[FEATURE] add CloudWatch plugin

cloudwatch/README.md

@@ -0,0 +1,102 @@
+# CloudWatch Plugin for Perses
+
+## Overview
+
+The CloudWatch plugin queries [Amazon CloudWatch](https://aws.amazon.com/cloudwatch/) metrics through the
+CloudWatch proxy of the Perses server. The server signs the requests with its own AWS identity, optionally assuming
+an IAM role: the browser never receives AWS credentials, and the datasource contains none.
+
+The CloudWatch proxy is disabled by default. A Perses administrator must enable it and allow the regions, accounts and
+roles the datasources can use. See the CloudWatch proxy documentation of Perses.
+
+## Features
+
+- **CloudWatch Datasource**: the region, and optionally the IAM role to assume and the secret holding its external ID.
+- **CloudWatch Time Series Query**: metrics (namespace, metric name, dimensions, statistic, period) and metric math
+  expressions referencing the other queries, with metric discovery in the editor.
+- **CloudWatch Dimension Values Variable**: the values of a dimension in a namespace, for example every `InstanceId`.
+- **Variable Support**: dashboard variables can be used in the namespaces, metric names, dimensions, expressions and
+  legends.
+
+## Datasource
+
+```yaml
+kind: Datasource
+metadata:
+  name: cloudwatch
+  project: production
+spec:
+  plugin:
+    kind: CloudWatchDatasource
+    spec:
+      proxy:
+        kind: CloudWatchProxy
+        spec:
+          region: us-east-1
+          # Optional: the IAM role assumed by the Perses server. Without it, the server uses its own AWS identity.
+          roleArn: arn:aws:iam::123456789012:role/perses-cloudwatch-read
+          # Optional, only with roleArn: the name of the secret holding the external ID in its authorization credentials.
+          externalIdSecret: cloudwatch-external-id
+```
+
+CloudWatch datasources are project or global datasources: the Perses server doesn't allow them in a dashboard.
+
+## Time Series Query
+
+```yaml
+kind: CloudWatchTimeSeriesQuery
+spec:
+  datasource:
+    kind: CloudWatchDatasource
+    name: cloudwatch
+  queries:
+    - id: m1
+      returnData: false
+      metric:
+        namespace: AWS/EC2
+        name: CPUUtilization
+        dimensions:
+          InstanceId: $instance
+        statistic: Average
+        period: 60
+    - id: e1
+      label: CPU x2
+      expression: m1 * 2
+```
+
+- `statistic` is `Average`, `Sum`, `Minimum`, `Maximum`, `SampleCount` or a percentile from `p0` to `p100`.
+- `period` is the minimum period in seconds, a multiple of 60. Like the minimum step of a Prometheus query, it is
+  increased to the step suggested by the panel, and so the series fit in the 10000 datapoints the Perses server
+  returns. For example, a single metric over 7 days is queried with a period of at least 2 minutes.
+- `returnData: false` hides a series only used by an expression.
+- Expressions support the arithmetic and comparison operators and the functions `ABS`, `CEIL`, `FLOOR`, `IF`, `FILL`,
+  `RATE`, `DIFF`, `DIFF_TIME`, `MIN`, `MAX`, `SUM` and `AVG`. `SEARCH`, Metrics Insights queries and Lambda functions
+  are not supported.
+- At most 20 queries, over at most 31 days.
+
+A dimension takes a single value, so use single-value variables in the dimensions: a multi-value variable is replaced by
+a single string, by default in the `(a|b)` format.
+
+## Dimension Values Variable
+
+```yaml
+kind: CloudWatchDimensionValuesVariable
+spec:
+  datasource:
+    kind: CloudWatchDatasource
+    name: cloudwatch
+  namespace: AWS/EC2
+  metricName: CPUUtilization # optional
+  dimensionKey: InstanceId
+  dimensions: # optional filters
+    AutoScalingGroupName: $asg
+```
+
+The options come from `ListMetrics`, which only returns the metrics with data in the last two weeks. The Perses server
+returns at most 1000 metrics: use `metricName` and `dimensions` to narrow the discovery on large accounts.
+
+## Connection test
+
+The CloudWatch proxy only accepts the `GetMetricData` and `ListMetrics` actions sent as `POST` requests, so the generic
+connection test of the datasource editor is not available. Use the metric discovery of the query editor to check the
+datasource.

cloudwatch/cue.mod/module.cue

@@ -0,0 +1,17 @@
+module: "github.com/perses/plugins/cloudwatch@v0"
+language: {
+	version: "v0.17.1"
+}
+source: {
+	kind: "git"
+}
+deps: {
+	"github.com/perses/shared/cue@v0": {
+		v:       "v0.55.0-beta.15"
+		default: true
+	}
+	"github.com/perses/spec/cue@v0": {
+		v:       "v0.3.0-beta.10"
+		default: true
+	}
+}

cloudwatch/go.mod

@@ -0,0 +1,37 @@
+module github.com/perses/plugins/cloudwatch
+
+go 1.27.1
+
+require (
+	github.com/perses/perses v0.55.0-beta.3
+	github.com/perses/spec v0.3.0-beta.10
+	github.com/stretchr/testify v1.12.1
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.5 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/jpillora/backoff v1.0.0 // indirect
+	github.com/muhlemmer/gu v0.3.1 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f // indirect
+	github.com/perses/common v0.31.2 // indirect
+	github.com/prometheus/client_golang v1.24.1 // indirect
+	github.com/prometheus/client_model v0.6.3 // indirect
+	github.com/prometheus/common v0.71.0 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/zitadel/oidc/v3 v3.51.3 // indirect
+	github.com/zitadel/schema v1.3.2 // indirect
+	go.yaml.in/yaml/v2 v2.4.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/net v0.59.0 // indirect
+	golang.org/x/oauth2 v0.37.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
+

cloudwatch/go.sum

@@ -0,0 +1,62 @@
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA=
+github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
+github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
+github.com/muhlemmer/gu v0.3.1 h1:7EAqmFrW7n3hETvuAdmFmn4hS8W+z3LgKtrnow+YzNM=
+github.com/muhlemmer/gu v0.3.1/go.mod h1:YHtHR+gxM+bKEIIs7Hmi9sPT3ZDUvTN/i88wQpZkrdM=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f h1:KUppIJq7/+SVif2QVs3tOP0zanoHgBEVAwHxUSIzRqU=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/nexucis/lamenv v0.5.2 h1:tK/u3XGhCq9qIoVNcXsK9LZb8fKopm0A5weqSRvHd7M=
+github.com/nexucis/lamenv v0.5.2/go.mod h1:HusJm6ltmmT7FMG8A750mOLuME6SHCsr2iFYxp5fFi0=
+github.com/perses/common v0.31.2 h1:klsl0KfWn6wVVG4rDJvsTvFO8Owf5ed4nj2VjbQST60=
+github.com/perses/common v0.31.2/go.mod h1:KgLB0ojBFzg93UwTNK8uAE1yuGexBiwqHiAvTFcHRDI=
+github.com/perses/perses v0.55.0-beta.3 h1:LMTE3/SnPGDpKMc58MVUufxTH9tehvCFJtx3E5d9F74=
+github.com/perses/perses v0.55.0-beta.3/go.mod h1:0UJkSSi6uH2DssOjY8BHnn3kjvnbj3ukAblF1R8K0Lw=
+github.com/perses/spec v0.3.0-beta.10 h1:DWqHHP3TIq0ekDZpdK6lqV394K6tWC5ZdYq1nO25spw=
+github.com/perses/spec v0.3.0-beta.10/go.mod h1:p08A4KJtH/7yP/nWdf7As/l0RE74kTYLKIP/8mvqC9E=
+github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
+github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
+github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
+github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM=
+github.com/prometheus/common v0.71.0 h1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8=
+github.com/prometheus/common v0.71.0/go.mod h1:CLJ5H8TEsGX8bl31BdMkfhIZ+QmZ9tBPPotUxUbfcmk=
+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
+github.com/zitadel/oidc/v3 v3.51.3 h1:jkEQ2k60amW6vwvzMwrGO7mw7vGxNp6BSsEH0AH6Gas=
+github.com/zitadel/oidc/v3 v3.51.3/go.mod h1:KQmYte+zOePAeVwR3LM153dxWBC9orWZAIa4w9r1ZhU=
+github.com/zitadel/schema v1.3.2 h1:gfJvt7dOMfTmxzhscZ9KkapKo3Nei3B6cAxjav+lyjI=
+github.com/zitadel/schema v1.3.2/go.mod h1:IZmdfF9Wu62Zu6tJJTH3UsArevs3Y4smfJIj3L8fzxw=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
+go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
+golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues=
+golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

cloudwatch/package.json

@@ -0,0 +1,77 @@
+{
+  "name": "@perses-dev/cloudwatch-plugin",
+  "version": "0.1.0-beta.0",
+  "license": "Apache-2.0",
+  "homepage": "https://github.com/perses/plugins/blob/main/README.md",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/perses/plugins.git"
+  },
+  "bugs": {
+    "url": "https://github.com/perses/plugins/issues"
+  },
+  "scripts": {
+    "dev": "rsbuild dev",
+    "build": "npm run build-mf && concurrently \"npm:build:*\"",
+    "build-mf": "rsbuild build",
+    "build:esm": "swc ./src -d dist/lib --strip-leading-paths --config-file ../.swcrc",
+    "build:types": "tsc --project tsconfig.build.json",
+    "lint": "oxlint src",
+    "test": "cross-env LC_ALL=C TZ=UTC vitest run",
+    "type-check": "tsc --noEmit"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "module": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "dependencies": {},
+  "peerDependencies": {
+    "@perses-dev/client": "^0.55.0-beta.15",
+    "@perses-dev/components": "^0.55.0-beta.15",
+    "@perses-dev/plugin-system": "^0.55.0-beta.15",
+    "@perses-dev/spec": "^0.3.0-beta.10",
+    "immer": "^10.1.1",
+    "react": "^18.3.0",
+    "react-dom": "^18.3.0"
+  },
+  "devDependencies": {},
+  "files": [
+    "lib/**/*",
+    "__mf/**/*",
+    "mf-manifest.json",
+    "mf-stats.json"
+  ],
+  "perses": {
+    "moduleName": "CloudWatch",
+    "schemasPath": "schemas",
+    "plugins": [
+      {
+        "kind": "Datasource",
+        "spec": {
+          "display": {
+            "name": "CloudWatch Datasource"
+          },
+          "name": "CloudWatchDatasource"
+        }
+      },
+      {
+        "kind": "TimeSeriesQuery",
+        "spec": {
+          "display": {
+            "name": "CloudWatch Time Series Query"
+          },
+          "name": "CloudWatchTimeSeriesQuery"
+        }
+      },
+      {
+        "kind": "Variable",
+        "spec": {
+          "display": {
+            "name": "CloudWatch Dimension Values Variable"
+          },
+          "name": "CloudWatchDimensionValuesVariable"
+        }
+      }
+    ]
+  }
+}

cloudwatch/rsbuild.config.ts

@@ -0,0 +1,37 @@
+// Copyright The Perses Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { pluginReact } from '@rsbuild/plugin-react';
+
+import { createConfigForPlugin } from '../rsbuild.shared';
+
+export default createConfigForPlugin({
+  name: 'CloudWatch',
+  rsbuildConfig: {
+    server: { port: 3136 },
+    plugins: [pluginReact()],
+  },
+  moduleFederation: {
+    exposes: {
+      './CloudWatchDatasource': './src/datasources/cloudwatch-datasource',
+      './CloudWatchTimeSeriesQuery': './src/queries/cloudwatch-time-series-query',
+      './CloudWatchDimensionValuesVariable': './src/variables/cloudwatch-dimension-values-variable',
+    },
+    shared: {
+      react: { requiredVersion: '18.2.0', singleton: true },
+      immer: { singleton: true },
+      '@perses-dev/components': { singleton: true },
+      '@perses-dev/plugin-system': { singleton: true },
+    },
+  },
+});

cloudwatch/schemas/datasources/cloudwatch/cloudwatch.cue

@@ -0,0 +1,28 @@
+// Copyright The Perses Authors
+// Licensed under the Apache License, Version 2.0 (the \"License\");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an \"AS IS\" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package model
+
+import (
+	"github.com/perses/shared/cue/common"
+	"github.com/perses/spec/cue/datasource"
+)
+
+#kind: "CloudWatchDatasource"
+
+kind: #kind
+spec: {
+	datasource.#CloudWatchDatasourceSpec
+}
+
+#selector: common.#datasourceSelector & {_kind: #kind}

cloudwatch/schemas/datasources/cloudwatch/tests/invalid/external-id-without-role.json

@@ -0,0 +1,12 @@
+{
+  "kind": "CloudWatchDatasource",
+  "spec": {
+    "proxy": {
+      "kind": "CloudWatchProxy",
+      "spec": {
+        "region": "us-east-1",
+        "externalIdSecret": "cloudwatch-external-id"
+      }
+    }
+  }
+}

cloudwatch/schemas/datasources/cloudwatch/tests/invalid/static-credentials.json

@@ -0,0 +1,12 @@
+{
+  "kind": "CloudWatchDatasource",
+  "spec": {
+    "proxy": {
+      "kind": "CloudWatchProxy",
+      "spec": {
+        "region": "us-east-1",
+        "accessKeyId": "AKIAEXAMPLE"
+      }
+    }
+  }
+}