Deploys Grafana in the observability project via the grafana-operator,
mirroring the puppet Grafana but modernised: CNPG for state and Authentik
OIDC for auth. Ports the live datasource + dashboards in as CRs.
Changes (apps/base/grafana):
- CNPG postgres Cluster + rw Pooler (db grafana), plus VaultAuth +
VaultStaticSecrets pulling postgres/oauth credentials from Vault.
- Grafana CR: postgres backend via the pooler, Authentik generic_oauth
(client id/secret from the Vault-synced secret, openid/email/profile
scopes, group->role mapping), root_url grafana.k8s.syd1.au.unkin.net.
- Single GrafanaDatasource (k8s VictoriaMetrics via the operator vmselect
service); reuses the previous default datasource uid so imported
dashboards resolve without edits.
- 13 GrafanaDashboards (gzipJson) exported from the current grafana.
- Gateway API (traefik-internal) + HTTPRoute for grafana.k8s.syd1.au.unkin.net.
- Register apps/overlays/*/grafana in the observability ApplicationSet and
add the grafana namespace to the project destinations.
