I am using the grafana plugin with Hawkular on OCP. If we dont set the CORS allowed value to all, then the grafana plugin gets AJAX errors due to CORS. As shown by some simple cURL commands below.

Hawkular CORS set to: http://test.com

*/counters/stats examples:
Fails due to Origin mismatch but still returns data - didn't expect to get data back if a 400 is returned... not sure if thats a bug or not. 

localhost:hawkular-client-java garethah$ curl -u admin:admin --header "Hawkular-Tenant: unit-testing" --request GET "http://192.168.99.100:8080/hawkular/metrics/counters/stats?bucketDuration=1d&percentiles=90.0&metrics=noofzsny&stacked=true" --header "Origin: http://bob.com" -vvv

*   Trying 192.168.99.100...
* Connected to 192.168.99.100 (127.0.0.1) port 8080 (#0)
* Server auth using Basic with user 'admin'
> GET /hawkular/metrics/counters/stats?bucketDuration=1d&percentiles=90.0&metrics=noofzsny&stacked=true HTTP/1.1
> Host: 192.168.99.100:8080
> Authorization: Basic YWRtaW46YWRtaW4=
> User-Agent: curl/7.49.1
> Accept: */*
> Hawkular-Tenant: unit-testing
> Origin: http://bob.com
>
< HTTP/1.1 400 Bad Request
< Expires: 0
< Cache-Control: no-cache, no-store, must-revalidate
< X-Powered-By: Undertow/1
< Server: WildFly/10
< Pragma: no-cache
< Date: Mon, 05 Dec 2016 17:25:22 GMT
< Connection: keep-alive
< Content-Type: application/json
< Content-Length: 217
<
* Connection #0 to host 192.168.99.100 left intact
[{"start":1480929922811,"end":1481016322811,"min":-5.3461447394508227E18,"avg":1.13394506239459277E18,"median":1.41820444399757005E18,"max":6.5335287915888394E18,"sum":1.1339450623945933E19,"samples":1,"empty":false}]

Working example with correctly returned Access-Control-Allow-Origin:

localhost:hawkular-client-java garethah$ curl -u admin:admin --header "Hawkular-Tenant: unit-testing" --request GET "http://192.168.99.100:8080/hawkular/metrics/counters/stats?bucketDuration=1d&percentiles=90.0&metrics=noofzsny&stacked=true" --header "Origin: http://test.com" -vvv

*   Trying 192.168.99.100...
* Connected to 192.168.99.100 (127.0.0.1) port 8080 (#0)
* Server auth using Basic with user 'admin'
> GET /hawkular/metrics/counters/stats?bucketDuration=1d&percentiles=90.0&metrics=noofzsny&stacked=true HTTP/1.1
> Authorization: Basic YWRtaW46YWRtaW4=
> User-Agent: curl/7.49.1
> Accept: */*
> Hawkular-Tenant: unit-testing
> Origin: http://test.com
>
< HTTP/1.1 200 OK
< Expires: 0
< Cache-Control: no-cache, no-store, must-revalidate
< X-Powered-By: Undertow/1
< Access-Control-Allow-Headers: origin,accept,content-type,hawkular-tenant
< Server: WildFly/10
< Pragma: no-cache
< Date: Mon, 05 Dec 2016 17:26:13 GMT
< Connection: keep-alive
< Access-Control-Allow-Origin: http://test.com
< Access-Control-Allow-Credentials: true
< Content-Type: application/json
< Content-Length: 217
< Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS, HEAD
< Access-Control-Max-Age: 259200
<
* Connection #0 to host 192.168.99.100 left intact
[{"start":1480929973847,"end":1481016373847,"min":-5.3461447394508227E18,"avg":1.13394506239459277E18,"median":1.41820444399757005E18,"max":6.5335287915888394E18,"sum":1.1339450623945933E19,"samples":1,"empty":false}]

*/counters/raw/query examples:
Gets data but doesn't return any Access-Control-Allow-Origin headers thus will fail in grafana.

localhost:hawkular-client-java garethah$ curl -u admin:admin --header "Hawkular-Tenant: unit-testing" --request POST "http://192.168.99.100:8080/hawkular/metrics/counters/raw/query"  --data "{order:\"ASC\",ids:[\"noofzsny\"]}" --header "Content-Type: application/json" --header "Origin: http://test.com" -vvv

*   Trying 192.168.99.100...
* Connected to 192.168.99.100 (127.0.0.1) port 8080 (#0)
* Server auth using Basic with user 'admin'
> POST /hawkular/metrics/counters/raw/query HTTP/1.1
> Host: 192.168.99.100:8080
> Authorization: Basic YWRtaW46YWRtaW4=
> User-Agent: curl/7.49.1
> Accept: */*
> Hawkular-Tenant: unit-testing
> Content-Type: application/json
> Origin: http://test.com
> Content-Length: 30
>
* upload completely sent off: 30 out of 30 bytes
< HTTP/1.1 200 OK
< Expires: 0
< Cache-Control: no-cache, no-store, must-revalidate
< X-Powered-By: Undertow/1
< Server: WildFly/10
< Pragma: no-cache
< Date: Mon, 05 Dec 2016 17:30:38 GMT
< Connection: keep-alive
< Content-Type: application/json
< Content-Length: 590
<
* Connection #0 to host 192.168.99.100 left intact
[{"id":"noofzsny","data":[{"timestamp":1480943333446,"value":-5346144739450823145},{"timestamp":1480943363446,"value":5257714416350875295},{"timestamp":1480943393446,"value":4269323419475977241},{"timestamp":1480943423446,"value":4996234959867023108},{"timestamp":1480943453446,"value":-4477830536950343320},{"timestamp":1480943483446,"value":3744561193794180662},{"timestamp":1480943513446,"value":-3619119654582223963},{"timestamp":1480943543446,"value":6533528791588839899},{"timestamp":1480943573446,"value":225819548751014015},{"timestamp":1480943603446,"value":-244636774898588607}]}]


Have i missed something in the grafana / hawkular setup? or is this a bug?

Cheers.