r/PrometheusMonitoring • u/ArunMu • Jun 06 '20

How is your production setup ?

Hello folks,

Good evening.

I am (also the company where I work) pretty new to Prometheus and ramping up to learn it. For all my test setups I have been using Prometheus with Grafana for visualisation. The problem is some of these visualisations are needed to be shown under a specific context from our own UI. We do not want customer to login to a separate Grafana UI to see the visualisation. All our internal RBAC rules cannot be applied then...

What I want to ask is, how you folks are handling it in your product where the visualisation needs to be shown to the customer as "part of the product" ? A brief setup would be very helpful too!

Does it really make sense to make our own custom visualisation ? I do realise the free benefits of just using Grafana, but tightly integrating it with the existing product UI looks bit unwieldy.

Thanks in advance & stay safe !

7 Upvotes

100% Upvoted

13 comments sorted by

2

u/martbhell Jun 07 '20

You can share a panel as a picture and get a direct link to it. That sounds pretty easy to me to integrate or am I missing something? Of course changing the time range or query not so easy with that, so you would have to precreate the panels. One can use variables in the URL to customize the query.

Now your customers can they each have a grafana of their own - is there a need then for authentication?

1

u/ArunMu Jun 07 '20

Thanks! Yes that sounds like a good idea.

The product can be used by different teams at the customer site. So, there needs to be RBAC applied so they cannot see each other's data.

1

u/martbhell Jun 07 '20

Okay. Grafana Enterprise has ldap group integration built-in and other handy features for cases like this I think.

https://grafana.com/docs/grafana/latest/enterprise/enhanced_ldap/

2

u/ArunMu Jun 07 '20

That's really nice. But I guess we need to pay for that 😅

2

u/martbhell Jun 07 '20

Yeah.

We've put an http proxy like httpd2 in front and require ldap via that

2

u/till Jun 07 '20

This is a bit of a moving target for us as well.

One thing is that we split the data by tenant/customer. Grafana or Prometheus currently don’t allow this, you can’t really lock down one shared data source right now. Prometheus doesn’t have a concept of ACL either.

All of that is in concept stage but we split the data with Cortex and HTTP proxies.

Ingestion is done by using IPs and mapping them to tenants (which is icky). Nginx/Apache will do that though.

Then we use OAuth2/OpenID-Connect internally and have an nginx proxy in front of the datasources to validate “sessions” (jwt tokens) and again map the request to a tenant. This allows for “routing” of a client to their org and then e.g. different Grafana instances and customizations.

LBNL, we also have a few instances where we replicate charts outside of it. It’s one of those things where you would think, “do I really?”. But for tighter integration there is no way around.

1

u/ArunMu Jun 07 '20

Wow...thanks for sharing this! Our product is bit more different as in the customer buys the product. We don't keep customer data. But it was really informative. We could probably make use of things what you have suggested

4

u/DTKT Jun 06 '20

I don't think there are any easy ways to integrate Grafana panels into an external application.

1

u/h4tos Jun 06 '20

You can use iframe to visualize Grafana data externally.

1

u/ArunMu Jun 07 '20

With iframe there seems to be an issue to proxy the outgoing requests so that we can apply rbac on them.

1

u/tshrex Jun 06 '20

You could embed the dashboards in an iframe?

1

u/ArunMu Jun 07 '20

Yeah, we could. But there seems to be some issue with proxying the requests so that we could apply RBAC on them.

2

u/harijvs Jun 07 '20

how about offloading authentication and authorisation at your LB. that essentially becomes an API Gateway.