Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Transition OnCall plugin to use Grafana service account #1806

Closed
mderynck opened this issue Apr 20, 2023 · 3 comments · Fixed by #2385
Closed

Transition OnCall plugin to use Grafana service account #1806

mderynck opened this issue Apr 20, 2023 · 3 comments · Fixed by #2385
Assignees
@mderynck
Labels
feature request New feature or request part:helm/kubernetes/docker

Comments

@mderynck
Copy link
Contributor

This issue is for tracking transitioning the OnCall plugin to use a service account instead of API key for communication with the OnCall backend. We should still keep the API key code and use it for older versions that do not support service accounts.

More info about API key deprecation: grafana/grafana#53567
@robinsmedberg
Copy link

robinsmedberg commented Jun 21, 2023 •
edited
Loading

@mderynck How is it going with this one? We are having problems with "Invalid API key".
Is there currently any work around? Or Grafana + OnCall versions that work together?

@mderynck
Copy link
Contributor Author

Hi @robinsmedberg! Can you enter a separate issue describing the problem you are experiencing with Invalid API key? Changing to service accounts in the OnCall plugin code has not been prioritized as API keys have remained compatible.

@robinsmedberg
Copy link

@mderynck Our problem is very similar to #1876

We made a clean install of Grafana (v9.2.19) + Oncall (v1.2.41) (external postgres, included redis).

After we restarted the Oncall engine the "Invalid API key" error returned.

@joeyorlando joeyorlando mentioned this issue Jun 27, 2023
Closed
@mderynck mderynck self-assigned this Jun 28, 2023
@mderynck mderynck mentioned this issue Jun 28, 2023
Merged
3 tasks
@joeyorlando joeyorlando linked a pull request Jun 29, 2023 that will close this issue
OnCall plugin use service accounts instead of api keys #2385
Merged
3 tasks
joeyorlando added a commit that referenced this issue Jun 29, 2023
@mderynck @joeyorlando
OnCall plugin use service accounts instead of api keys (#2385)
5b00956 
# What this PR does
Changes OnCall plugin to use service accounts and api tokens instead of
api keys. API keys will continue to work but if the plugin ever replaces
them it will use a service account instead. Previously this was thought
to be unnecessary but it was missing the case where the API key was
converted to a service account which it could no longer find when
searching the `/api/auth/keys` endpoint. That key would not be deleted
and it would conflict with a newly created one of the same name.

Now the behaviour is as follows: 
1. Anytime a new token is needed all API keys and tokens under the
service account matching the defined names will be deleted
2. A service account will be created named `sa-autogen-OnCall` if one
does not already exist
3. An api token will be created under that service account named
`OnCall`

## Which issue(s) this PR fixes
#1806 

## Checklist

- [x] Unit, integration, and e2e (if applicable) tests updated
- [x] Documentation added (or `pr:no public docs` PR label added if not
required)
- [x] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)

---------

Co-authored-by: Joey Orlando <[email protected]>
brojd pushed a commit that referenced this issue Sep 18, 2024
@mderynck @joeyorlando
OnCall plugin use service accounts instead of api keys (#2385)
d2cdd66 
# What this PR does
Changes OnCall plugin to use service accounts and api tokens instead of
api keys. API keys will continue to work but if the plugin ever replaces
them it will use a service account instead. Previously this was thought
to be unnecessary but it was missing the case where the API key was
converted to a service account which it could no longer find when
searching the `/api/auth/keys` endpoint. That key would not be deleted
and it would conflict with a newly created one of the same name.

Now the behaviour is as follows: 
1. Anytime a new token is needed all API keys and tokens under the
service account matching the defined names will be deleted
2. A service account will be created named `sa-autogen-OnCall` if one
does not already exist
3. An api token will be created under that service account named
`OnCall`

## Which issue(s) this PR fixes
#1806 

## Checklist

- [x] Unit, integration, and e2e (if applicable) tests updated
- [x] Documentation added (or `pr:no public docs` PR label added if not
required)
- [x] `CHANGELOG.md` updated (or `pr:no changelog` PR label added if not
required)

---------

Co-authored-by: Joey Orlando <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mderynck mderynck

Labels
feature request New feature or request part:helm/kubernetes/docker
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

OnCall plugin use service accounts instead of api keys grafana/oncall
3 participants
@Matvey-Kuk @robinsmedberg @mderynck