unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Wire Grafana OAuth roles to Authentik ak_groups / akP-grafana-admin (#264)

Browse Source 
## Why

Consume the two-tier Authentik RBAC from terraform-authentik#7. Grafana should grant Admin to the `akP-grafana-admin` permission group, which `akR-global-admin` members inherit.

## Change

- **grafana.yaml** (`auth.generic_oauth`): add `ak_groups` to `scopes`; `role_attribute_path` now keys off `ak_groups` and `akP-grafana-admin` (replaces the flat `grafana-admins`). Non-admins who can log in (gated to `akP-grafana-*` by the Authentik access policy) get Viewer; `role_attribute_strict: false` retained.

## Depends on
terraform-authentik#7 (creates `akP-grafana-admin`, the access binding, and the `ak_groups` mapping).

## Validation
`kustomize build` (base + overlay) renders; pre-commit clean.

Reviewed-on: #264
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>
This commit was merged in pull request #264.
This commit is contained in:
Ben Vincent
2026-07-18 16:24:26 +10:00
committed by BenVincent
parent 9bdb328d99
commit 6f62b7873f
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/grafana/grafana.yaml
+6 -3
View File
@@ -51,10 +51,13 @@ spec:
allow_sign_up: "true"
use_pkce: "true"
client_id: "grafana"
scopes: "openid email profile"
# ak_groups = hierarchical group claim from terraform-authentik (carries
# permission groups inherited via role groups).
scopes: "openid email profile ak_groups"
auth_url: "https://identity.unkin.net/application/o/authorize/"
token_url: "https://identity.unkin.net/application/o/token/"
api_url: "https://identity.unkin.net/application/o/userinfo/"
# Authentik groups -> Grafana roles (adjust group name as needed).
role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
# Authentik permission groups -> Grafana roles. akP-grafana-admin is granted
# to akR-global-admin members (and direct members) via terraform-authentik.
role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'"
role_attribute_strict: "false"