unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Wire Grafana OAuth roles to Authentik ak_groups / akP-grafana-admin #264

Merged
benvin merged 1 commits from benvin/grafana-akgroups into main 2026-07-18 16:24:27 +10:00
Conversation 0 Commits 1 Files Changed 1
+6 -3
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/grafana/grafana.yaml
+6 -3
View File
@@ -51,10 +51,13 @@ spec:
allow_sign_up: "true"
use_pkce: "true"
client_id: "grafana"
scopes: "openid email profile"
# ak_groups = hierarchical group claim from terraform-authentik (carries
# permission groups inherited via role groups).
scopes: "openid email profile ak_groups"
auth_url: "https://identity.unkin.net/application/o/authorize/"
token_url: "https://identity.unkin.net/application/o/token/"
api_url: "https://identity.unkin.net/application/o/userinfo/"
# Authentik groups -> Grafana roles (adjust group name as needed).
role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
# Authentik permission groups -> Grafana roles. akP-grafana-admin is granted
# to akR-global-admin members (and direct members) via terraform-authentik.
role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'"
role_attribute_strict: "false"