Configuring grafana.

kubernetes/apps/monitoring/grafana/app/externalsecret.yaml

@@ -14,15 +14,11 @@ spec:
     template:
       engineVersion: v2
       data:
-        GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "{{ .auth0_generic_client_id }}"
-        GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "{{ .auth0_generic_client_secret }}"
-        GF_AUTH_GENERIC_OAUTH_AUTH_URL: "{{ .auth0_hsn_domain }}/authorize"
-        GF_AUTH_GENERIC_OAUTH_TOKEN_URL: "{{ .auth0_hsn_domain }}/oauth/token"
-        GF_AUTH_GENERIC_OAUTH_API_URL: "{{ .auth0_hsn_domain }}/userinfo"
+        GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "{{ .authentik_grafana_oauth_client_secret }}"
   dataFrom:
     - extract:
-        key: auth0
+        key: Authentik
       rewrite:
         - regexp:
             source: "(.*)"
-            target: "auth0_$1"
+            target: "authentik_$1"

kubernetes/apps/monitoring/grafana/app/helmrelease.yaml

@@ -33,3 +33,66 @@ spec:
     configmap.reloader.stakater.com/reload: grafana
     secret.reloader.stakater.com/reload: grafana-secrets
     replicas: 1
+
+    grafana.ini:
+      analytics:
+        check_for_updates: false
+        check_for_plugin_updates: false
+        reporting_enabled: false
+      auth:
+        oauth_auto_login: true
+        oauth_allow_insecure_email_lookup: true
+        signout_redirect_url: https://authentik.valinor.social/application/o/grafana/end-session/
+      auth.basic:
+        enabled: false
+      auth.generic_oauth:
+        enabled: true
+        name: Authentik
+        icon: signin
+        scopes: openid profile email
+        empty_scopes: false
+        login_attribute_path: preferred_username
+        groups_attribute_path: groups
+        name_attribute_path: name
+        use_pkce: true
+        client_id: X9jnN2z3Ug0l0jgmua4uS6lHTF0HhtYhpdvJq3DC
+        client_secret: # Set by env vars
+        auth_url: https://authentik.valinor.social/application/o/authorize/
+        token_url: https://authentik.valinor.social/application/o/token/
+        api_url: https://authentik.valinor.social/application/o/userinfo/
+        # map user groups to Grafana roles
+        role_attribute_path: |
+          contains(groups[*], 'Grafana admins') && 'Admin' || contains(groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
+      date_formats:
+        use_browser_locale: true
+      explore:
+        enabled: true
+      news:
+        news_feed_enabled: false
+      panels:
+        disable_sanitize_html: true
+      paths:
+        data: /var/lib/grafana/data
+        logs: /var/log/grafana
+        plugins: /var/lib/grafana/plugins
+        provisioning: /etc/grafana/provisioning
+      security:
+        allow_embedding: true
+        cookie_samesite: grafana
+      server:
+        root_url: https://grafana.valinor.social
+    ingress:
+      enabled: true
+      ingressClassName: nginx
+      hosts:
+        - &host grafana.valinor.social
+      tls:
+        - hosts:
+            - *host
+    plugins:
+      - natel-discrete-panel
+      - pr0ps-trackmap-panel
+      - grafana-piechart-panel
+      - vonage-status-panel
+      - grafana-worldmap-panel
+      - grafana-clock-panel