UNCLASSIFIED - NO CUI

Skip to content

Kiali grafana password handling

Micah Nagel requested to merge kiali-grafana-password into master

Summary

Adds helm templating to pull the grafana password into Kiali when it's non-default. Supports both ways of passing in login info (via helm values directly or via helm values that point to a secret).

Moves grafana password info into a secret to hide the details from Kiali and configmap viewing.

Note: This does NOT handle the case where a user changes the password via the Grafana UI. After some investigation it looks like there isn't a clean way to do that since Grafana does not update the secret it uses for the Grafana password when its changed. I will make a note of this in the architecture doc for Kiali. Kiali offers us the ability to use token auth which may be something to evaluate in the future (if there's a pre-existing token we can use or have the chart create one on install) or perhaps we can investigate creation of a read-only account for kiali on startup.

Closes https://repo1.dso.mil/platform-one/big-bang/bigbang/-/issues/674

Edited by Micah Nagel

Merge request reports