Package: gonb
gonb - A Grafana onboarding toolOverviewGonb enable continues provisioning and configuration of Grafana based on an IAM source system.
This includes the lifecycle of organizations, users and teams.Users should authenticate using some SSO provider, but gonb us the same SSO IAM system to configure users into different
Grafana organizations and teams.
Gonb should be run using some scheduling tool to keep user in sync with the users definition in the IAM source.A typical patterns supported are:Map users in an IAM group to a corresponding organization.Map users in an IAM group into an organization and teamIn the later use case gonb also provide the creation of folders that are specific to a team. This support the
model where different teams have their own folder to create dashboards and alerts separated from other teams.The user model in the IAM system must be mapped to the Grafana model. The model include the objects for
organization, team and user where teams and users are linked to an organization.FeaturesIntegration with different IAM solution using a provider pattern.Multiple providers could operate against same Grafana instance, but should not operate on the same organization.A user can belong to multiple organizations.Automatic add and remove of user from organization(s) based on the lifecycle in the IAM.Update users in Grafana if any attributes in the user's IAM "object" is changed, e.g. the role, email.Create organization if they do not exist in Grafana, default false.Automatic creation of team folder, folder with same name as team, if teams are created. Default folder permission
for team is Editor.Team member lifecycle in the same way as for users in organizationManage permission for user with Grafana Admin (instance admin) rights. Default is false.Argument passingThe only way to pass arguments to gonb is by environment variables. Each provider must define their own and
required environment variables, and they must be exposed by the interface method:defmandatory_env_vars(self)->Dict[str,str]:passFor the grafana integration the following 3 must exist and have valid values:GONB_GRAFANA_URLGONB_GRAFANA_USERGONB_GRAFANA_PASSWORDGONB_GRAFANA_CREATE_ORGS - Will create organization(s) if not exists, defaultFalseGONB_GRAFANA_ADMINS - will manage users Grafana admin rights, defaultFalseGONB_SSO_PROVIDER - specify if the provider is based on a IAM used for Grafana authentication, defaultTrue.IfGONB_SSO_PROVIDERis True there is some updating operations that are not done by gonb, e.g. update a
user's name or email.Develop a providerA provider must implement the classgonb.provider.Providerand implement the following methods:defget_organisations(self)->Dict[str,OrganizationDTO]:defmandatory_env_vars(self)->Dict[str,str]:If not implemented aNotImplementedErrorwill be raised.Please see examples in the directoryjson_gonb_provider,json_team_gonb_providerandokta_gonb_provider.Both these example providers are part of gonb pip packagehttps://pypi.org/project/gonb.Running gonbThere are two ways you can use gonb. The first is to use it as package and build a provider.
The other way is to let gonb execute the provider. In this case the provider must be a python package and the
following environment variables must be set before gonb is executed:GONB_PROVIDER_CLASS_PATH  - the class name that is a subclass toProvider, e.g.json_gonb_provider.json_file.JSONFilewherejson_gonb_provider.json_fileis the package part.Gonb will dynamical load the module an instantiate the implementedProviderclass.
The second option enable building different providers as packages and use, e.g. pip to deploy dependency.Of course, you can use both gonb and a provider as packages and build something totally new like web service
that sync on external events.Run the json provider exampleThe json file provider is just for testing.gitclonegit@github.com:thenodon/gonb.git
python3-mvenvvenv
.venv/bin/activate
pipinstall-rrequirements.txtexportGONB_GRAFANA_PASSWORD=xyzexportGONB_GRAFANA_URL=http://localhost:3000exportGONB_GRAFANA_USER=adminexportGONB_JSON_FILE=json_file_example/users.json;# Set to true if organizations should be created if not existingexportGONB_GRAFANA_CREATE_ORGS=truecpjson_file_example/users_add.jsonjson_file_example/users.json
python-mjson_gonb_provider# check your Grafana for resultsSystem requirementsPython 3.8Grafana 9 - tested on 9.3.6Important notesPassword can be set by the provider, but should typical not since SSO would typical be used.
The default is to set the password to a 30 character random string of a mix of characters,
numbers and special characters.The GONB_GRAFANA_USER must be a Grafana instance admin.If the GONB_GRAFANA_USER do not exist in an organization that is to be managed, the user is added as an organization
admin.FutureSupport for Grafana Enterprise options for RBAC and team sync groups