unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Wire Grafana OAuth roles to Authentik ak_groups / akP-grafana-admin #264

Merged
benvin merged 1 commits from benvin/grafana-akgroups into main 2026-07-18 16:24:27 +10:00
Conversation 0 Commits 1 Files Changed 1
+6 -3
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/base/grafana/grafana.yaml
+6 -3
View File
@@ -51,10 +51,13 @@ spec:
allow_sign_up: "true" allow_sign_up: "true"
use_pkce: "true" use_pkce: "true"
client_id: "grafana" client_id: "grafana"
scopes: "openid email profile" # ak_groups = hierarchical group claim from terraform-authentik (carries
# permission groups inherited via role groups).
scopes: "openid email profile ak_groups"
auth_url: "https://identity.unkin.net/application/o/authorize/" auth_url: "https://identity.unkin.net/application/o/authorize/"
token_url: "https://identity.unkin.net/application/o/token/" token_url: "https://identity.unkin.net/application/o/token/"
api_url: "https://identity.unkin.net/application/o/userinfo/" api_url: "https://identity.unkin.net/application/o/userinfo/"
# Authentik groups -> Grafana roles (adjust group name as needed). # Authentik permission groups -> Grafana roles. akP-grafana-admin is granted
role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'" # to akR-global-admin members (and direct members) via terraform-authentik.
role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'"
role_attribute_strict: "false" role_attribute_strict: "false"