opensource/grafana
1
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2025-09-11 22:54:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: add intrumentation for auth server grpc client (#110875)

Browse Source
This commit is contained in:
Mustafa Sencer Özcan
2025-09-10 17:33:21 +02:00
committed by GitHub
parent 338fc84479
commit b8b85fbf47
4 changed files with 26 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
apps/iam/go.mod
View File

@ -308,6 +308,7 @@ require (
github.com/openfga/api/proto v0.0.0-20250127102726-f9709139a369 // indirect
github.com/openfga/language/pkg/go v0.2.0-beta.2.0.20250220223040-ed0cfba54336 // indirect
github.com/openfga/openfga v1.8.13 // indirect
github.com/opentracing-contrib/go-grpc v0.1.1 // indirect
github.com/opentracing-contrib/go-stdlib v1.0.0 // indirect
github.com/opentracing/opentracing-go v1.2.0 // indirect
github.com/patrickmn/go-cache v2.1.0+incompatible // indirect

2
apps/iam/go.sum
View File

@ -1100,6 +1100,8 @@ github.com/openfga/language/pkg/go v0.2.0-beta.2.0.20250220223040-ed0cfba54336 h
github.com/openfga/language/pkg/go v0.2.0-beta.2.0.20250220223040-ed0cfba54336/go.mod h1:IWRgDIekw3UGSWINwmCALHpMmn6NEJzz6e7KZGm+xQ4=
github.com/openfga/openfga v1.8.13 h1:ROURkotKhbmtyBX3188+cNElN8AOZmTl0CMkxUqwawo=
github.com/openfga/openfga v1.8.13/go.mod h1:h1VGcVW81eY1YyDtFx5+gxxAIEhIiOGR9SRGgs/X/k8=
github.com/opentracing-contrib/go-grpc v0.1.1 h1:Ws7IN1zyiL1DFqKQPhRXuKe5pLYzMfdxnC1qtajE2PE=
github.com/opentracing-contrib/go-grpc v0.1.1/go.mod h1:Nu6sz+4zzgxXu8rvKfnwjBEmHsuhTigxRwV2RhELrS8=
github.com/opentracing-contrib/go-stdlib v1.0.0 h1:TBS7YuVotp8myLon4Pv7BtCBzOTo1DeZCld0Z63mW2w=
github.com/opentracing-contrib/go-stdlib v1.0.0/go.mod h1:qtI1ogk+2JhVPIXVc6q+NHziSmy2W5GbdQZFUHADCBU=
github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=

29
pkg/services/authz/rbac.go
View File

@ -10,6 +10,7 @@ import (
"github.com/fullstorydev/grpchan/inprocgrpc"
grpcAuth "github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/auth"
"github.com/prometheus/client_golang/prometheus"
"github.com/prometheus/client_golang/prometheus/promauto"
"go.opentelemetry.io/otel/trace"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials"
@ -21,6 +22,7 @@ import (
authzv1 "github.com/grafana/authlib/authz/proto/v1"
"github.com/grafana/authlib/cache"
authlib "github.com/grafana/authlib/types"
"github.com/grafana/dskit/grpcclient"
"github.com/grafana/grafana/pkg/infra/db"
"github.com/grafana/grafana/pkg/infra/log"
"github.com/grafana/grafana/pkg/infra/tracing"
@ -69,7 +71,7 @@ func ProvideAuthZClient(
switch authCfg.mode {
case clientModeCloud:
rbacClient, err := newRemoteRBACClient(authCfg, tracer)
rbacClient, err := newRemoteRBACClient(authCfg, tracer, reg)
if features.IsEnabledGlobally(featuremgmt.FlagZanzana) {
return zanzana.WithShadowClient(rbacClient, zanzanaClient, reg)
}
@ -128,7 +130,7 @@ func ProvideAuthZClient(
// ProvideStandaloneAuthZClient provides a standalone AuthZ client, without registering the AuthZ service.
// You need to provide a remote address in the configuration
func ProvideStandaloneAuthZClient(
cfg *setting.Cfg, features featuremgmt.FeatureToggles, tracer trace.Tracer,
cfg *setting.Cfg, features featuremgmt.FeatureToggles, tracer trace.Tracer, reg prometheus.Registerer,
) (authlib.AccessClient, error) {
if !features.IsEnabledGlobally(featuremgmt.FlagAuthZGRPCServer) {
return nil, nil
@ -139,10 +141,10 @@ func ProvideStandaloneAuthZClient(
return nil, err
}
return newRemoteRBACClient(authCfg, tracer)
return newRemoteRBACClient(authCfg, tracer, reg)
}
func newRemoteRBACClient(clientCfg *authzClientSettings, tracer trace.Tracer) (authlib.AccessClient, error) {
func newRemoteRBACClient(clientCfg *authzClientSettings, tracer trace.Tracer, reg prometheus.Registerer) (authlib.AccessClient, error) {
tokenClient, err := authnlib.NewTokenExchangeClient(authnlib.TokenExchangeConfig{
Token: clientCfg.token,
TokenExchangeURL: clientCfg.tokenExchangeURL,
@ -159,13 +161,26 @@ func newRemoteRBACClient(clientCfg *authzClientSettings, tracer trace.Tracer) (a
}
}
conn, err := grpc.NewClient(
clientCfg.remoteAddress,
authzRequestDuration := promauto.With(reg).NewHistogramVec(prometheus.HistogramOpts{
Name: "authz_server_client_request_duration_seconds",
Help: "Time spent executing requests to authz server.",
NativeHistogramBucketFactor: 1.1,
NativeHistogramMaxBucketNumber: 160,
NativeHistogramMinResetDuration: time.Hour,
}, []string{"operation", "status_code"})
unaryInterceptors, streamInterceptors := grpcclient.Instrument(authzRequestDuration)
opts := []grpc.DialOption{
grpc.WithTransportCredentials(transportCreds),
grpc.WithPerRPCCredentials(
NewGRPCTokenAuth(AuthzServiceAudience, clientCfg.tokenNamespace, tokenClient),
),
)
grpc.WithChainUnaryInterceptor(unaryInterceptors...),
grpc.WithChainStreamInterceptor(streamInterceptors...),
}
conn, err := grpc.NewClient(clientCfg.remoteAddress, opts...)
if err != nil {
return nil, fmt.Errorf("failed to create authz client to remote server: %w", err)
}

2
pkg/storage/unified/sql/service.go
View File

@ -201,7 +201,7 @@ func (s *service) starting(ctx context.Context) error {
}
}
authzClient, err := authz.ProvideStandaloneAuthZClient(s.cfg, s.features, s.tracing)
authzClient, err := authz.ProvideStandaloneAuthZClient(s.cfg, s.features, s.tracing, s.reg)
if err != nil {
return err
}