Search code examples
prometheusgrafana

In Grafana, how to limit users to view data belonging to their org's only?


In Prometheus, we have different jobs to collect data from different teams, naming like "Team A - Node exporter, Team B - node exporter". In Grafana, we defined Orgs by team name so that user in their Org can set dashboard for themselves only. However, this will not segregate collected data, user in Org A(Team A) can still see metrics of servers from Org B (Team B).

As a Grafana Server Admin, is there any way that I can configure in Grafana to restrict users in Org A to check metrics of servers in Team A only?

Hope to find a way to restrict users in Grafana Org can see the data from his/her team only.


Solution

  • [I]s there any way that I can configure in Grafana to restrict users in Org A to check metrics of servers in Team A only?

    No. Prometheus doesn't provide any access control functionality. Without such a functionality Grafana would need to introduce query modification algorithm, that will add some selectors for such access control.

    The only way I could imagine realization of your idea (without query proxy, that will rewrite all queries based on organization) is to completely segregate your data: create second instance of Prometheus, move targets of organization B to it, and configure this instance as data source for organization B in Grafana.