unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Wire Grafana OAuth roles to Authentik ak_groups / akP-grafana-admin #264

Merged
benvin merged 1 commits from benvin/grafana-akgroups into main 2026-07-18 16:24:27 +10:00
Conversation 0 Commits 1 Files Changed 1
+6 -3
unkinben commented 2026-07-18 16:22:04 +10:00
Owner
Copy Link
Copy Source

Why

Consume the two-tier Authentik RBAC from terraform-authentik#7. Grafana should grant Admin to the akP-grafana-admin permission group, which akR-global-admin members inherit.

Change

  • grafana.yaml (auth.generic_oauth): add ak_groups to scopes; role_attribute_path now keys off ak_groups and akP-grafana-admin (replaces the flat grafana-admins). Non-admins who can log in (gated to akP-grafana-* by the Authentik access policy) get Viewer; role_attribute_strict: false retained.

Depends on

terraform-authentik#7 (creates akP-grafana-admin, the access binding, and the ak_groups mapping).

Validation

kustomize build (base + overlay) renders; pre-commit clean.

## Why Consume the two-tier Authentik RBAC from terraform-authentik#7. Grafana should grant Admin to the `akP-grafana-admin` permission group, which `akR-global-admin` members inherit. ## Change - **grafana.yaml** (`auth.generic_oauth`): add `ak_groups` to `scopes`; `role_attribute_path` now keys off `ak_groups` and `akP-grafana-admin` (replaces the flat `grafana-admins`). Non-admins who can log in (gated to `akP-grafana-*` by the Authentik access policy) get Viewer; `role_attribute_strict: false` retained. ## Depends on terraform-authentik#7 (creates `akP-grafana-admin`, the access binding, and the `ak_groups` mapping). ## Validation `kustomize build` (base + overlay) renders; pre-commit clean.
unkinben added 1 commit 2026-07-18 16:22:04 +10:00
Wire Grafana OAuth roles to Authentik ak_groups / akP-grafana-admin
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
1d4bf9de87 
Consume the two-tier Authentik RBAC (terraform-authentik): request the
hierarchical `ak_groups` scope and map `akP-grafana-admin` to the Grafana Admin
role (replacing the flat `grafana-admins`). Members of akR-global-admin inherit
akP-grafana-admin. Everyone else who can log in (gated to akP-grafana-* by the
Authentik access policy) gets Viewer.
benvin merged commit 6f62b7873f into main 2026-07-18 16:24:27 +10:00
benvin deleted branch benvin/grafana-akgroups 2026-07-18 16:24:27 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#264
Delete Branch "benvin/grafana-akgroups"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?