85 lines
3.2 KiB
YAML
85 lines
3.2 KiB
YAML
# services/monitoring/grafana-user-dedupe-job.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: grafana-user-dedupe-api-v2
|
|
namespace: monitoring
|
|
annotations:
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/role: "monitoring"
|
|
vault.hashicorp.com/agent-inject-secret-grafana-env.sh: "kv/data/atlas/monitoring/grafana-admin"
|
|
vault.hashicorp.com/agent-inject-template-grafana-env.sh: |
|
|
{{ with secret "kv/data/atlas/monitoring/grafana-admin" }}
|
|
export GRAFANA_USER="{{ index .Data.data "admin-user" }}"
|
|
export GRAFANA_PASSWORD="{{ index .Data.data "admin-password" }}"
|
|
{{ end }}
|
|
spec:
|
|
backoffLimit: 1
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: dedupe
|
|
image: python:3.12-slim
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
args:
|
|
- |
|
|
set -euo pipefail
|
|
. /vault/secrets/grafana-env.sh
|
|
grafana_url="${GRAFANA_URL}"
|
|
if [ -z "${grafana_url}" ]; then
|
|
echo "GRAFANA_URL is required"
|
|
exit 1
|
|
fi
|
|
if [ -z "${GRAFANA_USER}" ] || [ -z "${GRAFANA_PASSWORD}" ]; then
|
|
echo "Grafana admin credentials missing"
|
|
exit 1
|
|
fi
|
|
if [ -z "${GRAFANA_DEDUPE_EMAILS}" ]; then
|
|
echo "GRAFANA_DEDUPE_EMAILS is required"
|
|
exit 1
|
|
fi
|
|
python - <<'PY'
|
|
import base64
|
|
import json
|
|
import os
|
|
import urllib.parse
|
|
import urllib.request
|
|
|
|
grafana_url = os.environ["GRAFANA_URL"].rstrip("/")
|
|
user = os.environ["GRAFANA_USER"]
|
|
password = os.environ["GRAFANA_PASSWORD"]
|
|
emails = [e.strip() for e in os.environ["GRAFANA_DEDUPE_EMAILS"].split(",") if e.strip()]
|
|
|
|
token = base64.b64encode(f"{user}:{password}".encode("utf-8")).decode("utf-8")
|
|
headers = {"Authorization": f"Basic {token}"}
|
|
|
|
def request(method: str, url: str):
|
|
req = urllib.request.Request(url, headers=headers, method=method)
|
|
with urllib.request.urlopen(req, timeout=10) as resp:
|
|
return resp.read()
|
|
|
|
for email in emails:
|
|
lookup_url = f"{grafana_url}/api/users/lookup?loginOrEmail={urllib.parse.quote(email)}"
|
|
try:
|
|
payload = json.loads(request("GET", lookup_url))
|
|
except Exception:
|
|
print(f"no grafana user found for {email}")
|
|
continue
|
|
user_id = payload.get("id")
|
|
if not user_id:
|
|
print(f"no grafana user found for {email}")
|
|
continue
|
|
print(f"deleting grafana user {user_id} ({email})")
|
|
delete_url = f"{grafana_url}/api/admin/users/{user_id}"
|
|
request("DELETE", delete_url)
|
|
PY
|
|
echo "done"
|
|
env:
|
|
- name: GRAFANA_URL
|
|
value: http://grafana
|
|
- name: GRAFANA_DEDUPE_EMAILS
|
|
value: brad.stein@gmail.com,brad@bstein.dev
|