Skip to content

Commit 79a3c5c

Browse files
JenSeRealoliverisaacJens Plüddemann
authored
Add exit code (#12)
* set ldap to use recursive search. Set flags for log level. * Added helm chart * bumped chart version * fxied restart policy * fixed config file line * fixd name of yaml file * fixed viewer, editor -> view, edit * Added exit code logic * add dev environment * formatting * open file with 'with' keyword * formatting * removed unused filter, fixed login, name and email being arrays and thus crashing the script * updated apiVersion of cronjob --------- Co-authored-by: Oliver Isaac <[email protected]> Co-authored-by: Jens Plüddemann <[email protected]>
1 parent 26fb21a commit 79a3c5c

20 files changed

+1438
-70
lines changed

‎.gitignore

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,4 +133,9 @@ dmypy.json
133133
.lock
134134
.idea
135135
/shelf/
136-
/workspace.xml
136+
/workspace.xml
137+
138+
# Nix
139+
.devenv
140+
.direnv
141+
.envrc

‎Makefile

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
DOCKER_REPO ?= DOCKERHUB_USER/grafana-ldap-sync-script
22
DOCKER_TAG ?= v1.0
3+
CONFIG_DIR ?= ${PWD}
34

45
init:
56
pip install -r requirements.txt
@@ -28,7 +29,7 @@ docker-push: docker-build
2829
docker push ${DOCKER_REPO}:${DOCKER_TAG}
2930

3031
docker-run: docker-build
31-
docker run --mount 'type=bind,source=${PWD},target=/data' ${DOCKER_REPO}:${DOCKER_TAG} --config /data/config.yml --bind /data/example.csv
32+
docker run --mount 'type=bind,source=${CONFIG_DIR},target=/data' ${DOCKER_REPO}:${DOCKER_TAG} --config /data/config.yml --bind /data/example.csv --log-level=debug --dry-run
3233

3334
docker-explore: docker-build
34-
docker run -it --entrypoint /bin/bash --mount 'type=bind,source=${PWD},target=/data' ${DOCKER_REPO}:${DOCKER_TAG} -o vi
35+
docker run -it --entrypoint /bin/bash --mount 'type=bind,source=${CONFIG_DIR},target=/data' ${DOCKER_REPO}:${DOCKER_TAG} -o vi

‎README.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,9 @@ Before starting the script you need to enter your grafana & ldap credentials in
3131
path to your .csv file containing the bindings.
3232

3333
### Binding
34-
To bind LDAP-groups to grafana-teams and grant these teams access to folders you need to provide a .csv file. Please note
35-
that the first row of the csv is recognized as a header-row and is therefore being ignored.
36-
The file needs to contain the following information in this exact order:
34+
To bind LDAP-groups to grafana-teams and grant these teams access to folders you need to provide a .csv file. Please note
35+
that the first row of the csv is recognized as a header-row and is therefore being ignored.
36+
The file needs to contain the following information in this exact order:
3737
* **LDAP-Group**: The LDAP group which will be used for mapping.
3838
* **Grafana-Team Name**: The name of the Grafana team which will be created (if not exist) and where the group's users will be added to.
3939
* **Grafana-Team ID**: The ID of the Grafana team (currently not used).
@@ -65,7 +65,7 @@ Using this CSV mapping will result in the following operations:
6565

6666
#### Removing Bindings
6767
When a binding is removed in your .csv-file, this binding is also removed by the script. So if there is a team in your grafana instance which
68-
is not defined by the current binding the team will be deleted. This also applies to users. **This does not apply to folders!
68+
is not defined by the current binding the team will be deleted. This also applies to users. **This does not apply to folders!
6969
Folders need to be deleted manually if not needed anymore!**
7070

7171

‎config.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ config:
2424
groupSearchBase: dc=example,dc=com
2525
# Filter that should be used for the group search.
2626
groupSearchFilter:
27+
# Search recursively through groups
28+
searchRecusrively: False
2729
# Search-Base for user objects on the LDAP-Server.
2830
userSearchBase: dc=example,dc=com
2931
# Filter that should be used for user searches.

‎deploy/helm/grafana-ldap-sync/.helmignore

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎deploy/helm/grafana-ldap-sync/Chart.yaml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: v2
2+
name: grafana-ldap-sync
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 1.0.4
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
appVersion: 1.0.0

‎deploy/helm/grafana-ldap-sync/Makefile

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
template:
2+
helm3 template . --values=./values.example.yaml --debug

‎deploy/helm/grafana-ldap-sync/templates/NOTES.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
This helm chart deploys a cronjob which runs on, by default, a 30 minute schedule.

‎deploy/helm/grafana-ldap-sync/templates/_helpers.tpl

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "grafana-ldap-sync.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "grafana-ldap-sync.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "grafana-ldap-sync.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "grafana-ldap-sync.labels" -}}
37+
helm.sh/chart: {{ include "grafana-ldap-sync.chart" . }}
38+
{{ include "grafana-ldap-sync.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "grafana-ldap-sync.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "grafana-ldap-sync.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "grafana-ldap-sync.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "grafana-ldap-sync.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎deploy/helm/grafana-ldap-sync/templates/config.yaml

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: {{ include "grafana-ldap-sync.fullname" . }}-config
5+
labels:
6+
{{- include "grafana-ldap-sync.labels" . | nindent 4 }}
7+
stringData:
8+
config.yaml: |
9+
config:
10+
{{- .Values.config | toYaml | nindent 6 }}
11+
{{- if .Values.csvContent }}
12+
permissions.csv: {{ .Values.csvContent | quote }}
13+
{{- else }}
14+
{{- $comment := "In this case we need to generate the CSV usign some crazy logic" }}
15+
permissions.csv: |
16+
{{- $perms := list ( list "ZBV/LDAP-Gruppe" "Grafana-Team-Name" "Grafana-Team-ID" "Grafana-Folder-Name" "Grafana-Folder-UUID" "Grafana-Folder-Permissions" ) }}
17+
{{- $teams := .Values.teams }}
18+
{{- $folders := .Values.folders }}
19+
{{- $addTeamsToAll := .Values.addTeamsToAll }}
20+
{{- range $teamName, $groups := $teams }}
21+
{{- $comment := "This is how we default the group list to the team name" }}
22+
{{- if not $groups }}
23+
{{- $groups = list $teamName }}
24+
{{- end }}
25+
26+
{{- $comment := "Ensure that every permission level exists for every folder" }}
27+
{{- range $permLevel, $teamsToAdd := $addTeamsToAll }}
28+
{{- range $folderName, $permission := $folders }}
29+
{{- if not ( get $permission $permLevel ) }}
30+
{{- $permission = set $permission $permLevel ( list ) }}
31+
{{- $folders = set $folders $folderName $permission }}
32+
{{- end }}
33+
{{- end }}
34+
{{- end }}
35+
36+
{{- range $folderName, $permission := $folders }}
37+
{{- $comment := "This is how we default the permission" }}
38+
{{- if not $permission }}
39+
{{- $permission = dict "admin" ( list $folderName ) }}
40+
{{- end }}
41+
42+
{{- range $permLevel, $permTeams := $permission }}
43+
{{- $comment := "If the user decides to use Admin we must ensure it is lowercase" }}
44+
{{- $permLevel = lower $permLevel }}
45+
46+
{{- $comment := "This is how we use the addTeamsToAll so that a team can be added to all folders" }}
47+
48+
{{- $teamsToAdd := ( get $addTeamsToAll $permLevel ) }}
49+
{{- if $teamsToAdd }}
50+
{{- $permTeams = concat $permTeams $teamsToAdd }}
51+
{{- end }}
52+
53+
{{- range $t := $permTeams }}
54+
{{- if eq ( toString $t ) $teamName }}
55+
{{- range $group := $groups }}
56+
{{- $ldapGroup := $group }}
57+
{{- $grafanaTeamName := $teamName }}
58+
{{- $grafanaTeamID := 1 }}
59+
{{- $grafanaFolderName := $folderName }}
60+
{{- $grafanaFolderUUID := $folderName | lower | replace " " "-" }}
61+
{{- $grafanaFolderPermissions := title $permLevel }}
62+
63+
{{- $perms = append $perms ( list $ldapGroup $grafanaTeamName $grafanaTeamID $grafanaFolderName $grafanaFolderUUID $grafanaFolderPermissions ) }}
64+
{{- end }} {{- $comment := "End range $groups" }}
65+
{{- end }} {{- $comment := "end if eq $teamname" }}
66+
{{- end }} {{- $comment := "end range $teams" }}
67+
{{- end }} {{- $comment := "end range $permission" }}
68+
{{- end }} {{- $comment := "end range $folders" }}
69+
{{- end }} {{- $comment := "end range $teams" }}
70+
{{- range $perm := $perms }}
71+
{{- $perm | join "," | nindent 4 }}
72+
{{- end }}
73+
{{- end }} {{- $comment := "End if .csvContent" }}
74+

‎deploy/helm/grafana-ldap-sync/templates/cronjob.yaml

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
apiVersion: batch/v1
2+
kind: CronJob
3+
metadata:
4+
name: {{ include "grafana-ldap-sync.fullname" . }}
5+
labels:
6+
{{- include "grafana-ldap-sync.labels" . | nindent 4 }}
7+
spec:
8+
startingDeadlineSeconds: {{ .Values.cronJob.startingDeadlineSeconds }}
9+
schedule: {{ .Values.cronJob.schedule | quote }}
10+
successfulJobsHistoryLimit: {{ .Values.cronJob.successfulJobsHistoryLimit }}
11+
suspend: {{ .Values.cronJob.suspend }}
12+
concurrencyPolicy: {{ .Values.cronJob.concurrencyPolicy }}
13+
failedJobsHistoryLimit: {{ .Values.cronJob.failedJobsHistoryLimit }}
14+
jobTemplate:
15+
metadata:
16+
labels:
17+
{{- include "grafana-ldap-sync.labels" . | nindent 8 }}
18+
spec:
19+
activeDeadlineSeconds: 120
20+
template:
21+
metadata:
22+
{{- with .Values.podAnnotations }}
23+
annotations:
24+
{{- toYaml . | nindent 12 }}
25+
{{- end }}
26+
labels:
27+
{{- include "grafana-ldap-sync.selectorLabels" . | nindent 12 }}
28+
spec:
29+
{{- with .Values.imagePullSecrets }}
30+
imagePullSecrets:
31+
{{- toYaml . | nindent 12 }}
32+
{{- end }}
33+
serviceAccountName: {{ include "grafana-ldap-sync.serviceAccountName" . }}
34+
restartPolicy: {{ .Values.restartPolicy }}
35+
{{- with .Values.securityContext }}
36+
securityContext:
37+
{{- toYaml . | nindent 12 }}
38+
{{- end }}
39+
{{- with .Values.extraInitContainers }}
40+
{{- toYaml . | nindent 10 }}
41+
{{- end }}
42+
containers:
43+
{{- with .Values.extraContainers }}
44+
{{- toYaml . | nindent 12 }}
45+
{{- end }}
46+
- name: {{ .Chart.Name }}
47+
{{- with .Values.securityContext }}
48+
securityContext:
49+
{{- toYaml . | nindent 16 }}
50+
{{- end }}
51+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
52+
imagePullPolicy: {{ .Values.image.pullPolicy }}
53+
args:
54+
- --config=/config/config.yaml
55+
- --bind=/config/permissions.csv
56+
- --log-level={{ .Values.logLevel }}
57+
{{- if .Values.dryRun }}
58+
- --dry-run
59+
{{- end }}
60+
{{- with .Values.extraArgs }}
61+
{{- toYaml . | nindent 14 }}
62+
{{- end }}
63+
64+
{{- with .Values.resources }}
65+
resources:
66+
{{- toYaml . | nindent 16 }}
67+
{{- end }}
68+
volumeMounts:
69+
- name: config
70+
mountPath: /config
71+
readOnly: true
72+
{{- with .Values.extraVolumeMounts }}
73+
{{- toYaml . | nindent 14 }}
74+
{{- end }}
75+
{{- with .Values.extraContainerConfig }}
76+
{{- toYaml . | nindent 14 }}
77+
{{- end }}
78+
{{- with .Values.nodeSelector }}
79+
nodeSelector:
80+
{{- toYaml . | nindent 12 }}
81+
{{- end }}
82+
{{- with .Values.affinity }}
83+
affinity:
84+
{{- toYaml . | nindent 12 }}
85+
{{- end }}
86+
{{- with .Values.tolerations }}
87+
tolerations:
88+
{{- toYaml . | nindent 12 }}
89+
{{- end }}
90+
volumes:
91+
- name: config
92+
secret:
93+
secretName: {{ include "grafana-ldap-sync.fullname" . }}-config
94+
{{- with .Values.extraVolumes }}
95+
{{- toYaml . | nindent 12 }}
96+
{{- end }}
97+
---
98+
{{- range $man := .Values.extraManifests }}
99+
{{- toYaml $man }}
100+
---
101+
{{- end }}
102+

‎deploy/helm/grafana-ldap-sync/templates/serviceaccount.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{{- if .Values.serviceAccount.create -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "grafana-ldap-sync.serviceAccountName" . }}
6+
labels:
7+
{{- include "grafana-ldap-sync.labels" . | nindent 4 }}
8+
{{- with .Values.serviceAccount.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
{{- end }}

0 commit comments

Comments
 (0)