GoogleCloudPlatform / GoogleCloudPlatform/cloud-logging-data-source-plugin
grafana_data_source creation w/ terraform causes consistent Plugin Error
- Langage dominant
- TypeScript
- Étoiles
- 24
- Forks
- 17
- Merge moyen
- 13 h 11 min
- PR mergées (30 j)
- 11
Description
I've created the datasource manually via the UI using JWT and the plugin works great, however I tried to mimic the setup in our prod grafana instance with the same plugin version (latest) as of today and got errors.
The datasource is created correctly, however we see this error when trying to utilise it in UI Explorer:
`An error occurred within the plugin`
We're already managing our Google Cloud Monitoring datasources via code w/o any issues like so:
```
resource "grafana_data_source" "metrics_cm" {
provider = grafana.prod
name = "Cloud Monitoring - Metrics"
type = "stackdriver" # taken from grafana docs
uid = ""
json_data_encoded = jsonencode({
authenticationType = "jwt"
clientEmail = "@.iam.gserviceaccount.com"
defaultProject = "GCP_ACCOUNT_ID"
tokenUri = "https://oauth2.googleapis.com/token"
})
secure_json_data_encoded = jsonencode({
privateKey = data.google_secret_manager_secret_version.metrics-bq-datasource-private-key.secret_data
})
}
```
I tried a very similar approach for the cloud-logging & verified the format of the data_encoded fields is accurate by importing the "test" instance which was created by the UI:
```
resource "grafana_data_source" "cloudlogging_peng_renovate" {
provider = grafana.prod
name = "Cloud Logging - Renovate Logs"
type = "googlecloud-logging-datasource"
json_data_encoded = jsonencode({
authenticationType = "jwt"
clientEmail = "@.iam.gserviceaccount.com"
defaultProject = "GCP_ACCOUNT_ID"
tokenUri = "https://oauth2.googleapis.com/token"
pdcInjected = true
})
secure_json_data_encoded = jsonencode({
privateKey = data.google_secret_manager_secret_version.plat-eng-renovate-private-key.secret_data
})
}
```
These keys are in the same format for Cloud Monitoring & Cloud Logging secrets, and are extracted from the same JWT generated & uploaded manually in the UI for our test instance (which works):
```
-----BEGIN PRIVATE KEY-----\n\n-----END PRIVATE KEY-----\n
```
This `privateKey` content works fine for Cloud Monitoring Datasource, but as mentioned above fails for Cloud Logging.
I also verified the UI HTTP request content is the same as the data we are providing in our terraform example:
```
{
...
"name": "Cloud Logging - Renovate",
"type": "googlecloud-logging-datasource",
...
"jsonData": {
"authenticationType": "jwt",
"pdcInjected": true,
"clientEmail": "@.iam.gserviceaccount.com",
"defaultProject": "GCP_ACCOUNT_ID",
"tokenUri": "https://oauth2.googleapis.com/token"
},
"secureJsonFields": { "privateKey": true },
...
"apiVersion": "",
"secureJsonData": {
"privateKey": "-----BEGIN PRIVATE KEY-----\nMIIEvg...stripped...+CaQjPULhx\n-----END PRIVATE KEY-----\n"
}
}
```
I feel like the terraform datasource module might be stripping/malforming the privateKey content, and so it the datasource isn't created the same as when setting up via raw JWT and UI. Any help with this would be great!
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Aucun fichier du dépôt ni aucun test n’est nommé. Commencez par reproduire la googlecloud-logging-datasource gérée par Terraform et comparez sa charge utile privateKey avec la requête UI fonctionnelle ; le travail est terminé lorsque la datasource se charge correctement dans UI Explorer.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- gcp, grafana, terraform
- Domaine
- cloud, devops, observability-sre
- Type d'issue
- Bug
- Difficulté
- 4/5
- Temps estimé
- 3-5 jours
- Activité
- Calme
- Clarté
- Plutôt claire
- Accessibilité débutants
- 48/100