Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(grafana): create access for dialogporten devs #1205

Merged
merged 1 commit into from
Jan 7, 2025
Merged

Conversation

sduranc
Copy link
Collaborator

@sduranc sduranc commented Jan 7, 2025

Description

Related Issue(s)

  • #{issue number}

Verification

  • Your code builds clean without any errors or warnings
  • Manual testing done (required)
  • Relevant automated test added (if you find this hard, leave it and we'll help out)
  • All tests run green

Documentation

  • User documentation is updated with a separate linked PR in altinn-studio-docs. (if applicable)

Summary by CodeRabbit

  • New Features
    • Added new developer identifiers for Dialogporten to Grafana editor roles
    • Expanded access for Dialogporten developers in the test and production environments

@sduranc sduranc requested a review from a team as a code owner January 7, 2025 13:15
Copy link

coderabbitai bot commented Jan 7, 2025

📝 Walkthrough

Walkthrough

The changes involve updating the Grafana configuration in the Terraform file for the Altinn Monitor Test Resource Group. Two new local variables representing Dialogporten developer groups are introduced, with specific GUID values. These variables are then added to the existing grafana_editor local variable list, effectively expanding the set of users or groups with editor access to the Grafana instance.

Changes

File Change Summary
infrastructure/adminservices-test/altinn-monitor-test-rg/grafana.tf - Added dialogporten_developers local variable with GUID 857b3aa1-bde3-469c-a052-a24c81503646
- Added dialogporten_developers_prod local variable with GUID 415cfc7b-40f6-4540-9aef-cb9c9050aada
- Updated grafana_editor to include the new Dialogporten developer group GUIDs

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR. (Beta)
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

🧹 Nitpick comments (1)
infrastructure/adminservices-test/altinn-monitor-test-rg/grafana.tf (1)

77-79: LGTM! Consider documenting access permissions.

The addition of Dialogporten developer groups to the Grafana editors list is appropriate and follows existing patterns. Since this introduces new access permissions, consider:

  1. Documenting these permissions in the relevant documentation
  2. Adding a description of the access level granted to Dialogporten developers

Would you like me to help create a documentation PR in the altinn-studio-docs repository as mentioned in the PR checklist?

📜 Review details

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c5b9741 and f8a479c.

📒 Files selected for processing (1)
  • infrastructure/adminservices-test/altinn-monitor-test-rg/grafana.tf (1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
  • GitHub Check: Analyze (go)
🔇 Additional comments (1)
infrastructure/adminservices-test/altinn-monitor-test-rg/grafana.tf (1)

68-69: Verify Azure AD group IDs for Dialogporten developers

The GUIDs appear to be Azure AD group IDs. Let's verify they correspond to the correct Dialogporten developer groups.

✅ Verification successful

Implementation of Dialogporten developer groups follows established patterns

The new Dialogporten developer groups are correctly integrated into the Grafana configuration:

  • Follow consistent naming convention with other developer groups
  • Properly assigned Grafana Editor permissions
  • Part of a complete Dialogporten integration setup
🏁 Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify Azure AD group IDs exist and match the expected groups
# Note: This requires Azure CLI authentication

# Check dialogporten_developers group
echo "Checking dialogporten_developers group (857b3aa1-bde3-469c-a052-a24c81503646):"
az ad group show --group 857b3aa1-bde3-469c-a052-a24c81503646 --query "displayName" 2>/dev/null

# Check dialogporten_developers_prod group
echo "Checking dialogporten_developers_prod group (415cfc7b-40f6-4540-9aef-cb9c9050aada):"
az ad group show --group 415cfc7b-40f6-4540-9aef-cb9c9050aada --query "displayName" 2>/dev/null

Length of output: 511


Script:

#!/bin/bash
# Search for the Dialogporten developer group IDs across the codebase
echo "Searching for dialogporten_developers group ID:"
rg -l "857b3aa1-bde3-469c-a052-a24c81503646"

echo -e "\nSearching for dialogporten_developers_prod group ID:"
rg -l "415cfc7b-40f6-4540-9aef-cb9c9050aada"

echo -e "\nChecking for similar Grafana configuration patterns:"
fd "grafana.tf" --type f

Length of output: 665


Script:

#!/bin/bash
# Examine the complete grafana.tf file to understand the context
echo "Checking complete grafana.tf content:"
cat infrastructure/adminservices-test/altinn-monitor-test-rg/grafana.tf

echo -e "\nChecking for similar group ID patterns:"
rg -A 1 -B 1 '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' infrastructure/adminservices-test/altinn-monitor-test-rg/grafana.tf

Length of output: 7766

Copy link

github-actions bot commented Jan 7, 2025

Terraform environment test

Format and Style 🖌success

Initialization ⚙️success

Validation 🤖success

Validation Output

Success! The configuration is valid.


Plan 📖success

Show Plan

[Lines containing Refreshing state removed]
[Maybe further truncated see logs for complete plan output]
Acquiring state lock. This may take a few moments...
data.azurerm_monitor_data_collection_rule.prometheus: Reading...
data.azurerm_client_config.current: Reading...
data.azurerm_client_config.current: Read complete after 0s [id=Y2xpZW50Q29uZmlncy9jbGllbnRJZD1mMDNmNzU3OS01ZjM5LTRkN2YtYmNlYS04ZTVjYjZkN2FjYTQ7b2JqZWN0SWQ9MDJiMTdkMjgtN2VjOC00MDg0LTkyY2UtZDI2MDUxZmE0OTk4O3N1YnNjcmlwdGlvbklkPTFjZThlOWFmLWMyZDYtNDRlNy05YzVlLTA5OWEzMDgwNTZmZTt0ZW5hbnRJZD1jZDAwMjZkOC0yODNiLTRhNTUtOWJmYS1kMGVmNGE4YmEyMWM=]
data.azurerm_monitor_data_collection_rule.prometheus: Read complete after 1s [id=/subscriptions/1ce8e9af-c2d6-44e7-9c5e-099a308056fe/resourceGroups/MA_k6tests-amw_norwayeast_managed/providers/Microsoft.Insights/dataCollectionRules/k6tests-amw]
data.azurerm_resource_group.rg_dp_test: Reading...
data.azurerm_resource_group.rg_dp_test: Read complete after 1s [id=/subscriptions/8a353de8-d81d-468d-a40d-f3574b6bb3f4/resourceGroups/dp-be-test-rg]
data.azurerm_log_analytics_workspace.dp_law_test: Reading...
data.azurerm_log_analytics_workspace.dp_law_test: Read complete after 1s [id=/subscriptions/8a353de8-d81d-468d-a40d-f3574b6bb3f4/resourceGroups/dp-be-test-rg/providers/Microsoft.OperationalInsights/workspaces/dp-be-test-insightsWorkspace]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # azurerm_role_assignment.grafana_editors["415cfc7b-40f6-4540-9aef-cb9c9050aada"] will be created
  + resource "azurerm_role_assignment" "grafana_editors" {
      + condition_version                = (known after apply)
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "415cfc7b-40f6-4540-9aef-cb9c9050aada"
      + principal_type                   = "Group"
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Grafana Editor"
      + scope                            = "/subscriptions/1ce8e9af-c2d6-44e7-9c5e-099a308056fe/resourceGroups/altinn-monitor-test-rg/providers/Microsoft.Dashboard/grafana/altinn-grafana-test"
      + skip_service_principal_aad_check = true
    }

  # azurerm_role_assignment.grafana_editors["857b3aa1-bde3-469c-a052-a24c81503646"] will be created
  + resource "azurerm_role_assignment" "grafana_editors" {
      + condition_version                = (known after apply)
      + id                               = (known after apply)
      + name                             = (known after apply)
      + principal_id                     = "857b3aa1-bde3-469c-a052-a24c81503646"
      + principal_type                   = "Group"
      + role_definition_id               = (known after apply)
      + role_definition_name             = "Grafana Editor"
      + scope                            = "/subscriptions/1ce8e9af-c2d6-44e7-9c5e-099a308056fe/resourceGroups/altinn-monitor-test-rg/providers/Microsoft.Dashboard/grafana/altinn-grafana-test"
      + skip_service_principal_aad_check = true
    }

  # azurerm_role_assignment.monitoring_reader_rg_dp_test must be replaced
-/+ resource "azurerm_role_assignment" "monitoring_reader_rg_dp_test" {
      + condition_version                      = (known after apply)
      ~ id                                     = "/subscriptions/8a353de8-d81d-468d-a40d-f3574b6bb3f4/resourceGroups/dp-be-test-rg/providers/Microsoft.Authorization/roleAssignments/abc96681-04b2-fa88-e7d5-6242ca46f84c" -> (known after apply)
      ~ name                                   = "abc96681-04b2-fa88-e7d5-6242ca46f84c" -> (known after apply)
      ~ principal_type                         = "ServicePrincipal" -> (known after apply)
      ~ role_definition_id                     = "/subscriptions/8a353de8-d81d-468d-a40d-f3574b6bb3f4/providers/Microsoft.Authorization/roleDefinitions/43d0d8ad-25c7-4714-9337-8ba259a9fe05" -> "/subscriptions/1ce8e9af-c2d6-44e7-9c5e-099a308056fe/providers/Microsoft.Authorization/roleDefinitions/43d0d8ad-25c7-4714-9337-8ba259a9fe05" # forces replacement
      ~ role_definition_name                   = "Monitoring Reader" -> (known after apply)
        # (6 unchanged attributes hidden)
    }

  # helm_release.kube_prometheus_stack will be updated in-place
  ~ resource "helm_release" "kube_prometheus_stack" {
        id                         = "kube-prometheus-stack"
        name                       = "kube-prometheus-stack"
      ~ version                    = "67.0.0" -> "67.7.0"
        # (27 unchanged attributes hidden)
    }

  # helm_release.prometheus_operator_crds will be updated in-place
  ~ resource "helm_release" "prometheus_operator_crds" {
        id                         = "prometheus-operator-crds"
        name                       = "prometheus-operator-crds"
      ~ version                    = "17.0.0" -> "17.0.2"
        # (26 unchanged attributes hidden)
    }

Plan: 3 to add, 2 to change, 1 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan.out

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan.out"
Releasing state lock. This may take a few moments...

Context Values
Pusher @sduranc
Action push
Working Directory ./infrastructure/adminservices-test/altinn-monitor-test-rg
State File github.com/altinn/altinn-platform/environments/test/altinn-monitor-test-rg.tfstate
Plan File github.com_altinn_altinn-platform_environments_test_altinn-monitor-test-rg.tfstate.tfplan

@sduranc sduranc merged commit 375303a into main Jan 7, 2025
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants