IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-08-09 04:38:16 -05:00
Code Issues Packages Projects Releases Wiki Activity

ExtJwt: don't log verify errors as they spam for grafana-agent (#90351)

Browse Source 
* ExtJwt: don't log verify errors as they spam for grafana-agent

* remove dead code

* revert unintended change

* revert unintended change
This commit is contained in:
Charandas
2024-07-11 18:23:43 -07:00
committed by GitHub
parent d2bc4f3255
commit 4abb4d1662
3 changed files with 44 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/apiserver/endpoints/filters/requester.go
+43 -40
View File
@@ -16,54 +16,57 @@ func WithRequester(handler http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
ctx := req.Context()
requester, err := identity.GetRequester(ctx)
if err != nil {
// Find the kubernetes user info
info, ok := request.UserFrom(ctx)
if ok {
if info.GetName() == user.Anonymous {
requester = &identity.StaticRequester{
Namespace: identity.NamespaceAnonymous,
Name: info.GetName(),
Login: info.GetName(),
Permissions: map[int64]map[string][]string{},
}
if err == nil {
handler.ServeHTTP(w, req)
return
}
// Find the kubernetes user info
info, ok := request.UserFrom(ctx)
if ok {
if info.GetName() == user.Anonymous {
requester = &identity.StaticRequester{
Namespace: identity.NamespaceAnonymous,
Name: info.GetName(),
Login: info.GetName(),
Permissions: map[int64]map[string][]string{},
}
}
if info.GetName() == user.APIServerUser ||
slices.Contains(info.GetGroups(), user.SystemPrivilegedGroup) {
orgId := int64(1)
requester = &identity.StaticRequester{
Namespace: identity.NamespaceServiceAccount, // system:apiserver
UserID: 1,
OrgID: orgId,
Name: info.GetName(),
Login: info.GetName(),
OrgRole: identity.RoleAdmin,
if info.GetName() == user.APIServerUser ||
slices.Contains(info.GetGroups(), user.SystemPrivilegedGroup) {
orgId := int64(1)
requester = &identity.StaticRequester{
Namespace: identity.NamespaceServiceAccount, // system:apiserver
UserID: 1,
OrgID: orgId,
Name: info.GetName(),
Login: info.GetName(),
OrgRole: identity.RoleAdmin,
IsGrafanaAdmin: true,
AllowedKubernetesNamespace: "default",
IsGrafanaAdmin: true,
AllowedKubernetesNamespace: "default",
Permissions: map[int64]map[string][]string{
orgId: {
"*": {"*"}, // all resources, all scopes
Permissions: map[int64]map[string][]string{
orgId: {
"*": {"*"}, // all resources, all scopes
// Dashboards do not support wildcard action
// dashboards.ActionDashboardsRead: {"*"},
// dashboards.ActionDashboardsCreate: {"*"},
// dashboards.ActionDashboardsWrite: {"*"},
// dashboards.ActionDashboardsDelete: {"*"},
// dashboards.ActionFoldersCreate: {"*"},
// dashboards.ActionFoldersRead: {dashboards.ScopeFoldersAll}, // access to read all folders
},
// Dashboards do not support wildcard action
// dashboards.ActionDashboardsRead: {"*"},
// dashboards.ActionDashboardsCreate: {"*"},
// dashboards.ActionDashboardsWrite: {"*"},
// dashboards.ActionDashboardsDelete: {"*"},
// dashboards.ActionFoldersCreate: {"*"},
// dashboards.ActionFoldersRead: {dashboards.ScopeFoldersAll}, // access to read all folders
},
}
},
}
}
if requester != nil {
req = req.WithContext(identity.WithRequester(ctx, requester))
} else {
klog.V(5).Info("unable to map the k8s user to grafana requester", "user", info)
}
if requester != nil {
req = req.WithContext(identity.WithRequester(ctx, requester))
} else {
klog.V(5).Info("unable to map the k8s user to grafana requester", "user", info)
}
}
handler.ServeHTTP(w, req)
pkg/services/apiserver/builder/helper.go
+1
View File
@@ -102,6 +102,7 @@ func SetupConfig(
// Needs to run last in request chain to function as expected, hence we register it first.
handler := filters.WithTracingHTTPLoggingAttributes(requestHandler)
// filters.WithRequester needs to be after the K8s chain because it depends on the K8s user in context
handler = filters.WithRequester(handler)
handler = genericapiserver.DefaultBuildHandlerChain(handler, c)
pkg/services/authn/clients/ext_jwt.go
-2
View File
@@ -74,7 +74,6 @@ func (s *ExtendedJWT) Authenticate(ctx context.Context, r *authn.Request) (*auth
claims, err := s.accessTokenVerifier.Verify(ctx, jwtToken)
if err != nil {
s.log.Error("Failed to verify access token", "error", err)
return nil, errExtJWTInvalid.Errorf("failed to verify access token: %w", err)
}
@@ -82,7 +81,6 @@ func (s *ExtendedJWT) Authenticate(ctx context.Context, r *authn.Request) (*auth
if idToken != "" {
idTokenClaims, err := s.idTokenVerifier.Verify(ctx, idToken)
if err != nil {
s.log.Error("Failed to verify id token", "error", err)
return nil, errExtJWTInvalid.Errorf("failed to verify id token: %w", err)
}