Skip to content

Commit

Permalink
Add markdown linter (grafana#527)
Browse files Browse the repository at this point in the history
* General linter from github

* Follow the docs

* Fix CI image

* comment out yaml githubactions

* Add api.md to markdown ignore

* Test again

* Update markdown ignore again

* Fix markdown lint (grafana#5)

* Fix markdown lint

* fix lint github action

* don't think i need it

* and i did ^ ^

* file with error in it

* Fix dashboards

* trigger api.md bad file

* linting markdown deploy examples

* Fix row and remove changes to api.md

* remove more api-md

* put super-lint in the big file

* enable github action lint check

* Disable Github actions lint

* Update ./README.md and ignore rules

* Fix some long rows in md

* does the ignore work?

* yes it does

* Update SECURITY.MD

* extra space in env_vars.md
  • Loading branch information
Edvin N authored Sep 7, 2021
1 parent d1264d9 commit 9bd3f95
Show file tree
Hide file tree
Showing 18 changed files with 145 additions and 92 deletions.
22 changes: 21 additions & 1 deletion .github/workflows/pr-validation.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ env:
NAME: "grafana-operator"

jobs:
lint:
go-lint:
runs-on: ubuntu-latest
env:
GO111MODULE: on
Expand Down Expand Up @@ -96,6 +96,26 @@ jobs:
run: |
make test
build:
name: github super-linter
runs-on: ubuntu-latest

steps:
- name: Checkout Code
uses: actions/checkout@v2
with:
fetch-depth: 0

- name: super-linter
uses: docker://ghcr.io/github/super-linter:slim-v4
env:
VALIDATE_ALL_CODEBASE: false
DEFAULT_BRANCH: master
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# VALIDATE_GITHUB_ACTIONS: true
VALIDATE_MARKDOWN: true
# VALIDATE_YAML: false

build-container:
runs-on: ubuntu-latest
env:
Expand Down
17 changes: 17 additions & 0 deletions .markdown-lint.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
MD013:
# Number of characters
line_length: 250

# MD033/no-inline-html - Inline HTML
# This is for ./README.md
MD033:
allowed_elements:
- table
- tbody
- tr
- td
- div
- h4
- p
- a
- b
2 changes: 2 additions & 0 deletions .markdownlintignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
PULL_REQUEST_TEMPLATE.md
documentation/api.md
50 changes: 24 additions & 26 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,7 @@

A Kubernetes Operator based on the Operator SDK for creating and managing Grafana instances.

## Companies and teams that trust and use the Grafana operator:

## Companies and teams that trust and use the Grafana operator

<table class="tg">
<tbody>
Expand Down Expand Up @@ -77,9 +76,8 @@ A Kubernetes Operator based on the Operator SDK for creating and managing Grafan
</div>
</td> -->



## Grafana Operator on the Kubernetes community Slack

We have set up a channel dedicated to this operator on the Kubernetes community Slack, this is an easier way to address
more immediate issues and facilitate discussion around development/bugs etc. as well as providing support for questions
about the operator.
Expand All @@ -91,13 +89,12 @@ about the operator.
3: Once registered and able to see the Kubernetes community Slack workspace and channels follow this link to the [grafana-operator channel](https://kubernetes.slack.com/messages/grafana-operator/ ).

Alternatively:
If you're already a member of that workspace then just follow this link to the [grafana-operator channel](https://kubernetes.slack.com/messages/grafana-operator/ ) or search for "grafana-operator" in the browse channels option .
If you're already a member of that workspace then just follow this link to the [grafana-operator channel](https://kubernetes.slack.com/messages/grafana-operator/)
or search for "grafana-operator" in the browse channels option.

![image](https://user-images.githubusercontent.com/35736504/90978105-0b195300-e543-11ea-86ee-1825da0e3b75.png)



# Current status
## Current status

The Operator is available on [Operator Hub](https://operatorhub.io/operator/grafana-operator).

Expand All @@ -109,7 +106,8 @@ It can deploy and manage a Grafana instance on Kubernetes and OpenShift. The fol
* Import Grafana datasources from the same namespace
* Install Plugins (panels) defined as dependencies of dashboards

# Summary of benefits
## Summary of benefits

A list of benefits of using the operator over a single grafana deployment.

[The benefits of using an operator over standalone products as outlined by the people that created them](https://operatorframework.io/)
Expand All @@ -119,23 +117,20 @@ Grafana-operator specific benefits over standalone Grafana:
* The ability to configure and manage grafana deployments using kubernetes resources such as CRDs,configMaps etc
* Incoming changes to allow for multi-namespace support for the operator, meaning that just one instance of the operator can manage every instance of grafana on the cluster!
* Reducing the need for manual steps, allowing for quicker setups for things such as (and not limited to):
* Ingresses
* Grafana product versions
* Grafana dashboard plugins
* many others!
* Ingresses
* Grafana product versions
* Grafana dashboard plugins
* many others!
* Manage dashboards more efficiently through jsonnet, plugins and folder assignment, which can all be done through .yamls!
* Periodical reconciliation of resources, ensuring that the desired state is maintained, so nothing will be broken for too long




# Operator flags
## Operator flags

The operator supports the following flags on startup.
See [the documentation](./documentation/deploy_grafana.md) for a full list.
Flags can be passed as `args` to the container.

# Supported Custom Resources
## Supported Custom Resources

The following Grafana resources are supported:

Expand All @@ -157,21 +152,21 @@ Represents a Grafana dashboard and allows specifying required plugins. See [the

Represents a Grafana datasource. See [the documentation](./documentation/datasources.md) for a description of properties supported in the spec.

# Building the operator image
## Building the operator image

Init the submodules first to obtain grafonnet:

```sh
$ git submodule update --init
git submodule update --init
```

Then build the image using the operator-sdk:

```sh
$ operator-sdk build <registry>/<user>/grafana-operator:<tag>
operator-sdk build <registry>/<user>/grafana-operator:<tag>
```

# Running locally
## Running locally

You can run the Operator locally against a remote namespace using the operator-sdk:

Expand All @@ -182,11 +177,14 @@ Prerequisites:
* make sure to deploy the custom resource definition using the command ```kubectl create -f deploy/crds```

```sh
$ operator-sdk run local --namespace=<namespace> --operator-flags="<flags to pass>"
operator-sdk run local --namespace=<namespace> --operator-flags="<flags to pass>"
```

# Grafana features not yet supported in the operator
## Grafana features not yet supported in the operator

## Notifier provisioning
### Notifier provisioning

Grafana has provisioning support for multiple channels (notifiers) of alerts. The operator does currently not support this type of provisioning. An empty directory is mounted at the expected location to prevent a warning in the grafana log. This feature might be supported in the future.
Grafana has provisioning support for multiple channels (notifiers) of alerts.
The operator does currently not support this type of provisioning.
An empty directory is mounted at the expected location to prevent a warning in the grafana log.
This feature might be supported in the future.
19 changes: 9 additions & 10 deletions SECURITY.MD
Original file line number Diff line number Diff line change
Expand Up @@ -5,43 +5,42 @@ to address issues ASAP.

## Supported Versions

The use of 2.x.x is strongly discouraged, it is not supported or updated, versions prior to 3.x.x have no clear upgrade
The use of 2.x.x is strongly discouraged, it is not supported or updated, versions prior to 3.x.x have no clear upgrade
path to the current release, any security vulnerabilities in 2.x.x releases won't be addressed, unless done so by a
member of the community who uses that specific version,
please use the latest release of this operator to ensure most up-to-date code, this also means that we can address and
please use the latest release of this operator to ensure most up-to-date code, this also means that we can address and
find vulnerabilities quicker.

| Version | Supported |
| ------- | ------------------ |
| 2.x.x | :x: |
| 3.x.x | :white_check_mark: |


## Dealing with and reporting a Vulnerability

Ideally we want to resolve vulnerability issues as soon as possible, to help us with this please consider doing the
Ideally we want to resolve vulnerability issues as soon as possible, to help us with this please consider doing the
following:

If a vulnerability has been found, please investigate further so that you can provide as much context as possible when
If a vulnerability has been found, please investigate further so that you can provide as much context as possible when
reporting, specifying affected components/libraries/versions etc. this will help a great deal in resolution.

During your investigation if you happen upon a fix, please create a pull request with the proposed solution to that
vulnerability, detail the problem, your findings and the solution provided. By doing this, we can address the issue
sooner, having only to review and verify that the solution works as opposed to having to investigate this separately and
sooner, having only to review and verify that the solution works as opposed to having to investigate this separately and
take more time to reach a solution.

If there is no clear fix that was found during your investigation then please notify the repository admin(s) with the
findings of your investigation directly, ideally by email, we want to avoid making security vulnerabilities public
findings of your investigation directly, ideally by email, we want to avoid making security vulnerabilities public
before we can solve them, preventing bad actors from exploiting users of this operator.

If the security vulnerability exists in Grafana itself then please bring that up with the upstream
Grafana repository adhering to their doc [here](https://github.com/grafana/grafana/blob/master/SECURITY.md) and notify
the admin(s) of this operator to update when a patch has been released with the specific vulnerability fix.


## Contact

Please contact the following people with information regarding found vulnerabilities:

@pb82 - pbraun@redhat.com

@david-martin - davmarti@redhat.com
@david-martin - davmarti@redhat.com
13 changes: 9 additions & 4 deletions deploy/cluster_roles/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,20 @@

## Grant Grafana instance RBAC to GrafanaDashboard definitions in other projects/namespaces

By default a Grafana instance deployed by the Grafana Operator will only read GrafanaDashboard custom resources from the namespace/project that the Grafana instance is deployed in. If specifing the `--scan-all` or `--namespaces` flags or if your using `dashboardNamespaceSelector`, then the ServiceAccount that Grafana is running as needs view access to the GrafanaDashboard resources in other namespaces. To grant those permissions the following ClusterRole and ClusterRoleBinding need to be deployed.
By default a Grafana instance deployed by the Grafana Operator will only read GrafanaDashboard custom resources from the namespace/project that the Grafana instance is deployed in.
If specifing the `--scan-all` or `--namespaces` flags or if your using `dashboardNamespaceSelector`,
then the ServiceAccount that Grafana is running as needs view access to the GrafanaDashboard resources in other namespaces.
To grant those permissions the following ClusterRole and ClusterRoleBinding need to be deployed.

Create the `ClusterRole`
```

```shell
kubectl create -f cluster_role_grafana_operator.yaml
```

Create the `ClusterRoleBinding` for the `ServiceAccount/grafana-operator` in the given namespace
```

```shell
GRAFANA_NAMESPACE=grafana
sed "s/namespace: grafana/namespace: ${GRAFANA_NAMESPACE}/g" cluster_role_binding_grafana_operator.yaml
```
Expand All @@ -19,7 +24,7 @@ sed "s/namespace: grafana/namespace: ${GRAFANA_NAMESPACE}/g" cluster_role_bindin

For a cluster administrator to allow other users to be able to deploy Grafana operators and the associated Custom Resources namespace/project admins/editors need edit access to the Grafana Custom Resources.

```
```shell
kubectl create -f cluster_role_aggregate_grafana_admin_edit.yaml
kubectl create -f cluster_role_aggregate_grafana_view.yaml
```
8 changes: 4 additions & 4 deletions deploy/examples/ha/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,14 @@

This example demonstrates how to deploy Grafana in high availability mode running multiple replicas and using Postgres as a database.

Grafana will by default also use the database for session storage. To keep user sessions separate, the `remote_cache` configuration can be used.
Grafana will by default also use the database for session storage. To keep user sessions separate, the `remote_cache` configuration can be used.

## Installation

1. Make sure the operator is running, then create the templates in this directory:

```shell script
$ kubectl apply -f deploy/examples/ha
```shell
kubectl apply -f deploy/examples/ha
```

*NOTE:* This examples uses an `emptyDir` storage for Postgres and is only meant for demo purposes.
*NOTE:* This examples uses an `emptyDir` storage for Postgres and is only meant for demo purposes.
4 changes: 2 additions & 2 deletions deploy/examples/persistentvolume/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,6 @@ Grafana uses sqlite database to store user data by default, we can use `Persiste

1. Make sure the operator is running, then create the Grafana:

```shell script
$ kubectl apply -f deploy/examples/persistentvolume
```shell
kubectl apply -f deploy/examples/persistentvolume
```
2 changes: 1 addition & 1 deletion documentation/README.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
## Grafana Operator Documentation
# Grafana Operator Documentation

* [Installing Grafana](./deploy_grafana.md)
* [Dashboards](./dashboards.md)
Expand Down
4 changes: 2 additions & 2 deletions documentation/dashboards.md
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ The following properties are accepted in the `spec`:
* *jsonnet*: Jsonnet source. The [Grafonnet](https://grafana.github.io/grafonnet-lib/) library is made available
automatically and can be imported.
* *url*: Url address to download a json or jsonnet string with the dashboard contents.
* ***Warning***: If both url and json are specified then the json field will be updated with fetched. <br>
*The dashboard fetch priority by parameter is: url > configmap > json > jsonnet.*
* ***Warning***: If both url and json are specified then the json field will be updated with fetched.
* *The dashboard fetch priority by parameter is: url > configmap > json > jsonnet.*
* *plugins*: A list of plugins required by the dashboard. They will be installed by the operator if not already present.
* *datasources*: A list of datasources to be used as inputs. See [datasource inputs](#datasource-inputs).
* *configMapRef*: Import dashboards from config maps. See [config map references](#config-map-references).
Expand Down
6 changes: 3 additions & 3 deletions documentation/env_vars.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,13 +23,13 @@ Typically, this feature is used to provide the credentials for the Grafana admin
needs to be assured:

1. Admin credentials must be provided via the `GF_SECURITY_ADMIN_USER` and `GF_SECURITY_ADMIN_PASSWORD` environment
variables.
variables.
2. Set `skipCreateAdminAccount` to `true` to prevent the operator from creating an admin secret.

*NOTE*: The operator still requires an admin account to interact with Grafana. It will try to obtain the credentials
from the provided secrets or config maps.

# Using environment variables in data sources
## Using environment variables in data sources

Sometimes (e.g. when providing credentials) it is desirable to reference environment variables in the data source
configuration. This is possible using the following syntax:
Expand All @@ -48,4 +48,4 @@ spec:
```

here the value of `basicAuthPassword` is retrieved from the environment variable `$BASIC_AUTH_PASSWORD`. This assumes
that environment variables have been declared using `envFrom` as described above.
that environment variables have been declared using `envFrom` as described above.
8 changes: 5 additions & 3 deletions documentation/extra_files.md
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,10 @@ spec:
...
```

When mounting Secrets or ConfigMaps in Kubernetes, the keys become the file names and the values the contents of the file. For every config map specified in this way the Grafana operator will create a volume with the name `configmap-<name>` (the prefix will be `secret-` for Secrets) and add it to the Grafana deployment.
It will also create a volume mount with the same name and add it to all containers in the deployment. This includes the Grafana container and all extra containers specified via the `spec.containers` property. Config maps are mounted inside the containers under `/etc/grafana-configmaps/<configmap name>/`, secrets under `/etc/grafana-secrets/<secret name>/`.
When mounting Secrets or ConfigMaps in Kubernetes, the keys become the file names and the values the contents of the file.
For every config map specified in this way the Grafana operator will create a volume with the name `configmap-<name>` (the prefix will be `secret-` for Secrets) and add it to the Grafana deployment.
It will also create a volume mount with the same name and add it to all containers in the deployment. This includes the Grafana container and all extra containers specified via the `spec.containers` property.
Config maps are mounted inside the containers under `/etc/grafana-configmaps/<configmap name>/`, secrets under `/etc/grafana-secrets/<secret name>/`.

The missing piece for the LDAP example is to tell Grafana about the location of the configuration file. This can be done in the config section of the Grafana CR:

Expand All @@ -70,4 +72,4 @@ spec:

The full example can be found under `deploy/examples/ldap`.

*NOTE*: The Grafana Pod will not be able to start until all specified Secrets and Config maps exist.
*NOTE*: The Grafana Pod will not be able to start until all specified Secrets and Config maps exist.
9 changes: 5 additions & 4 deletions documentation/jsonnet.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
# Jsonnet support

The operator supports importing dashboards in [jsonnet](https://jsonnet.org/) format. The [grafonnet](https://grafana.github.io/grafonnet-lib/) library is available out of the box, other libraries can be imported via config maps.
The operator supports importing dashboards in [jsonnet](https://jsonnet.org/) format.
The [grafonnet](https://grafana.github.io/grafonnet-lib/) library is available out of the box, other libraries can be imported via config maps.

## Creating a jsonnet dashboard

Expand All @@ -21,7 +22,7 @@ spec:
The `grafonnet` library is provided by the operator and can be imported using:

```
```libsonet
local grafana = import 'grafonnet/grafana.libsonnet';
```

Expand Down Expand Up @@ -58,10 +59,10 @@ spec:
The libary will be imported as a file with the name `monitoring.libsonnet` into a directory with the same name of the config map.
It can be imported in a dashboard using the following code:

```
```libsonet
local monitoring = import 'monitoring/monitoring.libsonnet';
```

*NOTE*: The keys of the config map must be valid filenames, and the extension must be `.libsonnet`

*NOTE*: Multiple jsonnet files can be in the same config map
*NOTE*: Multiple jsonnet files can be in the same config map
Loading

0 comments on commit 9bd3f95

Please sign in to comment.