Skip to content

Commit f974da2

Browse files
d3adb5d3adb5
committed
feat(grafana): authenticate with keycloak via oidc
Authenticate against Keycloak via OIDC and disable persistence, as this Grafana instance should be configured declaratively.
1 parent 31d3827 commit f974da2

File tree

5 files changed

+106
-68
lines changed

5 files changed

+106
-68
lines changed

‎argo/app-of-apps/templates/monitoring/kube-prometheus-stack.yaml‎

Lines changed: 97 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -7,85 +7,114 @@ metadata:
77
spec:
88
project: monitoring
99

10-
source:
11-
repoURL: ghcr.io/prometheus-community/charts
12-
chart: kube-prometheus-stack
13-
targetRevision: 77.0.0
10+
sources:
11+
- repoURL: {{ .Values.repository.url }}
12+
targetRevision: {{ .Values.repository.targetRevision }}
13+
path: argo/monitoring
1414

15-
helm:
16-
valuesObject:
17-
crds:
18-
enabled: true
19-
upgradeJob:
20-
enabled: false
21-
kube-state-metrics:
22-
resources:
23-
limits:
24-
cpu: 100m
25-
memory: 64Mi
26-
requests:
27-
cpu: 10m
28-
memory: 32Mi
29-
prometheus-node-exporter:
30-
resources:
31-
limits:
32-
cpu: 100m
33-
memory: 64Mi
34-
requests:
35-
cpu: 10m
36-
memory: 32Mi
37-
prometheus:
38-
prometheusSpec:
39-
storageSpec:
40-
volumeClaimTemplate:
41-
spec:
42-
storageClassName: truenas-iscsi-hdd
43-
accessModes:
44-
- ReadWriteOnce
45-
resources:
46-
requests:
47-
storage: 20Gi
48-
grafana:
49-
persistence:
50-
enabled: true
51-
storageClassName: truenas-iscsi-hdd
52-
size: 2Gi
53-
ingress:
54-
enabled: true
55-
ingressClassName: nginx
56-
annotations:
57-
cert-manager.io/cluster-issuer: "letsencrypt"
58-
hosts:
59-
- grafana.d3adb5.ca
60-
tls:
61-
- hosts:
62-
- grafana.d3adb5.ca
63-
secretName: grafana-tls
64-
resources:
65-
limits:
66-
cpu: 250m
67-
memory: 512Mi
68-
requests:
69-
cpu: 20m
70-
memory: 512Mi
15+
- repoURL: ghcr.io/prometheus-community/charts
16+
chart: kube-prometheus-stack
17+
targetRevision: 77.0.0
7118

72-
sidecar:
19+
helm:
20+
valuesObject:
21+
crds:
22+
enabled: true
23+
upgradeJob:
24+
enabled: false
25+
kube-state-metrics:
7326
resources:
7427
limits:
75-
cpu: 200m
76-
memory: 128Mi
28+
cpu: 100m
29+
memory: 64Mi
7730
requests:
7831
cpu: 10m
79-
memory: 128Mi
80-
81-
initChownData:
32+
memory: 32Mi
33+
prometheus-node-exporter:
8234
resources:
8335
limits:
84-
cpu: 10m
85-
memory: 32Mi
36+
cpu: 100m
37+
memory: 64Mi
8638
requests:
8739
cpu: 10m
8840
memory: 32Mi
41+
prometheus:
42+
prometheusSpec:
43+
storageSpec:
44+
volumeClaimTemplate:
45+
spec:
46+
storageClassName: truenas-iscsi-hdd
47+
accessModes:
48+
- ReadWriteOnce
49+
resources:
50+
requests:
51+
storage: 20Gi
52+
grafana:
53+
persistence:
54+
enabled: false
55+
ingress:
56+
enabled: true
57+
ingressClassName: nginx
58+
annotations:
59+
cert-manager.io/cluster-issuer: "letsencrypt"
60+
hosts:
61+
- grafana.d3adb5.ca
62+
tls:
63+
- hosts:
64+
- grafana.d3adb5.ca
65+
secretName: grafana-tls
66+
envValueFrom:
67+
GRAFANA_OAUTH_CLIENT_ID:
68+
secretKeyRef:
69+
name: grafana-oidc-secrets
70+
key: client-id
71+
GRAFANA_OAUTH_CLIENT_SECRET:
72+
secretKeyRef:
73+
name: grafana-oidc-secrets
74+
key: client-secret
75+
grafana.ini:
76+
server:
77+
root_url: https://grafana.d3adb5.ca
78+
auth.generic_oauth:
79+
enabled: true
80+
name: Keycloak
81+
allow_sign_up: true
82+
client_id: "${GRAFANA_OAUTH_CLIENT_ID}"
83+
client_secret: "${GRAFANA_OAUTH_CLIENT_SECRET}"
84+
scopes: openid email profile offline_access roles groups
85+
email_attribute_path: email
86+
login_attribute_path: username
87+
name_attribute_path: full_name
88+
auth_url: https://id.d3adb5.ca/realms/core/protocol/openid-connect/auth
89+
token_url: https://id.d3adb5.ca/realms/core/protocol/openid-connect/token
90+
api_url: https://id.d3adb5.ca/realms/core/protocol/openid-connect/userinfo
91+
role_attribute_path: >-
92+
contains(groups[*], 'Admin') && 'Admin'
93+
|| contains(groups[*], 'Grafana') && Editor
94+
|| 'Viewer'
95+
96+
resources:
97+
limits:
98+
memory: 512Mi
99+
requests:
100+
cpu: 20m
101+
memory: 512Mi
102+
103+
sidecar:
104+
resources:
105+
limits:
106+
memory: 128Mi
107+
requests:
108+
cpu: 10m
109+
memory: 128Mi
110+
111+
initChownData:
112+
resources:
113+
limits:
114+
memory: 32Mi
115+
requests:
116+
cpu: 10m
117+
memory: 32Mi
89118

90119
destination:
91120
server: https://kubernetes.default.svc

‎argo/app-of-apps/templates/projects/monitoring.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ spec:
99

1010
sourceRepos:
1111
- ghcr.io/prometheus-community/charts
12+
- {{ .Values.repository.url }}
1213

1314
destinations:
1415
- namespace: {{ .Values.monitoring.namespace }}

‎argo/monitoring/oidc-secrets.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: bitnami.com/v1alpha1
2+
kind: SealedSecret
3+
metadata:
4+
name: grafana-oidc-secrets
5+
spec:
6+
encryptedData:
7+
client-secret: AgC6yIiC4r9wE5UkpHdaavDrDWZzLUH1/l1VYkT4ez655478MXkP2q/o7VZQBKzKtgm/sOXO5+VHLGmeyq8fFK3hoJE4ftjycvnhsdJekXZzg6ijFV1kjX+BI7cHB0ZXy0JtLvXeADEC6obkAb7nN4z9yUiGO7lU8SV1odbz/t6TbtcaV/X5tCNpPDfbypuZTE6t/tiHO4Q/ktWbM6WH9iixzS6rKhWrSlLE7NojQlBVrX+ISHkCFkivIIXceO0qb0KZ/KabjudbKCBOOLF39kHPebyXWE+JmGj+M1O571qBxvkdzMaz54kVImnLDbhe3ooCcK59rVeN9oEQSPA4nan4k/yDkFSJ8tELxA6nbzq/dnW7LeDqJvhfAun1pqAXt8J2mF3S5LgAFRXXg1rBCDf1QkyWwMxDKKa34NqcKo9yRsuy9T4koAaX6wraYTbTnZ6p1ica4I/nLJCNIe7tIrsiu0A7d0U2FHZHVge2dUzz3V6DI8Q/K/HMQxCe20UsTcoGyQHOtUfrlm6S8+XxmekS/q/TDw8nOxQoiwahawh19SzwAL6i/MHWW3RV53EgSwudUTMe7w85dwXDvFc1489KLKmFpPpPJpyGuQq8o5QaEHFikrTqhGGOfh3dkoEx+WZ+QY4fPZJ2y4O726D/B5e+DElrxPpoXZrIT3ZLWkOiQlzD/t28c3b5aAZgslUQWTG0fS/xtA5jPG7Co4BZWs+Xyu6AlgahiSjTVVpgZZCVfg==
8+
client-id: AgAxh2GgZNEstzl9C07D3Ak6mJjezhuiHnEF1B6V8JdOuK/iDFa395uqOFHn4FqNtJ4Oj/VKpj/wBvUQkEnjR7qJmXcf+gj0JH/L8Of28YXsOu685GrqeFfeK7BPLJmT9G0/nCt3t8uWhizOagbc8ZnppuaI4CJb5FbAYaQxMnX+l8TR0AAuw31umIueZwRyX0Xfjj+pf9bCjJ2Pl19kWpvUwwniLRjG3kERz8qi6qMgLpsPx2rReALTt37OCsR8+7Tlvzt4R1Em1n6rKvow717rM0ISMhuIpkbK9MU6NzuH4oatDYTpFrMIiDKUHS34lWSus3MzlG6qfM4FY5MI2LWKcr5gZfPpDPqXEW2a9yBV7KfsPXPWf0n+fQkTg/xDZhr3u2jPOmCp8BJjHnvkCssnI5d9wP0IAa7B9CRiXM+jG9url3VVfipnrlO/l/H1ppdMKOLLrLMTVb6+CYHCOve8LVXvrPxnIBvyTq86xNNfesIaye6/Z5U7Xj8YNsZB7HSowzY7xqx1LlZGhY91g/qR2kqxDs/pXEU1ynHwgT/C6DsxVYOtHRREEGUPetbBQhpWq4GCk6fGxgB40Jh47nwkclZpB2x1q8sF8mFvSjmMTG+6GJ/JqLOu1o1gDHAePSglwEbsyewA7OZgAPDjbAfEydy9WSzj9EvERNW3L8BFMVuasNiyrqziF/rt9fFc8pn+AX48eRb6

‎terraform/keycloak/terraform.auto.tfvars‎

214 Bytes
Binary file not shown.

‎terraform/keycloak/terraform.tfstate‎

5.76 KB
Binary file not shown.

0 commit comments

Comments
 (0)