Skip to content

feat: grafana token creation #197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bornast wants to merge 1 commit into
base: master
Choose a base branch
from
Open

feat: grafana token creation #197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 19 additions & 6 deletions src/components/grafana/builder.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ export class GrafanaBuilder {
[];
private readonly dashboardBuilders: GrafanaDashboardBuilder.CreateDashboard[] =
[];
private readonly scopes: string[] = [];
private folderName?: string;

constructor(name: string) {
Expand All @@ -27,25 +28,36 @@ export class GrafanaBuilder {
return this;
}

public addAmp(name: string, args: AMPConnection.Args): this {
this.connectionBuilders.push(opts => new AMPConnection(name, args, opts));
public addScope(...scopes: string[]): this {
this.scopes.push(...scopes);

return this;
}

public addAmp(name: string, args: Omit<AMPConnection.Args, 'stack'>): this {
this.connectionBuilders.push(
(ctx, opts) => new AMPConnection(name, { ...args, ...ctx }, opts),
);

return this;
}

public addCLoudWatchLogs(
name: string,
args: CloudWatchLogsConnection.Args,
args: Omit<CloudWatchLogsConnection.Args, 'stack'>,
): this {
this.connectionBuilders.push(
opts => new CloudWatchLogsConnection(name, args, opts),
(ctx, opts) =>
new CloudWatchLogsConnection(name, { ...args, ...ctx }, opts),
);

return this;
}

public addXRay(name: string, args: XRayConnection.Args): this {
this.connectionBuilders.push(opts => new XRayConnection(name, args, opts));
public addXRay(name: string, args: Omit<XRayConnection.Args, 'stack'>): this {
this.connectionBuilders.push(
(ctx, opts) => new XRayConnection(name, { ...args, ...ctx }, opts),
);

return this;
}
Expand Down Expand Up @@ -89,6 +101,7 @@ export class GrafanaBuilder {
connectionBuilders: this.connectionBuilders,
dashboardBuilders: this.dashboardBuilders,
folderName: this.folderName,
scopes: this.scopes,
},
opts,
);
Expand Down
2 changes: 1 addition & 1 deletion src/components/grafana/connections/amp-connection.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@ export class AMPConnection extends GrafanaConnection {
return new grafana.cloud.PluginInstallation(
`${this.name}-amp-plugin`,
{
stackSlug: this.getStackSlug(),
stackSlug: this.stack.slug,
slug: pluginName,
version: pluginVersion,
},
Expand Down
27 changes: 7 additions & 20 deletions src/components/grafana/connections/connection.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,17 @@ import * as pulumi from '@pulumi/pulumi';
import * as grafana from '@pulumiverse/grafana';
import { commonTags } from '../../../shared/common-tags';

const grafanaConfig = new pulumi.Config('grafana');

export namespace GrafanaConnection {
export type Args = {
awsAccountId: string;
dataSourceName?: string;
stack: pulumi.Input<grafana.cloud.GetStackResult>;
Copy link
Copy Markdown
Collaborator

@mandryllo mandryllo Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why inside Args and then omitted inside builder when using addAmp and others connections?
Can it be just under the same namespace but outside this type?

};

export type CreateConnectionContext = Pick<Args, 'stack'>;

export type CreateConnection = (
ctx: CreateConnectionContext,
opts: pulumi.ComponentResourceOptions,
) => GrafanaConnection;
}
Expand All @@ -21,6 +23,7 @@ export abstract class GrafanaConnection extends pulumi.ComponentResource {
public readonly role: aws.iam.Role;
public abstract readonly dataSource: grafana.oss.DataSource;
protected readonly dataSourceName: string;
protected readonly stack: pulumi.Output<grafana.cloud.GetStackResult>;

constructor(
type: string,
Expand All @@ -31,30 +34,14 @@ export abstract class GrafanaConnection extends pulumi.ComponentResource {
super(type, name, {}, opts);

this.name = name;

this.dataSourceName = args.dataSourceName ?? `${name}-datasource`;

this.stack = pulumi.output(args.stack);
this.role = this.createIamRole(args.awsAccountId);

this.registerOutputs();
}

protected getStackSlug(): string {
const grafanaUrl = grafanaConfig.get('url') ?? process.env.GRAFANA_URL;

if (!grafanaUrl) {
throw new Error(
'Grafana URL is not configured. Set it via Pulumi config (grafana:url) or GRAFANA_URL env var.',
);
}

return new URL(grafanaUrl).hostname.split('.')[0];
}

private createIamRole(awsAccountId: string): aws.iam.Role {
const stackSlug = this.getStackSlug();
const grafanaStack = grafana.cloud.getStack({ slug: stackSlug });

const assumeRolePolicy = aws.iam.getPolicyDocumentOutput({
statements: [
{
Expand All @@ -70,7 +57,7 @@ export abstract class GrafanaConnection extends pulumi.ComponentResource {
{
test: 'StringEquals',
variable: 'sts:ExternalId',
values: [pulumi.output(grafanaStack).id],
values: [this.stack.id],
},
],
},
Expand Down
2 changes: 1 addition & 1 deletion src/components/grafana/connections/xray-connection.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ export class XRayConnection extends GrafanaConnection {
return new grafana.cloud.PluginInstallation(
`${this.name}-x-ray-plugin`,
{
stackSlug: this.getStackSlug(),
stackSlug: this.stack.slug,
slug: pluginName,
version: pluginVersion,
},
Expand Down
137 changes: 130 additions & 7 deletions src/components/grafana/grafana.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,11 +8,18 @@ export namespace Grafana {
connectionBuilders: GrafanaConnection.CreateConnection[];
dashboardBuilders: GrafanaDashboardBuilder.CreateDashboard[];
folderName?: string;
scopes?: string[];
};
}

export class Grafana extends pulumi.ComponentResource {
public readonly name: string;
public readonly stack: pulumi.Output<grafana.cloud.GetStackResult>;
public readonly accessPolicy: grafana.cloud.AccessPolicy;
public readonly accessPolicyToken: pulumi.Output<string>;
public readonly serviceAccount: grafana.cloud.StackServiceAccount;
public readonly serviceAccountToken: pulumi.Output<string>;
public readonly provider: grafana.Provider;
public readonly connections: GrafanaConnection[];
public readonly folder: grafana.oss.Folder;
public readonly dashboards: grafana.oss.Dashboard[];
Expand All @@ -26,20 +33,136 @@ export class Grafana extends pulumi.ComponentResource {

this.name = name;

this.stack = grafana.cloud.getStackOutput({ slug: this.getStackSlug() });

this.accessPolicy = this.createAccessPolicy(args.scopes);
const accessPolicyToken = this.createAccessPolicyToken();
this.accessPolicyToken = pulumi.secret(accessPolicyToken.token);

this.serviceAccount = this.createServiceAccount();
const serviceAccountToken = this.createServiceAccountToken();
this.serviceAccountToken = pulumi.secret(serviceAccountToken.key);

this.provider = this.createProvider();

this.connections = args.connectionBuilders.map(build => {
return build({ parent: this });
return build(
{ stack: this.stack },
{ parent: this, provider: this.provider },
);
});

this.folder = new grafana.oss.Folder(
`${this.name}-folder`,
{ title: args.folderName ?? `${this.name}-ICB-GENERATED` },
{ parent: this },
);
this.folder = this.createFolder(args.folderName, this.provider);

this.dashboards = args.dashboardBuilders.map(build => {
return build(this.folder, { parent: this.folder });
return build(this.folder, {
parent: this.folder,
provider: this.provider,
});
});

this.registerOutputs();
}

private getStackSlug(): string {
const grafanaConfig = new pulumi.Config('grafana');
const grafanaUrl = grafanaConfig.get('url') ?? process.env.GRAFANA_URL;

if (!grafanaUrl) {
throw new Error(
'Grafana URL is not configured. Set it via Pulumi config (grafana:url) or GRAFANA_URL env var.',
);
}

return new URL(grafanaUrl).hostname.split('.')[0];
}

private createAccessPolicy(scopes?: string[]): grafana.cloud.AccessPolicy {
return new grafana.cloud.AccessPolicy(
`${this.name}-access-policy`,
{
region: this.stack.regionSlug,
name: `${this.name}-access-policy`,
scopes: [
...new Set([
'accesspolicies:read',
'accesspolicies:write',
'accesspolicies:delete',
'datasources:read',
'datasources:write',
'datasources:delete',
'stacks:read',
'stack-dashboards:read',
'stack-dashboards:write',
'stack-dashboards:delete',
'stack-plugins:read',
'stack-plugins:write',
'stack-plugins:delete',
...(scopes ?? []),
]),
],
realms: [{ type: 'stack', identifier: this.stack.id }],
},
{ parent: this },
);
}

private createAccessPolicyToken(): grafana.cloud.AccessPolicyToken {
return new grafana.cloud.AccessPolicyToken(
`${this.name}-cloud-token`,
{
region: this.stack.regionSlug,
accessPolicyId: this.accessPolicy.policyId,
name: `${this.name}-cloud-token`,
},
{ parent: this },
);
}

private createServiceAccount(): grafana.cloud.StackServiceAccount {
return new grafana.cloud.StackServiceAccount(
`${this.name}-sa`,
{
stackSlug: this.stack.slug,
name: `${this.name}-sa`,
role: 'Admin',
},
{ parent: this },
);
}

private createServiceAccountToken(): grafana.cloud.StackServiceAccountToken {
return new grafana.cloud.StackServiceAccountToken(
`${this.name}-sa-token`,
{
stackSlug: this.stack.slug,
serviceAccountId: this.serviceAccount.id,
name: `${this.name}-sa-token`,
},
{ parent: this },
);
}

private createFolder(
folderName: string | undefined,
provider: grafana.Provider,
): grafana.oss.Folder {
return new grafana.oss.Folder(
`${this.name}-folder`,
{ title: folderName ?? `${this.name}-ICB-GENERATED` },
{ parent: this, provider },
);
}

private createProvider(): grafana.Provider {
return new grafana.Provider(
`${this.name}-provider`,
{
cloudAccessPolicyToken: this.accessPolicyToken,
url: this.stack.url,
auth: this.serviceAccountToken,
},
{ parent: this },
);
}
}
26 changes: 24 additions & 2 deletions tests/grafana/amp-grafana.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,18 +56,24 @@ export function testAmpGrafana(ctx: GrafanaTestContext) {

it('should have created the AMP data source', async () => {
const grafana = ctx.outputs!.ampGrafana;

const ampDataSource = (
grafana.connections[0] as studion.grafana.AMPConnection
).dataSource;
const ampDataSourceName = ampDataSource.name as unknown as Unwrap<
typeof ampDataSource.name
>;

const authToken = grafana.serviceAccountToken as unknown as Unwrap<
typeof grafana.serviceAccountToken
>;

await backOff(async () => {
const { body, statusCode } = await grafanaRequest(
ctx,
'GET',
`/api/datasources/name/${encodeURIComponent(ampDataSourceName)}`,
authToken,
);
assert.strictEqual(statusCode, 200, 'Expected data source to exist');

Expand All @@ -90,16 +96,23 @@ export function testAmpGrafana(ctx: GrafanaTestContext) {
});

it('should have created the dashboard with expected panels', async () => {
const dashboard = ctx.outputs!.ampGrafana.dashboards[0];
const grafana = ctx.outputs!.ampGrafana;

const dashboard = grafana.dashboards[0];
const dashboardUid = dashboard.uid as unknown as Unwrap<
typeof dashboard.uid
>;

const authToken = grafana.serviceAccountToken as unknown as Unwrap<
typeof grafana.serviceAccountToken
>;

await backOff(async () => {
const { body, statusCode } = await grafanaRequest(
ctx,
'GET',
`/api/dashboards/uid/${dashboardUid}`,
authToken,
);
assert.strictEqual(statusCode, 200, 'Expected dashboard to exist');

Expand Down Expand Up @@ -135,16 +148,24 @@ export function testAmpGrafana(ctx: GrafanaTestContext) {
it('should display metrics data in the dashboard', async () => {
await requestEndpointWithExpectedStatus(ctx, ctx.config.usersPath, 200);

const grafana = ctx.outputs!.ampGrafana;

const ampDataSource = (
ctx.outputs!.ampGrafana.connections[0] as studion.grafana.AMPConnection
grafana.connections[0] as studion.grafana.AMPConnection
).dataSource;
const ampDataSourceName = ampDataSource.name as unknown as Unwrap<
typeof ampDataSource.name
>;

const authToken = grafana.serviceAccountToken as unknown as Unwrap<
typeof grafana.serviceAccountToken
>;

const { body: dsBody } = await grafanaRequest(
ctx,
'GET',
`/api/datasources/name/${encodeURIComponent(ampDataSourceName)}`,
authToken,
);
const dsData = (await dsBody.json()) as Record<string, unknown>;
const dataSourceUid = dsData.uid as string;
Expand All @@ -154,6 +175,7 @@ export function testAmpGrafana(ctx: GrafanaTestContext) {
ctx,
'POST',
'/api/ds/query',
authToken,
{
queries: [
{
Expand Down
Loading