Merge branch 'main' into matei/pod-to-pod-docs

linkerd · Aug 20, 2023 · d3d207d · d3d207d
2 parents a1dc0e2 + 3b57506
commit d3d207d
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 0 deletions.
diff --git a/linkerd.io/content/2-edge/tasks/grafana.md b/linkerd.io/content/2-edge/tasks/grafana.md
@@ -36,6 +36,15 @@ datasource Linkerd Viz' Prometheus instance, sets up a reverse proxy (more on
 that later), and pre-loads all the Linkerd Grafana dashboards that are published
 on <https://grafana.com/orgs/linkerd>.
 
+{{< note >}}
+The access to Linkerd Viz' Prometheus instance is restricted through the
+`prometheus-admin` AuthorizationPolicy, granting access only to the
+`metrics-api` ServiceAccount. In order to also grant access to Grafana, you need
+to add an AuthorizationPolicy pointing to its ServiceAccount. You can apply
+[authzpolicy-grafana.yaml](https://github.com/linkerd/linkerd2/blob/release/stable-2.13/grafana/authzpolicy-grafana.yaml)
+which grants permission for the `grafana` ServiceAccount.
+{{< /note >}}
+
 A more complex and production-oriented source is the [Grafana
 Operator](https://github.com/grafana-operator/grafana-operator). And there are
 also hosted solutions such as [Grafana

diff --git a/linkerd.io/content/2.13/tasks/grafana.md b/linkerd.io/content/2.13/tasks/grafana.md
@@ -36,6 +36,15 @@ datasource Linkerd Viz' Prometheus instance, sets up a reverse proxy (more on
 that later), and pre-loads all the Linkerd Grafana dashboards that are published
 on <https://grafana.com/orgs/linkerd>.
 
+{{< note >}}
+The access to Linkerd Viz' Prometheus instance is restricted through the
+`prometheus-admin` AuthorizationPolicy, granting access only to the
+`metrics-api` ServiceAccount. In order to also grant access to Grafana, you need
+to add an AuthorizationPolicy pointing to its ServiceAccount. You can apply
+[authzpolicy-grafana.yaml](https://github.com/linkerd/linkerd2/blob/release/stable-2.13/grafana/authzpolicy-grafana.yaml)
+which grants permission for the `grafana` ServiceAccount.
+{{< /note >}}
+
 A more complex and production-oriented source is the [Grafana
 Operator](https://github.com/grafana-operator/grafana-operator). And there are
 also hosted solutions such as [Grafana