68 lines
2.5 KiB
Terraform
68 lines
2.5 KiB
Terraform
|
locals {
|
||
|
|
grafana_oidc_redirect_uri = "${trim(var.grafana_base_url, "/")}/login/generic_oauth"
|
||
|
|
|
||
|
|
grafana_zitadel_roles = {
|
||
|
|
grafana_viewer = {
|
||
|
|
display_name = "Grafana viewer"
|
||
|
|
group = "Grafana"
|
||
|
|
}
|
||
|
|
grafana_editor = {
|
||
|
|
display_name = "Grafana editor"
|
||
|
|
group = "Grafana"
|
||
|
|
}
|
||
|
|
grafana_admin = {
|
||
|
|
display_name = "Grafana administrator"
|
||
|
|
group = "Grafana"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
grafana_zitadel_role_keys = keys(local.grafana_zitadel_roles)
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "zitadel_project_role" "grafana" {
|
||
|
|
for_each = local.grafana_zitadel_roles
|
||
|
|
|
||
|
|
org_id = zitadel_org.primary.id
|
||
|
|
project_id = zitadel_project.services.id
|
||
|
|
role_key = each.key
|
||
|
|
display_name = each.value.display_name
|
||
|
|
group = each.value.group
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "zitadel_application_oidc" "grafana" {
|
||
|
|
org_id = zitadel_org.primary.id
|
||
|
|
project_id = zitadel_project.services.id
|
||
|
|
name = "Grafana"
|
||
|
|
redirect_uris = [local.grafana_oidc_redirect_uri]
|
||
|
|
response_types = ["OIDC_RESPONSE_TYPE_CODE"]
|
||
|
|
grant_types = ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"]
|
||
|
|
post_logout_redirect_uris = [trim(var.grafana_base_url, "/")]
|
||
|
|
app_type = "OIDC_APP_TYPE_WEB"
|
||
|
|
auth_method_type = "OIDC_AUTH_METHOD_TYPE_BASIC"
|
||
|
|
version = "OIDC_VERSION_1_0"
|
||
|
|
clock_skew = "0s"
|
||
|
|
dev_mode = false
|
||
|
|
access_token_type = "OIDC_TOKEN_TYPE_BEARER"
|
||
|
|
access_token_role_assertion = false
|
||
|
|
id_token_role_assertion = true
|
||
|
|
id_token_userinfo_assertion = true
|
||
|
|
additional_origins = []
|
||
|
|
skip_native_app_success_page = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "vault_kv_secret_v2" "grafana_oidc" {
|
||
|
|
mount = var.vault_kv_mount
|
||
|
|
name = var.grafana_oidc_vault_path
|
||
|
|
|
||
|
|
data_json = jsonencode({
|
||
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_ID = zitadel_application_oidc.grafana.client_id
|
||
|
|
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET = zitadel_application_oidc.grafana.client_secret
|
||
|
|
client_id = zitadel_application_oidc.grafana.client_id
|
||
|
|
client_secret = zitadel_application_oidc.grafana.client_secret
|
||
|
|
discovery_url = "https://${var.zitadel_domain}/.well-known/openid-configuration"
|
||
|
|
redirect_uri = local.grafana_oidc_redirect_uri
|
||
|
|
})
|
||
|
|
|
||
|
|
# Vault is source of truth after first write. OIDC credential rotation is explicit.
|
||
|
|
lifecycle { ignore_changes = [data_json] }
|
||
|
|
}
|