Merge pull request #50613 from adk3798/grafana-anonymous

mgr/cephadm: allow configuring anonymous access for grafana

Reviewed-by: Redouane Kachach <rkachach@redhat.com>

2 files changed, 12 insertions, 0 deletions

diff --git a/src/python-common/ceph/deployment/service_spec.py b/src/python-common/ceph/deployment/service_spec.py
index 7cf609384d4..f3299e5903c 100644
--- a/src/python-common/ceph/deployment/service_spec.py
+++ b/src/python-common/ceph/deployment/service_spec.py
@@ -1301,6 +1301,7 @@ class GrafanaSpec(MonitoringSpec):
                  port: Optional[int] = None,
                  protocol: Optional[str] = 'https',
                  initial_admin_password: Optional[str] = None,
+                 anonymous_access: Optional[bool] = True,
                  extra_container_args: Optional[List[str]] = None,
                  extra_entrypoint_args: Optional[List[str]] = None,
                  custom_configs: Optional[List[CustomConfig]] = None,
@@ -1314,6 +1315,7 @@ class GrafanaSpec(MonitoringSpec):
             custom_configs=custom_configs)
 
         self.initial_admin_password = initial_admin_password
+        self.anonymous_access = anonymous_access
         self.protocol = protocol
 
     def validate(self) -> None:
@@ -1322,6 +1324,12 @@ class GrafanaSpec(MonitoringSpec):
             err_msg = f"Invalid protocol '{self.protocol}'. Valid values are: 'http', 'https'."
             raise SpecValidationError(err_msg)
 
+        if not self.anonymous_access and not self.initial_admin_password:
+            err_msg = ('Either initial_admin_password must be set or anonymous_access '
+                       'must be set to true. Otherwise the grafana dashboard will '
+                       'be inaccessible.')
+            raise SpecValidationError(err_msg)
+
 
 yaml.add_representer(GrafanaSpec, ServiceSpec.yaml_representer)
 
diff --git a/src/python-common/ceph/tests/test_service_spec.py b/src/python-common/ceph/tests/test_service_spec.py
index 041cbbbd4ec..a0e0be2aa81 100644
--- a/src/python-common/ceph/tests/test_service_spec.py
+++ b/src/python-common/ceph/tests/test_service_spec.py
@@ -53,6 +53,8 @@ def test_parse_host_placement_specs(test_input, expected, require_network):
         (GrafanaSpec(protocol='-https'), True, '^Invalid protocol'),
         (GrafanaSpec(protocol='http'), False, ''),
         (GrafanaSpec(protocol='https'), False, ''),
+        (GrafanaSpec(anonymous_access=False), True, '^Either initial'),  # we require inital_admin_password if anonymous_access is False
+        (GrafanaSpec(anonymous_access=False, initial_admin_password='test'), False, ''),
     ])
 def test_apply_grafana(spec: GrafanaSpec, raise_exception: bool, msg: str):
     if  raise_exception:
@@ -341,12 +343,14 @@ spec:
 service_type: grafana
 service_name: grafana
 spec:
+  anonymous_access: true
   port: 1234
   protocol: https
 ---
 service_type: grafana
 service_name: grafana
 spec:
+  anonymous_access: true
   initial_admin_password: secure
   port: 1234
   protocol: https