unkinben
4dfa0d52d2
Deploys Grafana in the observability project via the grafana-operator, mirroring the puppet Grafana but modernised: CNPG for state and Authentik OIDC for auth. Ports the live datasource + dashboards in as CRs. Changes (apps/base/grafana): - CNPG postgres Cluster + rw Pooler (db grafana), plus VaultAuth + VaultStaticSecrets pulling postgres/oauth credentials from Vault. - Grafana CR: postgres backend via the pooler, Authentik generic_oauth (client id/secret from the Vault-synced secret, openid/email/profile scopes, group->role mapping), root_url grafana.k8s.syd1.au.unkin.net. - Single GrafanaDatasource (k8s VictoriaMetrics via the operator vmselect service); reuses the previous default datasource uid so imported dashboards resolve without edits. - 13 GrafanaDashboards (gzipJson) exported from the current grafana. - Gateway API (traefik-internal) + HTTPRoute for grafana.k8s.syd1.au.unkin.net. - Register apps/overlays/*/grafana in the observability ApplicationSet and add the grafana namespace to the project destinations.
61 lines
1.9 KiB
YAML
61 lines
1.9 KiB
YAML
---
|
|
apiVersion: grafana.integreatly.org/v1beta1
|
|
kind: Grafana
|
|
metadata:
|
|
name: grafana
|
|
namespace: grafana
|
|
labels:
|
|
dashboards: "grafana"
|
|
spec:
|
|
deployment:
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: grafana
|
|
env:
|
|
# DB password + OAuth client secret injected from the
|
|
# Vault-synced secrets (GF_ env overrides grafana.ini).
|
|
- name: GF_DATABASE_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: postgres-credentials
|
|
key: password
|
|
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: oauth-credentials
|
|
key: client_secret
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
config:
|
|
server:
|
|
root_url: "https://grafana.k8s.syd1.au.unkin.net"
|
|
database:
|
|
type: "postgres"
|
|
host: "postgres-pooler-rw.grafana.svc.cluster.local:5432"
|
|
name: "grafana"
|
|
user: "grafana"
|
|
ssl_mode: "require"
|
|
auth:
|
|
disable_login_form: "false"
|
|
oauth_auto_login: "false"
|
|
"auth.generic_oauth":
|
|
enabled: "true"
|
|
name: "Authentik"
|
|
allow_sign_up: "true"
|
|
use_pkce: "true"
|
|
client_id: "grafana"
|
|
scopes: "openid email profile"
|
|
auth_url: "https://identity.unkin.net/application/o/authorize/"
|
|
token_url: "https://identity.unkin.net/application/o/token/"
|
|
api_url: "https://identity.unkin.net/application/o/userinfo/"
|
|
# Authentik groups -> Grafana roles (adjust group name as needed).
|
|
role_attribute_path: "contains(groups[*], 'grafana-admins') && 'Admin' || 'Viewer'"
|
|
role_attribute_strict: "false"
|