ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
238
vendor/workloads/grafana/grafana.yaml
vendored
Normal file
238
vendor/workloads/grafana/grafana.yaml
vendored
Normal file
|
|
@ -0,0 +1,238 @@
|
|||
---
|
||||
apiVersion: grafana.integreatly.org/v1beta1
|
||||
kind: Grafana
|
||||
metadata:
|
||||
name: grafana
|
||||
namespace: grafana
|
||||
labels:
|
||||
dashboards: grafana
|
||||
spec:
|
||||
version: 13.3.0
|
||||
client:
|
||||
useKubeAuth: true
|
||||
disableDefaultAdminSecret: true
|
||||
config:
|
||||
log:
|
||||
mode: console
|
||||
server:
|
||||
root_url: https://grafana.quorate.internal/
|
||||
auth:
|
||||
disable_login_form: "true"
|
||||
disable_signout_menu: "false"
|
||||
managed_service_accounts_enabled: "true"
|
||||
auth.basic:
|
||||
enabled: "false"
|
||||
auth.anonymous:
|
||||
enabled: "false"
|
||||
auth.jwt:
|
||||
enabled: "true"
|
||||
header_name: Authorization
|
||||
expect_claims: '{"aud": ["operator.grafana.com"]}'
|
||||
username_claim: sub
|
||||
email_claim: sub
|
||||
auto_sign_up: "true"
|
||||
role_attribute_strict: "true"
|
||||
role_attribute_path: "contains(sub, 'system:serviceaccount:grafana:grafana-operator') && 'GrafanaAdmin' || 'None'"
|
||||
jwk_set_url: https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}/openid/v1/jwks
|
||||
jwk_set_bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||||
tls_client_ca: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
||||
auth.generic_oauth:
|
||||
enabled: "true"
|
||||
name: Zitadel
|
||||
allow_sign_up: "true"
|
||||
auto_login: "false"
|
||||
scopes: openid profile email groups
|
||||
auth_url: https://auth.quorate.dev/oauth/v2/authorize
|
||||
token_url: https://auth.quorate.dev/oauth/v2/token
|
||||
api_url: https://auth.quorate.dev/oidc/v1/userinfo
|
||||
use_pkce: "true"
|
||||
use_refresh_token: "true"
|
||||
role_attribute_strict: "true"
|
||||
role_attribute_path: "contains(groups[*], 'grafana_admin') && 'GrafanaAdmin' || contains(groups[*], 'grafana_editor') && 'Editor' || contains(groups[*], 'grafana_viewer') && 'Viewer' || ''"
|
||||
allow_assign_grafana_admin: "true"
|
||||
security:
|
||||
disable_initial_admin_creation: "true"
|
||||
plugins:
|
||||
allow_loading_unsigned_plugins: quorate-rcon-app,quorate-rcon-panel,quorate-datasource
|
||||
feature_toggles:
|
||||
enable: externalServiceAccounts
|
||||
deployment:
|
||||
spec:
|
||||
replicas: 2
|
||||
minReadySeconds: 5
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 0
|
||||
maxSurge: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: grafana
|
||||
app.kubernetes.io/instance: grafana
|
||||
gateway.quorate.internal/allow-gateway-client: "true"
|
||||
quorate.dev/zitadel-relay: "true"
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: grafana-pull
|
||||
securityContext:
|
||||
fsGroup: 10001
|
||||
initContainers:
|
||||
- name: plugins
|
||||
image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
|
||||
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec, /installer/run.fsx]
|
||||
env:
|
||||
- name: SSL_CERT_FILE
|
||||
value: /s3/ca.crt
|
||||
- name: DOTNET_NOLOGO
|
||||
value: "true"
|
||||
- name: DOTNET_CLI_TELEMETRY_OPTOUT
|
||||
value: "1"
|
||||
- name: AWS_EC2_METADATA_DISABLED
|
||||
value: "true"
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 10001
|
||||
runAsGroup: 10001
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: [ALL]
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
memory: 512Mi
|
||||
volumeMounts:
|
||||
- name: installer
|
||||
mountPath: /installer
|
||||
readOnly: true
|
||||
- name: rcon-config
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
- name: plugin-auth
|
||||
mountPath: /s3
|
||||
readOnly: true
|
||||
- name: rcon-plugins
|
||||
mountPath: /plugins
|
||||
- name: plugin-tmp
|
||||
mountPath: /tmp
|
||||
volumes:
|
||||
- name: installer
|
||||
configMap:
|
||||
name: grafana-plugins
|
||||
- name: rcon-config
|
||||
configMap:
|
||||
name: grafana-rcon
|
||||
- name: rcon-auth
|
||||
secret:
|
||||
secretName: grafana-rcon
|
||||
defaultMode: 0440
|
||||
- name: rcon-ca
|
||||
secret:
|
||||
secretName: grafana-ca
|
||||
defaultMode: 0444
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- name: plugin-auth
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- secret:
|
||||
name: grafana-s3
|
||||
items:
|
||||
- key: secretAccessKey
|
||||
path: secretAccessKey
|
||||
- secret:
|
||||
name: grafana-ca
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- name: rcon-plugins
|
||||
emptyDir: {}
|
||||
- name: plugin-tmp
|
||||
emptyDir: {}
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: grafana
|
||||
app.kubernetes.io/instance: grafana
|
||||
topologyKey: kubernetes.io/hostname
|
||||
containers:
|
||||
- name: grafana
|
||||
volumeMounts:
|
||||
- name: rcon-plugins
|
||||
mountPath: /var/lib/grafana/plugins
|
||||
- name: rcon-plugins
|
||||
mountPath: /var/lib/grafana/plugins/quorate-rcon-app
|
||||
subPath: quorate-rcon-app
|
||||
readOnly: true
|
||||
- name: rcon-config
|
||||
mountPath: /etc/grafana/rcon/config.json
|
||||
subPath: config.json
|
||||
readOnly: true
|
||||
- name: rcon-config
|
||||
mountPath: /etc/grafana/provisioning/plugins/rcon.yaml
|
||||
subPath: apps.yaml
|
||||
readOnly: true
|
||||
- name: rcon-auth
|
||||
mountPath: /etc/grafana/rcon-auth
|
||||
readOnly: true
|
||||
- name: rcon-ca
|
||||
mountPath: /etc/ssl/certs/quorate.crt
|
||||
subPath: ca.crt
|
||||
readOnly: true
|
||||
env:
|
||||
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: grafana-oidc-zitadel
|
||||
key: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
|
||||
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: grafana-oidc-zitadel
|
||||
key: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
|
||||
- name: GF_DATABASE_TYPE
|
||||
value: postgres
|
||||
- name: GF_DATABASE_HOST
|
||||
value: main-rw.postgres.svc.cluster.local:5432
|
||||
- name: GF_DATABASE_NAME
|
||||
value: grafana
|
||||
- name: GF_DATABASE_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: grafana-db
|
||||
key: username
|
||||
- name: GF_DATABASE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: grafana-db
|
||||
key: password
|
||||
- name: GF_DATABASE_SSL_MODE
|
||||
value: require
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 3000
|
||||
failureThreshold: 30
|
||||
periodSeconds: 2
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 3000
|
||||
failureThreshold: 3
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
memory: 1Gi
|
||||
Loading…
Reference in a new issue