04. 10. 2024
Emil Fazzi
APM, ITOA
How to Restrict Viewing Access in Grafana Dashboards Based on Alyvix Tags
With the introduction of Alyvix Tags in NetEye 4.38, we’ve given users the ability to filter test cases and reports based on their tags, making it easier to focus on the specific test cases that matter to each department or subdivision within a tenant. One of the requests that emerged from this new feature was the need to apply similar viewing restrictions to Alyvix performance dashboards in Grafana.
Currently, although direct linking between Alyvix tags and Grafana teams isn’t available, there is a manual approach you can take to restrict viewing access based on tags. In this post, I’ll walk you step by step through the process for limiting the viewing capabilities of Grafana dashboards by using a manual configuration. This can be especially helpful for customers who need to split their performance data across multiple sub-companies or internal teams.
Why Viewing Restrictions Matter
Let’s consider a use case where a tenant, ACME, manages multiple test cases across different departments or companies. For instance, Testcase1 and Testcase2 may both belong to ACME’s Tokyo division, and we only want users from that division to have access to these test cases, rather than being able to see the entire suite of tenant test cases.
Alyvix’s tagging functionality allows us to filter test cases by tags in the UI, but to maintain consistency across NetEye, we also want to restrict the visibility of dashboards in Grafana so that users only see the data relevant to their specific tag(s).
Step by Step: Restricting Dashboard Views in Grafana
In this section, I’ll guide you through setting up Grafana to restrict users’ access to performance data based on tags, by using manual configurations.
1. Tagging Test Cases in Alyvix
The first step is to assign tags to the test cases you want to restrict in the Alyvix UI. For example, we’ll assign the Tokyo tag to Testcase1 and Testcase2. A detailed guide to this procedure can be found in the dedicated section of our NetEye User Guide.
- Why this is important: Although assigning an Alyvix tag will have no effects on Grafana Alyvix dashboards as mentioned before, it is strictly related to the permission management of Tags and Testcases for user roles, and maintaining coherence between the two modules is crucial.
2. Setting up Access Control in NetEye
Now let’s create an inherited role for our restricted users.
- Create an inherited role: The viewer role for the Tokyo team will be inherited from the main tenant role (e.g.,
neteye_tenant_ACME). - Alyvix module permissions: Assign the necessary permissions for the Alyvix module, including
alyvix/tenant-viewerandalyvix/viewer-tags. In this case, the viewer role should be restricted to theTokyotag.This ensures that in the Alyvix UI, only the tagged test cases (Testcase1 and Testcase2) will be visible to members of this role. - Analytics module permissions: Similarly, assign Grafana permissions, specifying the viewer role for the Analytics module. Here we’ll define the Alyvix-Tokyo team under
grafana/teams, ensuring in a future step that this team will only have access to the tagged test cases.
3. Configuring ITOA Dashboards in Grafana
Next, we move to Grafana to configure the dashboards and apply our viewing restrictions.
- Create a Grafana team: In Grafana’s organization settings (ensure you’re in the correct organization, e.g., ACME), create a team called
Alyvix-Tokyoor any suitable name that identifies the team for restricted access. Make sure the name of the team is the one specified in the previous step in the role permissions. - Remove general viewing permissions: To restrict this team’s access, remove the general Grafana Viewer role from the Visual Monitoring (Alyvix) folder. This ensures that only authorized users (those assigned to the Tokyo team) will have access to the specific dashboards we configure.
4. Cloning and Customizing Dashboards
Since we want to restrict viewing access to just the tagged test cases, we need to clone the relevant Alyvix dashboards and customize them to show only the appropriate data.
- Clone the dashboard: Go to the Visual Monitoring (Alyvix) folder, find the relevant performance dashboard (e.g., Test Cases Performance), and clone it. Name it something like
Tokyo Performance Dashboard. - Limit test cases: In the cloned dashboard, navigate to Variables and locate the variable that defines which test cases are displayed. Change the variable type to
Custom, and manually enter the test cases associated with thetokyotag (Testcase1 and Testcase2). This way, only these test cases will be visible on the dashboard.
5. Granting Viewing Access
After customizing the dashboard, we need to grant viewing permissions to the restricted team.
- Assign team permissions: In the dashboard permissions, add the
Alyvix-Tokyoteam and grant them theViewpermission. This ensures that only users within this team can view the dashboard. - Remove Viewer
Viewpermission: Make sure that the general Viewer user does not haveViewpermission on the modified dashboard, otherwise it will be visible to all users.
6. Restoring Full Access to Non-Restricted Viewers
Since we’ve removed general viewing permissions from the Alyvix folder, we need to make sure that non-restricted viewers (those who don’t fall under any tag restrictions) can still access the full dashboard suite.
- Create a team for full access: Create a team called
Full Viewers(or similar), and grant this team viewing permissions for the entire Alyvix folder.
Conclusion
By following this procedure, you can manually restrict viewing access in Grafana dashboards based on Alyvix tags, ensuring that each team or subdivision only sees the data that matters to them. While the current setup requires manual configuration, it offers a flexible way to control access, ensuring that users don’t see test cases outside their scope.
In future releases, we’ll introduce the idea to automate the linking of Alyvix tags with Grafana teams, making this process even more seamless. But for now, this solution offers a way to meet the immediate needs of environments where teams require strict control over test case visibility.
Stay tuned for more updates, and feel free to reach out with any questions or feedback!
These Solutions are Engineered by Humans
Are you passionate about performance metrics or other modern IT challenges? Do you have the experience to drive solutions like the one above? Our customers often present us with problems that need customized solutions. In fact, we’re currently hiring for roles just like this as well as other roles here at Würth Phoenix.
Emil Fazzi
Software Developer, R&D Team in the "IT System & Service Management Solutions" group at Würth Phoenix.
Author
