Use Grafana Service Accounts for pmm-agent authentication

General

Escalation

General

Escalation

Description

Hi,

Currently PMM Admin has to use user's credentials (usually this is just admin's ones) in order to connect new pmm-agent to PMM Server. Even our official documentation provides provides in an examples using admin's credentials: https://docs.percona.com/percona-monitoring-and-management/setting-up/client/index.html#register.

Such approach has a significant drawbacks:

it contradicts OWASP-TOP10 "A05:2021 – Security Misconfiguration" https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
it is not secured at all to use admin's credentials in any tasks/actions not related to Admin at all.
potential admin credentials leakage
issues after changing admin's credentials - it is required to change them in all pmm-agents that use them.

There was an alternative "Authenticating using API keys". But Grafana now deprecates API keys and provides an alternative - Service Accounts.

So this ticket is dedicated to this topic - consider migrating pmm-agent credentials to Grafana Service Accounts. And use a separate Service Account for each pmm-agent.

Moreover, in Percona Everest product we need to automatically connect new pmm-agents to PMM Server. Service Accounts suit best in this task.

How to test

Testing with existing service account

Create new service account.
Create new service token with admin rights related to account you created before.
Save service token (looks like: glsa_Fp0ggev31R58ueNJbJgYw7fIGfO3yKWH_746383ab).
Paste service token to pmm-agent config to password field under server group. Username should be “service_token”.
Connect pmm-agent to pmm-server and run it.
Everything should work as usual.

Testing without existing service account

Use basic auth in pmm-agent config.
Connect pmm-agent to pmm-server and run it.
Your config should be updated and you should see service_token as a username and generated service token in password field.
Everything should work as usual.

Testing with existing API key

Create API key in Grafana.
Use API key auth in pmm-agent config (username: api_key, password:yourAPIKey).
Connect pmm-agent to pmm-server and run it.
Go to Grafana settings and you should be able to see “API key” tab there and your API key.
Everything should work as usual.

Testing with existing API key and upgrade from PMM 2 to PMM3

Use PMM2 version.
Create API key in Grafana.
Use API key auth in pmm-agent config (username: api_key, password:yourAPIKey).
Connect pmm-agent to pmm-server and run it.
Upgrade to PMM3 (docker way update).
Go to Grafana settings and API key tab should disappear. You should see only “Service accounts” tab.
Everything should work as usual.