ce7cb702218693d08ea6d83464d2457c9250027c

vendor/workloads/grafana/credential-rotation/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - policy.yaml
+  - rbac.yaml

vendor/workloads/grafana/credential-rotation/policy.yaml

@@ -0,0 +1,40 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: grafana-credential-rotation
+spec:
+  mutateExistingOnPolicyUpdate: false
+  rules:
+    - name: patch-grafana-cr-revision
+      match:
+        any:
+          - resources:
+              kinds:
+                - Secret
+              names:
+                - grafana-db
+                - grafana-oidc-zitadel
+              namespaces:
+                - grafana
+              operations:
+                - UPDATE
+      preconditions:
+        all:
+          - key: "{{ request.object.data }}"
+            operator: NotEquals
+            value: "{{ request.oldObject.data }}"
+      mutate:
+        targets:
+          - apiVersion: grafana.integreatly.org/v1beta1
+            kind: Grafana
+            name: grafana
+            namespace: grafana
+        patchStrategicMerge:
+          spec:
+            deployment:
+              spec:
+                template:
+                  metadata:
+                    annotations:
+                      # Admission UPDATE objects still carry the pre-commit resourceVersion.
+                      credentials.quorate.internal/revision: "{{ request.uid }}"

vendor/workloads/grafana/credential-rotation/rbac.yaml

@@ -0,0 +1,36 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno:grafana-mutator
+rules:
+  - apiGroups:
+      - grafana.integreatly.org
+    resources:
+      - grafanas
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kyverno:grafana-mutator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kyverno:grafana-mutator
+subjects:
+  - kind: ServiceAccount
+    name: kyverno-background-controller
+    namespace: kyverno

vendor/workloads/grafana/dashboards.yaml

@@ -0,0 +1,149 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: minecraft
+  namespace: grafana
+  annotations:
+    grafana.com/dashboard-id: "16508"
+    grafana.com/source-url: https://grafana.com/grafana/dashboards/16508-minecraft-server-stats/
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  uid: minecraft
+  url: https://grafana.com/api/dashboards/16508/revisions/latest/download
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: oci-l4-relay
+  namespace: grafana
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  plugins:
+    - name: victoriametrics-logs-datasource
+      version: latest
+  uid: oci-l4-relay
+  configMapRef:
+    name: grafana-dashboard-oci-l4-relay
+    key: oci-l4-relay.json
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: node-exporter-full
+  namespace: grafana
+  annotations:
+    grafana.com/dashboard-id: "13960"
+    grafana.com/source-url: https://grafana.com/grafana/dashboards/13960-node-exporter-full/
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  uid: node-exporter
+  url: https://grafana.com/api/dashboards/13960/revisions/latest/download
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: victoriametrics-cluster
+  namespace: grafana
+  annotations:
+    grafana.com/dashboard-id: "11176"
+    grafana.com/source-url: https://grafana.com/grafana/dashboards/11176-victoriametrics-cluster/
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  uid: victoriametrics-cluster
+  url: https://grafana.com/api/dashboards/11176/revisions/latest/download
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: victoriametrics-operator
+  namespace: grafana
+  annotations:
+    grafana.com/dashboard-id: "17869"
+    grafana.com/source-url: https://grafana.com/grafana/dashboards/17869-victoriametrics-operator/
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  uid: victoriametrics-operator
+  url: https://grafana.com/api/dashboards/17869/revisions/latest/download
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: victorialogs-cluster
+  namespace: grafana
+  annotations:
+    grafana.com/dashboard-id: "23274"
+    grafana.com/source-url: https://grafana.com/grafana/dashboards/23274-victorialogs-cluster/
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  uid: victorialogs-cluster
+  url: https://grafana.com/api/dashboards/23274/revisions/latest/download
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: victorialogs-internal-state
+  namespace: grafana
+  annotations:
+    grafana.com/dashboard-id: "24585"
+    grafana.com/source-url: https://grafana.com/grafana/dashboards/24585-victorialogs-internal-state/
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  plugins:
+    - name: victoriametrics-logs-datasource
+      version: latest
+  uid: victorialogs-internal-state
+  url: https://grafana.com/api/dashboards/24585/revisions/latest/download
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: smartctl-exporter
+  namespace: grafana
+  annotations:
+    grafana.com/dashboard-id: "22604"
+    grafana.com/source-url: https://grafana.com/grafana/dashboards/22604-smartctl-exporter-dashboard/
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  uid: smartctl-exporter
+  url: https://grafana.com/api/dashboards/22604/revisions/latest/download
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
+metadata:
+  name: nvidia-dcgm-exporter
+  namespace: grafana
+  annotations:
+    grafana.com/dashboard-id: "12239"
+    grafana.com/source-url: https://grafana.com/grafana/dashboards/12239-nvidia-dcgm-exporter-dashboard/
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  uid: nvidia-dcgm-exporter
+  url: https://grafana.com/api/dashboards/12239/revisions/latest/download

vendor/workloads/grafana/datasources.yaml

@@ -0,0 +1,75 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDatasource
+metadata:
+  name: victoriametrics
+  namespace: grafana
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  valuesFrom:
+    - targetPath: secureJsonData.httpHeaderValue1
+      valueFrom:
+        secretKeyRef:
+          name: grafana-vmauth-metrics-token
+          key: token
+  datasource:
+    name: VictoriaMetrics
+    uid: victoriametrics
+    type: prometheus
+    access: proxy
+    url: http://vmauth-main.victoriametrics.svc.cluster.local:8427/prometheus
+    isDefault: true
+    jsonData:
+      timeInterval: 15s
+      httpHeaderName1: Authorization
+    secureJsonData:
+      httpHeaderValue1: Bearer ${token}
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDatasource
+metadata:
+  name: minecraft-console
+  namespace: grafana
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  datasource:
+    name: Minecraft Console
+    uid: minecraft-console
+    type: quorate-datasource
+    access: proxy
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDatasource
+metadata:
+  name: victorialogs
+  namespace: grafana
+spec:
+  resyncPeriod: 5m
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  plugins:
+    - name: victoriametrics-logs-datasource
+      version: latest
+  valuesFrom:
+    - targetPath: secureJsonData.httpHeaderValue1
+      valueFrom:
+        secretKeyRef:
+          name: grafana-vmauth-logs-token
+          key: token
+  datasource:
+    name: VictoriaLogs
+    uid: victorialogs
+    type: victoriametrics-logs-datasource
+    access: proxy
+    url: http://vmauth-main.victoriametrics.svc.cluster.local:8427
+    jsonData:
+      httpHeaderName1: Authorization
+    secureJsonData:
+      httpHeaderValue1: Bearer ${token}

vendor/workloads/grafana/grafana.yaml

@@ -0,0 +1,238 @@
+---
+apiVersion: grafana.integreatly.org/v1beta1
+kind: Grafana
+metadata:
+  name: grafana
+  namespace: grafana
+  labels:
+    dashboards: grafana
+spec:
+  version: 13.3.0
+  client:
+    useKubeAuth: true
+  disableDefaultAdminSecret: true
+  config:
+    log:
+      mode: console
+    server:
+      root_url: https://grafana.quorate.internal/
+    auth:
+      disable_login_form: "true"
+      disable_signout_menu: "false"
+      managed_service_accounts_enabled: "true"
+    auth.basic:
+      enabled: "false"
+    auth.anonymous:
+      enabled: "false"
+    auth.jwt:
+      enabled: "true"
+      header_name: Authorization
+      expect_claims: '{"aud": ["operator.grafana.com"]}'
+      username_claim: sub
+      email_claim: sub
+      auto_sign_up: "true"
+      role_attribute_strict: "true"
+      role_attribute_path: "contains(sub, 'system:serviceaccount:grafana:grafana-operator') && 'GrafanaAdmin' || 'None'"
+      jwk_set_url: https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}/openid/v1/jwks
+      jwk_set_bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
+      tls_client_ca: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+    auth.generic_oauth:
+      enabled: "true"
+      name: Zitadel
+      allow_sign_up: "true"
+      auto_login: "false"
+      scopes: openid profile email groups
+      auth_url: https://auth.quorate.dev/oauth/v2/authorize
+      token_url: https://auth.quorate.dev/oauth/v2/token
+      api_url: https://auth.quorate.dev/oidc/v1/userinfo
+      use_pkce: "true"
+      use_refresh_token: "true"
+      role_attribute_strict: "true"
+      role_attribute_path: "contains(groups[*], 'grafana_admin') && 'GrafanaAdmin' || contains(groups[*], 'grafana_editor') && 'Editor' || contains(groups[*], 'grafana_viewer') && 'Viewer' || ''"
+      allow_assign_grafana_admin: "true"
+    security:
+      disable_initial_admin_creation: "true"
+    plugins:
+      allow_loading_unsigned_plugins: quorate-rcon-app,quorate-rcon-panel,quorate-datasource
+    feature_toggles:
+      enable: externalServiceAccounts
+  deployment:
+    spec:
+      replicas: 2
+      minReadySeconds: 5
+      strategy:
+        type: RollingUpdate
+        rollingUpdate:
+          maxUnavailable: 0
+          maxSurge: 1
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: grafana
+            app.kubernetes.io/instance: grafana
+            gateway.quorate.internal/allow-gateway-client: "true"
+            quorate.dev/zitadel-relay: "true"
+        spec:
+          imagePullSecrets:
+            - name: grafana-pull
+          securityContext:
+            fsGroup: 10001
+          initContainers:
+            - name: plugins
+              image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+              command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec, /installer/run.fsx]
+              env:
+                - name: SSL_CERT_FILE
+                  value: /s3/ca.crt
+                - name: DOTNET_NOLOGO
+                  value: "true"
+                - name: DOTNET_CLI_TELEMETRY_OPTOUT
+                  value: "1"
+                - name: AWS_EC2_METADATA_DISABLED
+                  value: "true"
+              securityContext:
+                runAsNonRoot: true
+                runAsUser: 10001
+                runAsGroup: 10001
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: [ALL]
+                seccompProfile:
+                  type: RuntimeDefault
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 128Mi
+                limits:
+                  memory: 512Mi
+              volumeMounts:
+                - name: installer
+                  mountPath: /installer
+                  readOnly: true
+                - name: rcon-config
+                  mountPath: /config
+                  readOnly: true
+                - name: plugin-auth
+                  mountPath: /s3
+                  readOnly: true
+                - name: rcon-plugins
+                  mountPath: /plugins
+                - name: plugin-tmp
+                  mountPath: /tmp
+          volumes:
+            - name: installer
+              configMap:
+                name: grafana-plugins
+            - name: rcon-config
+              configMap:
+                name: grafana-rcon
+            - name: rcon-auth
+              secret:
+                secretName: grafana-rcon
+                defaultMode: 0440
+            - name: rcon-ca
+              secret:
+                secretName: grafana-ca
+                defaultMode: 0444
+                items:
+                  - key: ca.crt
+                    path: ca.crt
+            - name: plugin-auth
+              projected:
+                defaultMode: 0440
+                sources:
+                  - secret:
+                      name: grafana-s3
+                      items:
+                        - key: secretAccessKey
+                          path: secretAccessKey
+                  - secret:
+                      name: grafana-ca
+                      items:
+                        - key: ca.crt
+                          path: ca.crt
+            - name: rcon-plugins
+              emptyDir: {}
+            - name: plugin-tmp
+              emptyDir: {}
+          affinity:
+            podAntiAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                - labelSelector:
+                    matchLabels:
+                      app.kubernetes.io/name: grafana
+                      app.kubernetes.io/instance: grafana
+                  topologyKey: kubernetes.io/hostname
+          containers:
+            - name: grafana
+              volumeMounts:
+                - name: rcon-plugins
+                  mountPath: /var/lib/grafana/plugins
+                - name: rcon-plugins
+                  mountPath: /var/lib/grafana/plugins/quorate-rcon-app
+                  subPath: quorate-rcon-app
+                  readOnly: true
+                - name: rcon-config
+                  mountPath: /etc/grafana/rcon/config.json
+                  subPath: config.json
+                  readOnly: true
+                - name: rcon-config
+                  mountPath: /etc/grafana/provisioning/plugins/rcon.yaml
+                  subPath: apps.yaml
+                  readOnly: true
+                - name: rcon-auth
+                  mountPath: /etc/grafana/rcon-auth
+                  readOnly: true
+                - name: rcon-ca
+                  mountPath: /etc/ssl/certs/quorate.crt
+                  subPath: ca.crt
+                  readOnly: true
+              env:
+                - name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: grafana-oidc-zitadel
+                      key: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
+                - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+                  valueFrom:
+                    secretKeyRef:
+                      name: grafana-oidc-zitadel
+                      key: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
+                - name: GF_DATABASE_TYPE
+                  value: postgres
+                - name: GF_DATABASE_HOST
+                  value: main-rw.postgres.svc.cluster.local:5432
+                - name: GF_DATABASE_NAME
+                  value: grafana
+                - name: GF_DATABASE_USER
+                  valueFrom:
+                    secretKeyRef:
+                      name: grafana-db
+                      key: username
+                - name: GF_DATABASE_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: grafana-db
+                      key: password
+                - name: GF_DATABASE_SSL_MODE
+                  value: require
+              startupProbe:
+                httpGet:
+                  path: /api/health
+                  port: 3000
+                failureThreshold: 30
+                periodSeconds: 2
+              readinessProbe:
+                httpGet:
+                  path: /api/health
+                  port: 3000
+                failureThreshold: 3
+                periodSeconds: 10
+                timeoutSeconds: 3
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 256Mi
+                limits:
+                  memory: 1Gi

vendor/workloads/grafana/kustomization.yaml

@@ -0,0 +1,25 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - vso.yaml
+  - grafana.yaml
+  - poddisruptionbudget.yaml
+  - datasources.yaml
+  - dashboards.yaml
+  - route.yaml
+  - network-policies.yaml
+  - credential-rotation
+  - ../../../services/grafana-plugins
+  - plugins
+
+configurations:
+  - plugins/references.yaml
+
+generatorOptions:
+  disableNameSuffixHash: true
+
+configMapGenerator:
+  - name: grafana-dashboard-oci-l4-relay
+    namespace: grafana
+    files:
+      - oci-l4-relay.json=dashboard-json/oci-l4-relay.json

vendor/workloads/grafana/network-policies.yaml

@@ -0,0 +1,183 @@
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: grafana
+  namespace: grafana
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: grafana
+      app.kubernetes.io/instance: grafana
+  ingress:
+    # Kubelet probes, local port-forwarding, and same-node Gateway backend flows.
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+    # Gateway I Envoy proxy: outbound connections use reserved:ingress identity.
+    - fromEntities:
+        - ingress
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            gateway.networking.k8s.io/gateway-name: gateway-internal
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: grafana
+            app.kubernetes.io/name: grafana-operator
+            app.kubernetes.io/instance: grafana-operator
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: minecraft
+            app.kubernetes.io/name: minecraft
+            app.kubernetes.io/instance: skies
+      toPorts:
+        - ports:
+            - port: "25575"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: versitygw
+            app.kubernetes.io/name: versitygw
+      toPorts:
+        - ports:
+            - port: "7070"
+              protocol: TCP
+    - toFQDNs:
+        - matchName: s3.quorate.internal
+      toPorts:
+        - ports:
+            - port: "443"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: postgres
+            cnpg.io/cluster: main
+      toPorts:
+        - ports:
+            - port: "5432"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: victoriametrics
+            app.kubernetes.io/name: vmauth
+      toPorts:
+        - ports:
+            - port: "8427"
+              protocol: TCP
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: kube-system
+            k8s-app: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+          rules:
+            dns:
+              - matchPattern: "*"
+    - toServices:
+        - k8sService:
+            namespace: kube-system
+            serviceName: kube-dns
+      toPorts:
+        - ports:
+            - port: "53"
+              protocol: UDP
+            - port: "53"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: gateway-internal-egress-grafana
+spec:
+  endpointSelector:
+    matchLabels:
+      "reserved:ingress": ""
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: grafana
+            app.kubernetes.io/name: grafana
+            app.kubernetes.io/instance: grafana
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-grafana
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: grafana
+            app.kubernetes.io/name: grafana
+            app.kubernetes.io/instance: grafana
+      toPorts:
+        - ports:
+            - port: "3000"
+              protocol: TCP
+---
+# Same-node Gateway backend selections can return to node-local ephemeral
+# source ports via the host path.
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-ingress-grafana-replies
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: grafana
+            app.kubernetes.io/name: grafana
+            app.kubernetes.io/instance: grafana
+      toPorts:
+        - ports:
+            - port: "32768"
+              endPort: 60999
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: grafana-artifacts
+  namespace: versitygw
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: versitygw
+      app.kubernetes.io/instance: versitygw
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: grafana
+            app.kubernetes.io/name: grafana
+            app.kubernetes.io/instance: grafana
+      toPorts:
+        - ports:
+            - port: "7070"
+              protocol: TCP

vendor/workloads/grafana/plugins/apps.yaml

@@ -0,0 +1,5 @@
+apiVersion: 1
+apps:
+  - type: quorate-rcon-app
+    org_id: 1
+    enabled: true

vendor/workloads/grafana/plugins/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+configMapGenerator:
+  - name: grafana-rcon
+    namespace: grafana
+    files:
+      - settings.json
+      - config.json=rcon.json
+      - apps.yaml

vendor/workloads/grafana/plugins/rcon.json

@@ -0,0 +1,5 @@
+{
+  "apiUrl": "http://127.0.0.1:3000",
+  "address": "minecraft-rcon.minecraft.svc.cluster.local:25575",
+  "passwordPath": "/etc/grafana/rcon-auth/password"
+}

vendor/workloads/grafana/plugins/references.yaml

@@ -0,0 +1,5 @@
+nameReference:
+  - kind: ConfigMap
+    fieldSpecs:
+      - kind: Grafana
+        path: spec/deployment/spec/template/spec/volumes/configMap/name

vendor/workloads/grafana/plugins/settings.json

@@ -0,0 +1,7 @@
+{
+  "Endpoint": "https://s3.quorate.internal",
+  "Bucket": "artifacts",
+  "Key": "grafana-rcon/893f61afd3a59c5463c911060cc09aa791738eff445034690e1ddddbe6f63424.zip",
+  "Sha256": "893f61afd3a59c5463c911060cc09aa791738eff445034690e1ddddbe6f63424",
+  "AccessKey": "grafana"
+}

vendor/workloads/grafana/poddisruptionbudget.yaml

@@ -0,0 +1,11 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: grafana
+  namespace: grafana
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: grafana
+      app.kubernetes.io/instance: grafana

vendor/workloads/grafana/route.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana
+  namespace: grafana
+spec:
+  parentRefs:
+    - name: gateway-internal
+      namespace: kube-system
+      sectionName: https
+  hostnames:
+    - grafana.quorate.internal
+  rules:
+    - backendRefs:
+        - name: grafana-service
+          port: 3000

vendor/workloads/grafana/vso.yaml

@@ -0,0 +1,160 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: grafana-vso
+  namespace: grafana
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: grafana
+spec:
+  method: kubernetes
+  mount: kubernetes
+  kubernetes:
+    role: grafana
+    serviceAccount: grafana-vso
+  vaultConnectionRef: vault/vault
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: grafana-oidc-zitadel
+  namespace: grafana
+spec:
+  type: kv-v2
+  mount: secret
+  path: grafana/oidc/zitadel
+  destination:
+    name: grafana-oidc-zitadel
+    create: true
+  refreshAfter: 1h
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: grafana-db
+  namespace: grafana
+spec:
+  mount: database
+  path: static-creds/grafana
+  allowStaticCreds: true
+  refreshAfter: 5m
+  destination:
+    name: grafana-db
+    create: true
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: grafana-s3
+  namespace: grafana
+spec:
+  type: kv-v2
+  mount: secret
+  path: versitygw/users/grafana
+  destination:
+    name: grafana-s3
+    create: true
+  refreshAfter: 1h
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: grafana-rcon
+  namespace: grafana
+spec:
+  type: kv-v2
+  mount: secret
+  path: minecraft/rcon
+  destination:
+    name: grafana-rcon
+    create: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        password:
+          text: '{{ get .Secrets "password" }}'
+  refreshAfter: 1h
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultDynamicSecret
+metadata:
+  name: grafana-ca
+  namespace: grafana
+spec:
+  mount: pki
+  path: cert/ca
+  requestHTTPMethod: GET
+  destination:
+    name: grafana-ca
+    create: true
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        ca.crt:
+          text: '{{ get .Secrets "certificate" }}'
+  refreshAfter: 1h
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: grafana-pull
+  namespace: grafana
+spec:
+  type: kv-v2
+  mount: secret
+  path: quay/oauth/project-delivery-reader
+  refreshAfter: 5m
+  destination:
+    name: grafana-pull
+    create: true
+    type: kubernetes.io/dockerconfigjson
+    transformation:
+      excludeRaw: true
+      excludes: [.*]
+      templates:
+        .dockerconfigjson:
+          text: |
+            {{- $token := get .Secrets "token" -}}
+            {"auths":{"registry.quorate.internal":{"username":"$oauthtoken","password":"{{ $token }}","auth":"{{ printf "%s:%s" "$oauthtoken" $token | b64enc }}"}}}
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: grafana-vmauth-metrics-token
+  namespace: grafana
+spec:
+  type: kv-v2
+  mount: secret
+  path: victoriametrics/vmauth/query
+  destination:
+    name: grafana-vmauth-metrics-token
+    create: true
+  refreshAfter: 1h
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: grafana-vmauth-logs-token
+  namespace: grafana
+spec:
+  type: kv-v2
+  mount: secret
+  path: victorialogs/vmauth/query
+  destination:
+    name: grafana-vmauth-logs-token
+    create: true
+  refreshAfter: 1h
+  vaultAuthRef: default