unkin/argocd-apps
2
0
Fork 0
Code Issues 2 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

grafana: deploy Grafana instance, datasource and dashboards #238

Merged
benvin merged 1 commits from benvin/grafana-instance into main 2026-07-06 23:54:52 +10:00
Conversation 0 Commits 1 Files Changed 26
+533
unkinben commented 2026-07-06 22:16:04 +10:00
Owner
Copy Link
Copy Source

Why

Deploys Grafana in-cluster (observability project) via the grafana-operator, mirroring the puppet Grafana but modernised — CNPG for state, Authentik OIDC for auth — and ports the live datasource + dashboards in as CRs.

Depends on: grafana-operator (#235, merged), grafana schemas (#236, merged), Authentik OIDC (terraform-authentik #2), Vault seeds (done), and ^grafana/ image proxy (terraform-artifactapi #5).

Changes (apps/base/grafana)

  • CNPG postgres Cluster + rw Pooler (db grafana); VaultAuth + VaultStaticSecrets pulling postgres/oauth credentials from kv/kubernetes/namespace/grafana/default/*.
  • Grafana CR: postgres backend via the pooler; Authentik generic_oauth (client id/secret from the Vault-synced secret, openid/email/profile scopes, group→role mapping); root_url grafana.k8s.syd1.au.unkin.net.
  • 1 GrafanaDatasource — k8s VictoriaMetrics via the operator vmselect-main service; reuses the previous default datasource uid so the imported dashboards resolve unedited.
  • 13 GrafanaDashboards (gzipJson) exported from the current grafana.
  • Gateway API (traefik-internal) + HTTPRoute for grafana.k8s.syd1.au.unkin.net.
  • Registered in the observability ApplicationSet + project.

Review notes

  • OAuth role_attribute_path maps Authentik group grafana-admins → Admin, else Viewer — confirm the group name.
  • database.ssl_mode: require against the CNPG pooler — adjust if the pooler isn't serving TLS.
  • The VictoriaLogs - cluster dashboard has no in-cluster logs datasource yet (no VictoriaLogs in k8s) — included for completeness, will be empty until one exists.
  • make kubeconform clean (24 resources, validated against the strict grafana schemas).
## Why Deploys Grafana in-cluster (observability project) via the grafana-operator, mirroring the puppet Grafana but modernised — **CNPG** for state, **Authentik OIDC** for auth — and ports the live datasource + dashboards in as CRs. Depends on: grafana-operator (#235, merged), grafana schemas (#236, merged), Authentik OIDC (terraform-authentik #2), Vault seeds (done), and `^grafana/` image proxy (terraform-artifactapi #5). ## Changes (`apps/base/grafana`) - **CNPG** postgres Cluster + rw Pooler (db `grafana`); **VaultAuth** + **VaultStaticSecrets** pulling `postgres`/`oauth` credentials from `kv/kubernetes/namespace/grafana/default/*`. - **Grafana CR**: postgres backend via the pooler; Authentik `generic_oauth` (client id/secret from the Vault-synced secret, openid/email/profile scopes, group→role mapping); `root_url` grafana.k8s.syd1.au.unkin.net. - **1 GrafanaDatasource** — k8s VictoriaMetrics via the operator `vmselect-main` service; reuses the previous default datasource uid so the imported dashboards resolve unedited. - **13 GrafanaDashboards** (gzipJson) exported from the current grafana. - **Gateway API** (traefik-internal) + HTTPRoute for grafana.k8s.syd1.au.unkin.net. - Registered in the observability ApplicationSet + project. ## Review notes - OAuth `role_attribute_path` maps Authentik group `grafana-admins` → Admin, else Viewer — **confirm the group name**. - `database.ssl_mode: require` against the CNPG pooler — adjust if the pooler isn't serving TLS. - The `VictoriaLogs - cluster` dashboard has no in-cluster logs datasource yet (no VictoriaLogs in k8s) — included for completeness, will be empty until one exists. - `make kubeconform` clean (24 resources, validated against the strict grafana schemas).
unkinben added 1 commit 2026-07-06 22:16:04 +10:00
grafana: deploy Grafana instance, datasource and dashboards
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
4dfa0d52d2 
Deploys Grafana in the observability project via the grafana-operator,
mirroring the puppet Grafana but modernised: CNPG for state and Authentik
OIDC for auth. Ports the live datasource + dashboards in as CRs.

Changes (apps/base/grafana):
- CNPG postgres Cluster + rw Pooler (db grafana), plus VaultAuth +
  VaultStaticSecrets pulling postgres/oauth credentials from Vault.
- Grafana CR: postgres backend via the pooler, Authentik generic_oauth
  (client id/secret from the Vault-synced secret, openid/email/profile
  scopes, group->role mapping), root_url grafana.k8s.syd1.au.unkin.net.
- Single GrafanaDatasource (k8s VictoriaMetrics via the operator vmselect
  service); reuses the previous default datasource uid so imported
  dashboards resolve without edits.
- 13 GrafanaDashboards (gzipJson) exported from the current grafana.
- Gateway API (traefik-internal) + HTTPRoute for grafana.k8s.syd1.au.unkin.net.
- Register apps/overlays/*/grafana in the observability ApplicationSet and
  add the grafana namespace to the project destinations.
benvin merged commit 95c5d71222 into main 2026-07-06 23:54:52 +10:00
benvin deleted branch benvin/grafana-instance 2026-07-06 23:54:52 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#238
Delete Branch "benvin/grafana-instance"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?