GoogleCloudPlatform / GoogleCloudPlatform/cloud-logging-data-source-plugin

grafana_data_source creation w/ terraform causes consistent Plugin Error

Offen
#202 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
TypeScript
Sterne
24
Forks
17
Ø Merge
13 Std. 11 Min.
Gemergte PRs (30 T.)
11

Beschreibung

I've created the datasource manually via the UI using JWT and the plugin works great, however I tried to mimic the setup in our prod grafana instance with the same plugin version (latest) as of today and got errors.

The datasource is created correctly, however we see this error when trying to utilise it in UI Explorer:
`An error occurred within the plugin`

We're already managing our Google Cloud Monitoring datasources via code w/o any issues like so:

```
resource "grafana_data_source" "metrics_cm" {
provider = grafana.prod
name = "Cloud Monitoring - Metrics"
type = "stackdriver" # taken from grafana docs
uid = ""
json_data_encoded = jsonencode({
authenticationType = "jwt"
clientEmail = "@.iam.gserviceaccount.com"
defaultProject = "GCP_ACCOUNT_ID"
tokenUri = "https://oauth2.googleapis.com/token"
})
secure_json_data_encoded = jsonencode({
privateKey = data.google_secret_manager_secret_version.metrics-bq-datasource-private-key.secret_data
})
}
```

I tried a very similar approach for the cloud-logging & verified the format of the data_encoded fields is accurate by importing the "test" instance which was created by the UI:
```
resource "grafana_data_source" "cloudlogging_peng_renovate" {
provider = grafana.prod
name = "Cloud Logging - Renovate Logs"
type = "googlecloud-logging-datasource"

json_data_encoded = jsonencode({
authenticationType = "jwt"
clientEmail = "@.iam.gserviceaccount.com"
defaultProject = "GCP_ACCOUNT_ID"
tokenUri = "https://oauth2.googleapis.com/token"
pdcInjected = true
})

secure_json_data_encoded = jsonencode({
privateKey = data.google_secret_manager_secret_version.plat-eng-renovate-private-key.secret_data
})
}
```

These keys are in the same format for Cloud Monitoring & Cloud Logging secrets, and are extracted from the same JWT generated & uploaded manually in the UI for our test instance (which works):
```
-----BEGIN PRIVATE KEY-----\n\n-----END PRIVATE KEY-----\n
```
This `privateKey` content works fine for Cloud Monitoring Datasource, but as mentioned above fails for Cloud Logging.

I also verified the UI HTTP request content is the same as the data we are providing in our terraform example:
```
{
...
"name": "Cloud Logging - Renovate",
"type": "googlecloud-logging-datasource",
...
"jsonData": {
"authenticationType": "jwt",
"pdcInjected": true,
"clientEmail": "@.iam.gserviceaccount.com",
"defaultProject": "GCP_ACCOUNT_ID",
"tokenUri": "https://oauth2.googleapis.com/token"
},
"secureJsonFields": { "privateKey": true },
...
"apiVersion": "",
"secureJsonData": {
"privateKey": "-----BEGIN PRIVATE KEY-----\nMIIEvg...stripped...+CaQjPULhx\n-----END PRIVATE KEY-----\n"
}
}
```

I feel like the terraform datasource module might be stripping/malforming the privateKey content, and so it the datasource isn't created the same as when setting up via raw JWT and UI. Any help with this would be great!

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Es werden keine Repository-Dateien oder Tests genannt. Beginne damit, die von Terraform verwaltete googlecloud-logging-datasource zu reproduzieren, und vergleiche ihre privateKey-Nutzlast mit der funktionierenden UI-Anfrage; die Arbeit ist abgeschlossen, wenn die Datasource im UI Explorer erfolgreich geladen wird.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
gcp, grafana, terraform
Bereich
cloud, devops, observability-sre
Issue-Typ
Bug
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Ruhig
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
48/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.