Initial commit

infrastructure/grafana/values.yaml

@@ -0,0 +1,141 @@
+# values/grafana.values.yaml
+
+# --- Admin credentials via Vault/ESO ---
+# Admin username & password are stored in Vault at:
+#   secret/grafana-admin
+# and pulled into a K8s Secret grafana-admin-secret by ExternalSecret.
+# admin:
+#   existingSecret: grafana-admin-secret
+#   userKey: admin-user
+#   passwordKey: admin-password
+
+# These plain values are ignored when existingSecret is set, but leave
+# them harmless defaults so you can still helm template without ESO.
+adminUser: admin
+adminPassword: "admin"
+
+# --- Deployment annotations for Reloader ---
+# Automatically restart Grafana when secrets change
+# Note: Unpoller has its own Reloader annotation in unpoller namespace
+deploymentAnnotations:
+  secret.reloader.stakater.com/reload: "grafana-authentik-oauth,grafana-teslamate-datasource"
+
+# --- Persistence for dashboards and config ---
+persistence:
+  enabled: true
+  type: pvc
+  storageClassName: rook-ceph-block
+  accessModes:
+    - ReadWriteOnce
+  size: 10Gi
+
+# --- Service type ---
+service:
+  type: ClusterIP
+  # Security context for Talos compatibility
+  securityContext:
+    runAsUser: 472
+    runAsGroup: 472
+    runAsNonRoot: true
+    fsGroup: 472
+
+# --- Ingress disabled - Istio VirtualService handles routing ---
+ingress:
+  enabled: false
+
+# --- Authentik OIDC Integration ---
+# ============================================================================
+# AUTOMATIC ADMIN ACCESS - BOOTSTRAP READY
+# ============================================================================
+# Role mapping assigns Grafana roles based on Authentik group membership:
+#
+#   Authentik Group       → Grafana Role
+#   ─────────────────────────────────────────────────────────
+#   authentik Admins      → Admin (full access) - AUTOMATIC!
+#   Grafana Admins        → Admin (full access)
+#   Grafana Editors       → Editor (can edit dashboards)
+#   Grafana Viewers       → Viewer (read-only)
+#   (any other user)      → Viewer (read-only)
+#
+# BOOTSTRAP BEHAVIOR:
+#   ✓ authentik Admins get automatic Grafana admin access (no manual config!)
+#   ✓ Groups auto-created by Authentik blueprint during bootstrap
+#   ✓ Add users to groups in Authentik UI for access control
+#
+# TO GRANT ADMIN ACCESS TO OTHER USERS:
+#   1. Log into Authentik at https://auth.kube.huskypup.net
+#   2. Go to Directory → Groups → "Grafana Admins"
+#   3. Add users to the group
+#   4. Users log out/in to Grafana to receive admin role
+# ============================================================================
+grafana.ini:
+  server:
+    root_url: https://grafana.kube.huskypup.net
+  auth.generic_oauth:
+    enabled: true
+    name: Authentik
+    scopes: openid profile email
+    auth_url: https://auth.kube.huskypup.net/application/o/authorize/
+    token_url: https://auth.kube.huskypup.net/application/o/token/
+    api_url: https://auth.kube.huskypup.net/application/o/userinfo/
+    # Role mapping: authentik Admins OR Grafana Admins → Admin, Grafana Editors → Editor, else → Viewer
+    role_attribute_path: contains(groups[*], 'authentik Admins') && 'Admin' || contains(groups[*], 'Grafana Admins') && 'Admin' || contains(groups[*], 'Grafana Editors') && 'Editor' || 'Viewer'
+    allow_sign_up: true
+    client_id: $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_ID}
+    client_secret: $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
+
+
+# Load OAuth credentials and datasource passwords from secrets as environment variables
+envFromSecrets:
+  - name: grafana-authentik-oauth
+  - name: grafana-teslamate-datasource
+
+
+
+# --- Datasources ---
+datasources:
+  datasources.yaml:
+    apiVersion: 1
+    datasources:
+      - name: Prometheus
+        type: prometheus
+        uid: Prometheus
+        url: http://kube-prometheus-stack-prometheus.prometheus.svc.cluster.local:9090
+        access: proxy
+        isDefault: true
+      - name: TeslaMate
+        type: grafana-postgresql-datasource
+        uid: TeslaMate
+        url: pg-teslamate-rw.teslamate.svc.cluster.local:5432
+        database: teslamate
+        user: teslamate
+        access: proxy
+        isDefault: false
+        editable: true
+        secureJsonData:
+          password: $__env{TESLAMATE_DB_PASSWORD}
+        jsonData:
+          sslmode: disable
+          postgresVersion: 1600
+          timescaledb: false
+          database: teslamate
+
+# --- Sidecar to auto-discover dashboards from ConfigMaps ---
+# Dashboards are deployed as ConfigMaps with the label grafana_dashboard: "1"
+# The sidecar automatically discovers them and loads them into Grafana
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+
+sidecar:
+  dashboards:
+    enabled: true
+    label: grafana_dashboard
+    labelValue: "1"
+    folder: /var/lib/grafana/dashboards
+    searchNamespace: ALL
+    defaultFolderName: "General"
+    provider:
+      foldersFromFilesStructure: true