admin

Grafana Cloud 管理

文档：https://grafana.com/docs/grafana-cloud/account-management.md

常见工作流

设置新堆栈

# 1. Create the stack via Cloud API
curl -X POST https://grafana.com/api/instances \
  -H "Authorization: Bearer <grafana-com-api-key>" \
  -H "Content-Type: application/json" \
  -d '{"name": "my-new-stack", "slug": "my-new-stack", "region": "us-east-0", "plan": "grafana-cloud-free"}'

# 2. Verify the stack is reachable (poll until 200)
until curl -fs https://my-new-stack.grafana.net/api/health > /dev/null; do sleep 2; done

# 3. Mint an admin service-account token (see § Service Accounts below)

# 4. Test the token
curl https://my-new-stack.grafana.net/api/org -H "Authorization: Bearer <token>"
# Returns 200 + org JSON → token works

团队入驻

1. 通过 POST /api/org/invites 邀请用户（每位用户执行一次 curl — 参见 references/api-reference.md § Stack API）
2. 通过 POST /api/teams 创建团队
3. 通过 POST /api/teams/{teamId}/members 添加每位用户
4. 为团队分配 RBAC 角色（参见下文的 § RBAC）
5. 验证：GET /api/teams/{teamId}/members 返回预期的用户列表

配置 SSO（Okta / SAML / GitHub）

1. 从 references/sso.md 中选择提供商配置，并将其放入 grafana.ini
2. 重启 Grafana
3. 在宣布之前，务必在无痕窗口中验证：参见 references/sso.md § Verifying SSO，了解 5 步验证和角色映射调试模式

删除堆栈（破坏性操作）

# 1. Delete via Cloud API
curl -X DELETE https://grafana.com/api/instances/{id} \
  -H "Authorization: Bearer <grafana-com-api-key>"

# 2. Verify the stack is gone (must return 404)
curl https://grafana.com/api/instances/{id} \
  -H "Authorization: Bearer <grafana-com-api-key>"

如果几秒后 GET 仍然返回 200，说明删除未生效 — 请重新检查堆栈 ID 和 Cloud API 密钥。

组织和堆栈结构

Grafana Cloud Account
└── Organization (billing unit)
    ├── Stack 1 (prod)   → dedicated Grafana, Prometheus, Loki, Tempo URLs
    ├── Stack 2 (staging)
    └── Stack 3 (dev)

• 组织：顶级账户，包含账单、用户、API 密钥和堆栈
• 堆栈：专用的 Grafana + LGTM 实例，拥有独立的 URL 和凭据

用户角色

角色	范围	权限
Org Admin	组织	管理堆栈、用户、账单和 API 密钥
Admin	堆栈	数据源、插件、用户和配置
Editor	堆栈	创建/编辑仪表板和告警
Viewer	堆栈	只读仪表板

RBAC

在配置 YAML 中定义自定义角色和分配：

# provisioning/access-control/roles.yaml
apiVersion: 1
roles:
  - name: TeamDashboardEditor
    description: Edit dashboards within team folder
    permissions:
      - action: dashboards:read
        scope: folders:UID:team-folder
      - action: dashboards:write
        scope: folders:UID:team-folder
      - action: dashboards:create
        scope: folders:UID:team-folder

# provisioning/access-control/assignments.yaml
apiVersion: 1
roleAssignments:
  - roleName: TeamDashboardEditor
    users:
      - [email protected]
      - [email protected]
    teams:
      - platform-team

提交 YAML 并重启 Grafana 后，验证角色是否已应用：GET /api/access-control/roles | jq '.[] | select(.name=="TeamDashboardEditor")'。

服务账户

服务账户是以编程方式访问（CI/CD、Terraform、Agent）的推荐方式。

# 1. Create the service account
curl -X POST https://yourstack.grafana.net/api/serviceaccounts \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "terraform-provisioner", "role": "Admin", "isDisabled": false}'

# 2. Mint a token for it
curl -X POST https://yourstack.grafana.net/api/serviceaccounts/{id}/tokens \
  -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"name": "ci-token", "secondsToLive": 0}'

# 3. Verify the token works (test on a harmless endpoint)
curl https://yourstack.grafana.net/api/org \
  -H "Authorization: Bearer <new-token>"
# 200 + org JSON → token works. Anything else → re-check role assignment in step 1.

对应的配置方式（YAML，声明式）：

# provisioning/access-control/service_accounts.yaml
apiVersion: 1
serviceAccounts:
  - name: alloy-writer
    orgId: 1
    role: Editor
    tokens:
      - name: alloy-token

参考资料

• references/sso.md — OAuth / SAML / GitHub OAuth 配置、5 步 SSO 验证模式和常见故障
• references/terraform.md — Terraform 提供程序配置、常见资源模式（团队、用户、文件夹、仪表板）和漂移排查
• references/api-reference.md — 完整的 Cloud API 和 Stack API 端点参考，以及审计日志查询