feat(base-cluster/monitoring): set code challenge for grafana #1500
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
WalkthroughThe Grafana OAuth configuration was updated to enable PKCE (Proof Key for Code Exchange) by adding the Changes
Sequence Diagram(s)sequenceDiagram
User -> Grafana: Initiate OAuth login
Grafana -> OAuth Provider: Redirect with PKCE challenge
OAuth Provider -> User: Authenticate and authorize
User -> OAuth Provider: Provide credentials
OAuth Provider -> Grafana: Return authorization code + PKCE verifier
Grafana -> OAuth Provider: Exchange code for token (with PKCE verifier)
OAuth Provider -> Grafana: Issue access token
Grafana -> User: Grant access
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Pull Request Overview
This PR adds a code challenge option to improve OAuth security for Grafana by enabling PKCE.
- Introduces the "use_pkce: true" flag in the OAuth configuration.
- Enhances the security posture of Grafana authentication.
Comments suppressed due to low confidence (1)
charts/base-cluster/templates/monitoring/kube-prometheus-stack/_grafana-config.yaml:27
- [nitpick] Consider adding an inline comment to explain the purpose of 'use_pkce: true' for future maintainers, especially if the team is not familiar with PKCE configuration requirements.
use_pkce: true
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
charts/base-cluster/templates/monitoring/kube-prometheus-stack/_grafana-config.yaml (1)
26-27: Expose PKCE toggle via values and document version requirements.Currently
use_pkceis hard-coded:scopes: openid profile email use_pkce: true
- Make it configurable in
values.yaml(e.g..Values.global.authentication.oauth.usePkce) instead of forcingtrue:- use_pkce: true + {{- if .config.usePkce }} + use_pkce: {{ .config.usePkce }} + {{- end }}
- Document the minimum Grafana/chart version that supports
use_pkce, and bump the chart version inChart.yamlif needed.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
charts/base-cluster/templates/monitoring/kube-prometheus-stack/_grafana-config.yaml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (4)
- GitHub Check: generateDiffCommentBody
- GitHub Check: check licenses
- GitHub Check: lint helm chart (base-cluster)
- GitHub Check: wait-for-checks
tasches
approved these changes
Jun 6, 2025
github-merge-queue bot
pushed a commit
that referenced
this pull request
Jun 6, 2025
🤖 I have created a release *beep* *boop* --- ## [8.1.0](base-cluster-v8.0.0...base-cluster-v8.1.0) (2025-06-06) ### Features * **base-cluster/monitoring:** allow upsizing tempo storage ([#1448](#1448)) ([db1a742](db1a742)) * **base-cluster/monitoring:** also read secrets for datasources ([#1479](#1479)) ([83ba8bd](83ba8bd)) * **base-cluster/monitoring:** configure service graph for grafana ([#1422](#1422)) ([8d4bb4c](8d4bb4c)) * **base-cluster/monitoring:** set code challenge for grafana ([#1500](#1500)) ([aa803da](aa803da)) * **base-cluster/monitoring:** set code_challenge_method for oauth2-proxy ([#1496](#1496)) ([b252cd7](b252cd7)) ### Bug Fixes * **base-cluster:** this prevents the user from installing this under another name ([#1418](#1418)) ([f4807e8](f4807e8)) ### Miscellaneous Chores * **base-cluster/docs:** update flux helmrelease command to update CRDs ([#1421](#1421)) ([a8fd535](a8fd535)) * **base-cluster/monitoring:** remove unnecessary open-telemetry-collector dashboard ([#1449](#1449)) ([520e9e1](520e9e1)) * **base-cluster:** change descheduler syntax ([#1483](#1483)) ([907bdae](907bdae)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Enhanced monitoring with support for upsizing tempo storage. - Enabled reading secrets for datasources and configuring the service graph in Grafana. - Added options to set the code challenge and code_challenge_method for Grafana and oauth2-proxy. - Introduced an optional persistence configuration for tracing ingester storage size. - **Bug Fixes** - Resolved an issue preventing installation of the chart under unintended names. - **Chores** - Updated helmrelease command for CRD updates. - Removed an unnecessary dashboard and adjusted descheduler syntax. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
See #1496
Summary by CodeRabbit