Give access to central Grafana to @colliand

[GeorgianaElena]

Context

In #1438 (comment), @colliand asked for access to the central grafana.

Proposal

We should do this.

Updates and actions

Steps to be taken by @2i2c-org/tech-team:

• give access to GCP two-eye-two-see project
• confirm with @colliand that colliand@2i2c.org the correct address to use for access to the project above

Steps to be taken by @colliand

• setup gcloud and sops per instructions in https://team-compass.2i2c.org/en/latest/practices/secrets.html#set-up-sops
• use sops to decrypt the file which stores the password of the admin user of the central grafana by following the docs in:
  • https://team-compass.2i2c.org/en/latest/practices/secrets.html#decrypt-secrets-with-sops
  • https://infrastructure.2i2c.org/en/latest/howto/operate/grafana.html#access-hub-grafana-dashboards

Update

#1437 was merged, and we can now login into the central grafana using GitHub. Access is granted based on the membership in 2i2c-org GitHub org.

[sgibson91]

I have sent an invite to colliand@2i2c.org to gain access to two-eye-two-see

[damianavila]

Even when I know @colliand can handle all the technical steps, maybe it makes sense to give him the pass through another tool (ie. Bitwarden)? Otherwise, I feel it is a lot of toil for him...

[choldgraf]

I agree with @damianavila - I don't think that we should require all team members to understand sops and gcloud just to get access to a grafana dashboard. If we think that a service will be useful to people who aren't on the engineering team, we shouldn't require engineering practices to use them. (I'm also imagining future hires that may have much less engineering-specific experience than any of us have already)

In my opinion it would be fine to use something like Bitwarden's send feature to send the password.

[sgibson91]

While I don't disagree, with the password manager approach we then run into a source of truth issue. We store the grafana admin password in the repo because it is automatically read by our deployment infrastructure when we deploy the support chart. If we change that password for whatever reason, we then have a monumental task on our hands updating everyone's password managers.

I think an actual solution would be something more like GitHub Auth with Teams and let e.g. tech-team have access. So an individual's access is not dependent on the state of the default password we use in deployments.

[GeorgianaElena]

I'm working on #1437, that should allow logging in with GitHub and we won't have to get through this steps. Shouldn't take long, but yeah, please feel free to send the password to @colliand anyway you feel is more appropriate in the meantime

[sgibson91]

So I think a good plan is:

• Short term access for Jim right now: Send password via a password manager
• Medium to long term access for future hires with fewer engineering-specific skills: The GitHub Auth integration Georgiana is working on

[GeorgianaElena]

#1437 was merged, and we can now login into the central grafana using GitHub. "Viewer" access is granted based on the membership in 2i2c-org GitHub org.

@colliand, can you please try it out? Click on the Sign in with GitHub button at the bottom of the page at https://grafana.pilot.2i2c.cloud

[choldgraf]

Just a note that I agree w/ @sgibson91 and @GeorgianaElena's assessment above. My suggestion of sending via Bitwarden was just as a one-off, but I think that our long term focus should be on the guiding principle of:

If we think that a service will be useful to people who aren't on the engineering team, we shouldn't require engineering practices to use them.

I think the GitHub Auth login approach is great 👍

However I just tried to log in via this method, and after authorizing the github app, got:

[sgibson91]

However I just tried to log in via this method, and after authorizing the github app, got:

Same for me

[GeorgianaElena]

Yep, this issue should be fixed by #1460.

@sgibson91, @choldgraf, can you please try again now? 🙏🏼

[sgibson91]

Yay!! 🚀

[choldgraf]

it works for me too!

[colliand]

Yay! It works for me too. Now I need to learn how to use it!

[damianavila]

Since @colliand confirmed access we can call this one done. Awesome work @GeorgianaElena!