argocd-apps/apps/base/grafana/vaultauth.yaml at 4dfa0d52d20ea85cf4690af9f847cd6a54e64db5 - argocd-apps - Gitea

unkin/argocd-apps

Files

T

unkinben 4dfa0d52d2

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/kubeconform Pipeline was successful

Details

grafana: deploy Grafana instance, datasource and dashboards

Deploys Grafana in the observability project via the grafana-operator,
mirroring the puppet Grafana but modernised: CNPG for state and Authentik
OIDC for auth. Ports the live datasource + dashboards in as CRs.

Changes (apps/base/grafana):
- CNPG postgres Cluster + rw Pooler (db grafana), plus VaultAuth +
  VaultStaticSecrets pulling postgres/oauth credentials from Vault.
- Grafana CR: postgres backend via the pooler, Authentik generic_oauth
  (client id/secret from the Vault-synced secret, openid/email/profile
  scopes, group->role mapping), root_url grafana.k8s.syd1.au.unkin.net.
- Single GrafanaDatasource (k8s VictoriaMetrics via the operator vmselect
  service); reuses the previous default datasource uid so imported
  dashboards resolve without edits.
- 13 GrafanaDashboards (gzipJson) exported from the current grafana.
- Gateway API (traefik-internal) + HTTPRoute for grafana.k8s.syd1.au.unkin.net.
- Register apps/overlays/*/grafana in the observability ApplicationSet and
  add the grafana namespace to the project destinations.

2026-07-06 22:15:46 +10:00

19 lines

354 B

YAML

Raw Blame History

 ---
 apiVersion: secrets.hashicorp.com/v1beta1
 kind: VaultAuth
 metadata:
   name: default
   namespace: grafana
 spec:
   allowedNamespaces:
     - grafana
   kubernetes:
     audiences:
       - vault
     role: default
     serviceAccount: default
     tokenExpirationSeconds: 600
   method: kubernetes
   mount: k8s/au/syd1
   vaultConnectionRef: vso-system/default