cephadm: Add ability to deploy grafana container

This patch adds initial support for deploying grafana. It uses a specific container image that has the grafana
plugins and ceph-dashboards pre-installed, and relies on
the caller passing appropriate SSL 'files' for the grafana
instance to run under https (example in the samples dir)

Signed-off-by: Paul Cuzner <pcuzner@redhat.com>

diff --git a/src/cephadm/cephadm b/src/cephadm/cephadm
index d699b7b0aba8df4ffcdbae372451fbfc47b786a4..1c2cdf98d07ceadbf74c3f8e2e114f644caaa000 100755 (executable)
--- a/src/cephadm/cephadm
+++ b/src/cephadm/cephadm
@@ -85,7 +85,8 @@ class Monitoring(object):
 
     port_map = {
         "prometheus": 9095,  # Avoid default 9090, due to conflict with cockpit UI
-        "node-exporter": 9100
+        "node-exporter": 9100,
+        "grafana": 3000,
     }
 
     components = {
@@ -97,12 +98,12 @@ class Monitoring(object):
                 "args": [
                     "--config.file=/etc/prometheus/prometheus.yml",
                     "--storage.tsdb.path=/prometheus",
-                    "--web.listen-address=:{}".format(port_map['prometheus'])
+                    "--web.listen-address=:{}".format(port_map['prometheus']),
                 ]
             },
             "config-json": [
-                "prometheus.yml"
-            ]
+                "prometheus.yml",
+            ],
         },
         "node-exporter": {
             "image": {
@@ -110,9 +111,23 @@ class Monitoring(object):
                 "cpus": "1",
                 "memory": "1GB",
                 "args": [
-                    "--no-collector.timex"
-                ]
+                    "--no-collector.timex",
+                ],
             }
+        },
+        "grafana": {
+            "image": {
+                "image": "pcuzner/ceph-grafana-el8:latest",
+                "cpus": "2",
+                "memory": "4GB",
+                "args": [],
+            },
+            "config-json": [
+                "grafana.ini",
+                "provisioning/datasources/ceph-dashboard.yml",
+                "certs/cert_file",
+                "certs/cert_key",
+            ],
         }
     }
 
@@ -780,6 +795,13 @@ def create_daemon_dirs(fsid, daemon_type, daemon_id, uid, gid,
             makedirs(os.path.join(data_dir_root, config_dir), uid, gid, 0o755)
             makedirs(os.path.join(data_dir_root, config_dir, 'alerting'), uid, gid, 0o755)
             makedirs(os.path.join(data_dir_root, 'data'), uid, gid, 0o755)
+        elif daemon_type == 'grafana':
+            data_dir_root = get_data_dir(fsid, daemon_type, daemon_id)
+            config_dir = 'etc/grafana'
+            makedirs(os.path.join(data_dir_root, config_dir), uid, gid, 0o755)
+            makedirs(os.path.join(data_dir_root, config_dir, 'certs'), uid, gid, 0o755)
+            makedirs(os.path.join(data_dir_root, config_dir, 'provisioning/datasources'), uid, gid, 0o755)
+            makedirs(os.path.join(data_dir_root, 'data'), uid, gid, 0o755)
 
         # populate the config directory for the component from the config-json
         for fname in required_config:
@@ -921,6 +943,10 @@ def get_container_mounts(fsid, daemon_type, daemon_id):
             mounts['/proc'] = '/host/proc:ro'
             mounts['/sys'] = '/host/sys:ro'
             mounts['/'] = '/rootfs:ro'
+        elif daemon_type == "grafana":
+            mounts[os.path.join(data_dir, 'etc/grafana/grafana.ini')] = '/etc/grafana/grafana.ini:Z'
+            mounts[os.path.join(data_dir, 'etc/grafana/provisioning/datasources')] = '/etc/grafana/provisioning/datasources:Z'
+            mounts[os.path.join(data_dir, 'etc/grafana/certs')] = '/etc/grafana/certs:Z'
 
     return mounts
 
@@ -1808,17 +1834,21 @@ def command_deploy():
         elif args.image == DEFAULT_IMAGE:
             raise Error("--image parameter must be supplied for {}".format(daemon_type))
 
-        if daemon_type == 'prometheus':
-            if not args.config_json:
-                raise Error("config-json parameter is needed when deploying prometheus service")
+        if daemon_type in ['prometheus', 'grafana'] and not args.config_json:
+                raise Error("config-json parameter is needed when deploying {} service".format(daemon_type))
 
+        if daemon_type == 'prometheus':
             uid, gid = extract_uid_gid(file_path='/etc/prometheus')
         elif daemon_type == 'node-exporter':
             uid, gid = 65534, 65534
-
+        elif daemon_type == 'grafana':
+            uid, gid = extract_uid_gid(file_path='/var/lib/grafana')
+        else:
+            raise Error("{} not implemented yet".format(daemon_type))
+        
         # Monitoring metadata is nested dicts, so asking mypy to ignore
-        p = Monitoring.components[daemon_type]  # type: ignore
-        metadata = p.get('image', dict())  # type: ignore
+        m = Monitoring.components[daemon_type]  # type: ignore
+        metadata = m.get('image', dict())  # type: ignore
         monitoring_args = [
             '--user',
             str(uid),
@@ -1828,7 +1858,6 @@ def command_deploy():
             metadata.get('memory', '4GB')  # type: ignore
         ]
 
-
         c = get_container(args.fsid, daemon_type, daemon_id, container_args=monitoring_args)
         deploy_daemon(args.fsid, daemon_type, daemon_id, c, uid, gid,
                       reconfig=args.reconfig)

diff --git a/src/cephadm/samples/grafana.json b/src/cephadm/samples/grafana.json
new file mode 100644 (file)
index 0000000..36f6e43
--- /dev/null
+++ b/src/cephadm/samples/grafana.json
@@ -0,0 +1,88 @@
+{
+    "grafana.ini": [
+            "[users]",
+            "  default_theme = light",
+            "[auth.anonymous]",
+            "  enabled = true",
+            "  org_name = 'Main Org.'",
+            "  org_role = 'Viewer'",
+            "[server]",
+            "  domain = 'bootstrap.storage.lab'",
+            "  protocol = https",
+            "  cert_file = /etc/grafana/certs/cert_file",
+            "  cert_key = /etc/grafana/certs/cert_key",
+            "  http_port = 3000",
+            "  http_addr = 10.90.90.150",
+            "[security]",
+            "  admin_user = admin",
+            "  admin_password = admin",
+            "  allow_embedding = true"
+    ],
+    "provisioning/datasources/ceph-dashboard.yml": [
+            "deleteDatasources:",
+            "  - name: 'Dashboard'",
+            "    orgId: 1",
+            " ",
+            "datasources:",
+            "  - name: 'Dashboard'",
+            "    type: 'prometheus'",
+            "    access: 'proxy'",
+            "    orgId: 1",
+            "    url: 'http://10.90.90.150:9095'",
+            "    basicAuth: false",
+            "    isDefault: true",
+            "    editable: false"
+    ],
+    "certs/cert_file": [
+        "-----BEGIN CERTIFICATE-----",
+        "MIIDLTCCAhWgAwIBAgIUEH0mq6u93LKsWlNXst5pxWcuqkQwDQYJKoZIhvcNAQEL",
+        "BQAwJjELMAkGA1UECgwCSVQxFzAVBgNVBAMMDmNlcGgtZGFzaGJvYXJkMB4XDTIw",
+        "MDEwNTIyNDYyMFoXDTMwMDEwMjIyNDYyMFowJjELMAkGA1UECgwCSVQxFzAVBgNV",
+        "BAMMDmNlcGgtZGFzaGJvYXJkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC",
+        "AQEAqxh6eO0NTZJe+DoKZG/kozJCf+83eB3gWzwXoNinRmV/49f5WPR20DIxAe0R",
+        "saO6XynJXTrhvXT1bsARUq+LSmjWNFoYXopFuOJhGdWn4dmpuHwtpcFv2kjzNOKj",
+        "U2EG8j6bsRp1jFAzn7kdbSWT0UHySRXp9DPAjDiF3LjykMXiJMReccFXrB1pRi93",
+        "nJxED8d6oT5GazGB44svb+Zi6ABamZu5SDJC1Fr/O5rWFNQkH4hQEqDPj1817H9O",
+        "sm0mZiNy77ZQuAzOgZN153L3QOsyJismwNHfAMGMH9mzPKOjyhc13VlZyeEzml8p",
+        "ZpWQ2gi8P2r/FAr8bFL3MFnHKwIDAQABo1MwUTAdBgNVHQ4EFgQUZg3v7MX4J+hx",
+        "w3HENCrUkMK8tbwwHwYDVR0jBBgwFoAUZg3v7MX4J+hxw3HENCrUkMK8tbwwDwYD",
+        "VR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAaR/XPGKwUgVwH3KXAb6+",
+        "s9NTAt6lCmFdQz1ngoqFSizW7KGSXnOgd6xTiUCR0Tjjo2zKCwhIINaI6mwqMbrg",
+        "BOjb7diaqwFaitRs27AtdmaqMGndUqEBUn/k64Ld3VPGL4p0W2W+tXsyzZg1qQIn",
+        "JXb7c4+oWzXny7gHFheYQTwnHzDcNOf9vJiMGyYYvU1xTOGucu6dwtOVDDe1Z4Nq",
+        "AyIYWDScRr2FeAOXyx4aW2v5bjpTxvP+79/OOBbQ+p4y5F4PDrPeOSweGoo6huTR",
+        "+T+YI9Jfw2XCgV7NHWhfdt3fHHwUQzO6WszWU557pmCODLvXWsQ8P+GRiG7Nywm3",
+        "uA==",
+        "-----END CERTIFICATE-----"
+    ],
+    "certs/cert_key": [
+        "-----BEGIN PRIVATE KEY-----",
+        "MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCrGHp47Q1Nkl74",
+        "Ogpkb+SjMkJ/7zd4HeBbPBeg2KdGZX/j1/lY9HbQMjEB7RGxo7pfKcldOuG9dPVu",
+        "wBFSr4tKaNY0WhheikW44mEZ1afh2am4fC2lwW/aSPM04qNTYQbyPpuxGnWMUDOf",
+        "uR1tJZPRQfJJFen0M8CMOIXcuPKQxeIkxF5xwVesHWlGL3ecnEQPx3qhPkZrMYHj",
+        "iy9v5mLoAFqZm7lIMkLUWv87mtYU1CQfiFASoM+PXzXsf06ybSZmI3LvtlC4DM6B",
+        "k3XncvdA6zImKybA0d8AwYwf2bM8o6PKFzXdWVnJ4TOaXylmlZDaCLw/av8UCvxs",
+        "UvcwWccrAgMBAAECggEAeBv0BiYrm5QwdUORfhaKxAIJavRM1Vbr5EBYOgM90o54",
+        "bEN2ePsM2XUSsE5ziGfu8tVL1dX7GNwdW8UbpBc1ymO0VAYXa27YKUVKcy9o7oS1",
+        "v5v1E5Kq6esiSLL9gw/vJ2nKNFblxD2dL/hs7u1dSp5n7uSiW1tlRUp8toljRzts",
+        "1Cenp0J/a82HwWDE8j/H9NvitTOZ2cdwJ76V8GkBynlvr2ARjRfZGx0WXEJmoZYD",
+        "YUQVU303DB6Q2tkFco4LbPofkuhhMPhXsz3fZ/blHj/c78tqP9L5sQ29oqoPE1pS",
+        "DBOwKC/eoi5FY34RdLNL0dKq9MzbuYqEcCfZOJgxoQKBgQDf+5XF+aXQz2OmSaj6",
+        "1Yr+3KAKdfX/AYp22X1Wy4zWcZlgujgwQ1FG0zay8HVBM0/xn4UgOtcKCoXibePh",
+        "ag1t8aZINdRE1JcMzKmZoSvU9Xk30CNvygizuJVEKsJFPDbPzCpauDSplzcQb4pZ",
+        "wepucPuowkPMBx0iU3x0qSThWwKBgQDDjYs7d30xxSqWWXyCOZshy7UtHMNfqP15",
+        "kDfTXIZzuHvDf6ZNci10VY1eDZbpZfHgc6x1ElbKv2H4dYsgkENJZUi1YQDpVPKq",
+        "4N5teNykgAuagiR7dRFltSju3S7hIE6HInTv3hShaFPymlEE7zuBMuEUcuvYz5YN",
+        "RjxsvypKcQKBgCuuV+Y1KqZPW8K5SNAqRyIvCrMfkCr8NPG6tpvvtHa5zsyzZHPd",
+        "HQOv+1HoXSWrCSM5FfBUKU3XAYdIIRH76cSQRPp+LPiDcTXY0Baa/P5aJRrCZ7bM",
+        "cugBznJt2FdCR/o8eeIZXIPabq2w4w1gKQUC2cFuqWQn2wGvwGzL89pTAoGAAfpx",
+        "mSVpT9KVzrWTC+I3To04BP/QfixAfDVYSzwZZBxOrDijXw8zpISlDHmIuE2+t62T",
+        "5g9Mb3qmLBRMVwT+mUR8CtGzZ6jjV5U0yti5KrTc6TA93D3f8i51/oygR8jC4p0X",
+        "n8GYZdWfW8nx3eHpsTHpkwJinmvjMbkvLU51yBECgYAnUAMyhNOWjbYS5QWd8i1W",
+        "SFQansVDeeT98RebrzmGwlgrCImHItJz0Tz8gkNB3+S2B2balqT0WHaDxQ8vCtwX",
+        "xB4wd+gMomgdYtHGRnRwj1UyRXDk0c1TgGdRjOn3URaezBMibHTQSbFgPciJgAuU",
+        "mEl75h1ToBX9yvnH39o50g==",
+        "-----END PRIVATE KEY-----"
+    ]
+}
\ No newline at end of file