Skip to content

Updating Grafana security details #864

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Dec 19, 2024
Merged

Updating Grafana security details #864

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 13 additions & 5 deletions docs/admin/observability/metrics.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,17 +82,24 @@ sshuttle -r user@host 0/0

Grafana will be available at http://host:3370/-/debug/grafana.

### Grafana Security
### Grafana security

<Callout type="warning">
WARNING: By default, our Grafana container runs in anonymous mode with authentication disabled, relying on Sourcegraph's authentication and authorization when accessed through your Sourcegraph instance.

We recommend you use your network security controls to prevent access to Grafana's listening ports, or enable Grafana's builtin authentication.
We recommend you use your network security controls to prevent access to Grafana's listening port, or enable Grafana's built-in authentication.
</Callout>

To enable Grafana's builtin authentication, configure the `GF_AUTH_ANONYMOUS_ENABLED` environment variable to `false` in the Grafana container's environment variables in your deployment override file.
To enable Grafana's built-in authentication, configure the `GF_AUTH_ANONYMOUS_ENABLED` environment variable to `false` in the Grafana container's environment variables in your deployment override file, then redeploy the Grafana container.

We also recommend that you customize the default admin username and password by configuring the `GF_SECURITY_ADMIN_USER` and `GF_SECURITY_ADMIN_PASSWORD` environment variables, using your secrets management tool in your deployment pipeline.
We also recommend that you customize the default admin username and password.

For new deployments, configure the `GF_SECURITY_ADMIN_USER` and `GF_SECURITY_ADMIN_PASSWORD` environment variables on the Grafana container, using your deployment pipeline's secrets management tool, to initialize the default admin user. Changing these environment variables do not change the username or password after the user is initialized on first deployment.

For existing deployments, you can either:

1. Log in to the Grafana web UI with the default credentials, and it will prompt you to change the password.
2. Or, configure the environment variables the same as a new instance, delete the Grafana container's storage volume, and restart the Grafana container. This will cause Grafana to re-initialize, including the default admin user. The contents of the Grafana container's storage volume are ephemeral, so metrics data will not be lost.

```yaml
# Helm override
Expand All @@ -108,11 +115,12 @@ grafana:
# Docker Compose override
grafana:
environment:
- 'GF_AUTH_ANONYMOUS_ENABLED=false'
- 'GF_SECURITY_ADMIN_USER=custom-admin-username'
- 'GF_SECURITY_ADMIN_PASSWORD=custom-admin-password'
- 'GF_AUTH_ANONYMOUS_ENABLED=false'
```


## Prometheus

Prometheus is a monitoring tool that collects application- and system-level metrics over time and makes these accessible through a robust query language.
Expand Down
Loading