From 1d4bf9de8779a32fa01e2d4aa0b79fd62f03d25e Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 18 Jul 2026 16:21:50 +1000 Subject: [PATCH] Wire Grafana OAuth roles to Authentik ak_groups / akP-grafana-admin Consume the two-tier Authentik RBAC (terraform-authentik): request the hierarchical `ak_groups` scope and map `akP-grafana-admin` to the Grafana Admin role (replacing the flat `grafana-admins`). Members of akR-global-admin inherit akP-grafana-admin. Everyone else who can log in (gated to akP-grafana-* by the Authentik access policy) gets Viewer. --- apps/base/grafana/grafana.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/apps/base/grafana/grafana.yaml b/apps/base/grafana/grafana.yaml index 88d363f..1665d71 100644 --- a/apps/base/grafana/grafana.yaml +++ b/apps/base/grafana/grafana.yaml @@ -51,10 +51,13 @@ spec: allow_sign_up: "true" use_pkce: "true" client_id: "grafana" - scopes: "openid email profile" + # ak_groups = hierarchical group claim from terraform-authentik (carries + # permission groups inherited via role groups). + scopes: "openid email profile ak_groups" auth_url: "https://identity.unkin.net/application/o/authorize/" token_url: "https://identity.unkin.net/application/o/token/" api_url: "https://identity.unkin.net/application/o/userinfo/" - # Authentik groups -> Grafana roles (adjust group name as needed). - role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'" + # Authentik permission groups -> Grafana roles. akP-grafana-admin is granted + # to akR-global-admin members (and direct members) via terraform-authentik. + role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'" role_attribute_strict: "false"