From 6f62b7873fdacea8807a32e73eea714946f315fc Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sat, 18 Jul 2026 16:24:26 +1000 Subject: [PATCH] Wire Grafana OAuth roles to Authentik ak_groups / akP-grafana-admin (#264) ## Why Consume the two-tier Authentik RBAC from terraform-authentik#7. Grafana should grant Admin to the `akP-grafana-admin` permission group, which `akR-global-admin` members inherit. ## Change - **grafana.yaml** (`auth.generic_oauth`): add `ak_groups` to `scopes`; `role_attribute_path` now keys off `ak_groups` and `akP-grafana-admin` (replaces the flat `grafana-admins`). Non-admins who can log in (gated to `akP-grafana-*` by the Authentik access policy) get Viewer; `role_attribute_strict: false` retained. ## Depends on terraform-authentik#7 (creates `akP-grafana-admin`, the access binding, and the `ak_groups` mapping). ## Validation `kustomize build` (base + overlay) renders; pre-commit clean. Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/264 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- apps/base/grafana/grafana.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/apps/base/grafana/grafana.yaml b/apps/base/grafana/grafana.yaml index 88d363f..1665d71 100644 --- a/apps/base/grafana/grafana.yaml +++ b/apps/base/grafana/grafana.yaml @@ -51,10 +51,13 @@ spec: allow_sign_up: "true" use_pkce: "true" client_id: "grafana" - scopes: "openid email profile" + # ak_groups = hierarchical group claim from terraform-authentik (carries + # permission groups inherited via role groups). + scopes: "openid email profile ak_groups" auth_url: "https://identity.unkin.net/application/o/authorize/" token_url: "https://identity.unkin.net/application/o/token/" api_url: "https://identity.unkin.net/application/o/userinfo/" - # Authentik groups -> Grafana roles (adjust group name as needed). - role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'" + # Authentik permission groups -> Grafana roles. akP-grafana-admin is granted + # to akR-global-admin members (and direct members) via terraform-authentik. + role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'" role_attribute_strict: "false"