needed to provide a smooth authentication experience into Grafana.
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Pro and Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Pro and Advanced](/docs/grafana-cloud).
|
||||
|
||||
## Supported SAML
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ weight: 500
|
||||
|
||||
If you manage your secrets with [Hashicorp Vault](https://www.hashicorp.com/products/vault), you can use them for [Configuration]({{< relref "../../../configure-grafana/" >}}) and [Provisioning]({{< relref "../../../../administration/provisioning/" >}}).
|
||||
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced]({{< ref "/docs/grafana-cloud" >}}).
|
||||
> **Note:** Available in [Grafana Enterprise]({{< relref "../../../../introduction/grafana-enterprise/" >}}) and [Grafana Cloud Advanced](/docs/grafana-cloud).
|
||||
|
||||
> **Note:** If you have Grafana [set up for high availability]({{< relref "../../../set-up-for-high-availability/" >}}), then we advise not to use dynamic secrets for provisioning files.
|
||||
> Each Grafana instance is responsible for renewing its own leases. Your data source leases might expire when one of your Grafana servers shuts down.
|
||||
|
||||
@ -9,7 +9,7 @@ title: Configure security hardening
|
||||
|
||||
Security hardening enables you to apply additional security, which can help stop certain vulnerabilities from being exploited by a malicious attacker.
|
||||
|
||||
> **Note:** These settings are available in the [grafana.ini configuration file]({{< relref "../configure-grafana/#configuration-file-location" >}}). To apply changes to the configuration file, restart the Grafana server.
|
||||
> **Note:** These settings are available in the [grafana.ini configuration file]({{< relref "../../configure-grafana/#configuration-file-location" >}}). To apply changes to the configuration file, restart the Grafana server.
|
||||
|
||||
## Additional security for cookies
|
||||
|
||||
|
||||
@ -45,7 +45,7 @@ You can now easily embed Grafana in other applications by adding a JWT token dir
|
||||
When the JWT token is passed through the request URL to Grafana, Grafana validates and authenticates the token linked to a specific user, allowing access to dashboards which that user can view.
|
||||
To see JWT URL embedding in action, see the [sample project](https://github.com/grafana/grafana-iframe-oauth-sample).
|
||||
|
||||
> **Note:** JWT URL Embedding and `allow_embedding` are not available to Grafana Cloud users. For Grafana Cloud, use the [Public Dashboards]({{< relref "../dashboards/dashboard-public/" >}}) feature. To enable that, [open a ticket with our Support team](https://grafana.com/docs/grafana-cloud/account-management/support/).
|
||||
> **Note:** JWT URL Embedding and `allow_embedding` are not available to Grafana Cloud users. For Grafana Cloud, use the [Public Dashboards]({{< relref "../dashboards/dashboard-public/" >}}) feature. To enable that, [open a ticket with our Support team](/docs/grafana-cloud/account-management/support/).
|
||||
|
||||
{{< figure src="/static/img/docs/dashboards/jwt-url-embedding-9-1.png" max-width="750px" caption="A JWT token used to embed Grafana" >}}
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user