---
apiVersion: grafana.integreatly.org/v1beta1
kind: Grafana
metadata:
  name: grafana
  namespace: grafana
  labels:
    dashboards: grafana
spec:
  version: 13.3.0
  client:
    useKubeAuth: true
  disableDefaultAdminSecret: true
  config:
    log:
      mode: console
    server:
      root_url: https://grafana.quorate.internal/
    auth:
      disable_login_form: "true"
      disable_signout_menu: "false"
      managed_service_accounts_enabled: "true"
    auth.basic:
      enabled: "false"
    auth.anonymous:
      enabled: "false"
    auth.jwt:
      enabled: "true"
      header_name: Authorization
      expect_claims: '{"aud": ["operator.grafana.com"]}'
      username_claim: sub
      email_claim: sub
      auto_sign_up: "true"
      role_attribute_strict: "true"
      role_attribute_path: "contains(sub, 'system:serviceaccount:grafana:grafana-operator') && 'GrafanaAdmin' || 'None'"
      jwk_set_url: https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}/openid/v1/jwks
      jwk_set_bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
      tls_client_ca: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
    auth.generic_oauth:
      enabled: "true"
      name: Zitadel
      allow_sign_up: "true"
      auto_login: "false"
      scopes: openid profile email groups
      auth_url: https://auth.quorate.dev/oauth/v2/authorize
      token_url: https://auth.quorate.dev/oauth/v2/token
      api_url: https://auth.quorate.dev/oidc/v1/userinfo
      use_pkce: "true"
      use_refresh_token: "true"
      role_attribute_strict: "true"
      role_attribute_path: "contains(groups[*], 'grafana_admin') && 'GrafanaAdmin' || contains(groups[*], 'grafana_editor') && 'Editor' || contains(groups[*], 'grafana_viewer') && 'Viewer' || ''"
      allow_assign_grafana_admin: "true"
    security:
      disable_initial_admin_creation: "true"
    plugins:
      allow_loading_unsigned_plugins: quorate-rcon-app,quorate-rcon-panel,quorate-datasource
    feature_toggles:
      enable: externalServiceAccounts
  deployment:
    spec:
      replicas: 2
      minReadySeconds: 5
      strategy:
        type: RollingUpdate
        rollingUpdate:
          maxUnavailable: 0
          maxSurge: 1
      template:
        metadata:
          labels:
            app.kubernetes.io/name: grafana
            app.kubernetes.io/instance: grafana
            gateway.quorate.internal/allow-gateway-client: "true"
            quorate.dev/zitadel-relay: "true"
        spec:
          imagePullSecrets:
            - name: grafana-pull
          securityContext:
            fsGroup: 10001
          initContainers:
            - name: plugins
              image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
              command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec, /installer/run.fsx]
              env:
                - name: SSL_CERT_FILE
                  value: /s3/ca.crt
                - name: DOTNET_NOLOGO
                  value: "true"
                - name: DOTNET_CLI_TELEMETRY_OPTOUT
                  value: "1"
                - name: AWS_EC2_METADATA_DISABLED
                  value: "true"
              securityContext:
                runAsNonRoot: true
                runAsUser: 10001
                runAsGroup: 10001
                allowPrivilegeEscalation: false
                readOnlyRootFilesystem: true
                capabilities:
                  drop: [ALL]
                seccompProfile:
                  type: RuntimeDefault
              resources:
                requests:
                  cpu: 100m
                  memory: 128Mi
                limits:
                  memory: 512Mi
              volumeMounts:
                - name: installer
                  mountPath: /installer
                  readOnly: true
                - name: rcon-config
                  mountPath: /config
                  readOnly: true
                - name: plugin-auth
                  mountPath: /s3
                  readOnly: true
                - name: rcon-plugins
                  mountPath: /plugins
                - name: plugin-tmp
                  mountPath: /tmp
          volumes:
            - name: installer
              configMap:
                name: grafana-plugins
            - name: rcon-config
              configMap:
                name: grafana-rcon
            - name: rcon-auth
              secret:
                secretName: grafana-rcon
                defaultMode: 0440
            - name: rcon-ca
              secret:
                secretName: grafana-ca
                defaultMode: 0444
                items:
                  - key: ca.crt
                    path: ca.crt
            - name: plugin-auth
              projected:
                defaultMode: 0440
                sources:
                  - secret:
                      name: grafana-s3
                      items:
                        - key: secretAccessKey
                          path: secretAccessKey
                  - secret:
                      name: grafana-ca
                      items:
                        - key: ca.crt
                          path: ca.crt
            - name: rcon-plugins
              emptyDir: {}
            - name: plugin-tmp
              emptyDir: {}
          affinity:
            podAntiAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                - labelSelector:
                    matchLabels:
                      app.kubernetes.io/name: grafana
                      app.kubernetes.io/instance: grafana
                  topologyKey: kubernetes.io/hostname
          containers:
            - name: grafana
              volumeMounts:
                - name: rcon-plugins
                  mountPath: /var/lib/grafana/plugins
                - name: rcon-plugins
                  mountPath: /var/lib/grafana/plugins/quorate-rcon-app
                  subPath: quorate-rcon-app
                  readOnly: true
                - name: rcon-config
                  mountPath: /etc/grafana/rcon/config.json
                  subPath: config.json
                  readOnly: true
                - name: rcon-config
                  mountPath: /etc/grafana/provisioning/plugins/rcon.yaml
                  subPath: apps.yaml
                  readOnly: true
                - name: rcon-auth
                  mountPath: /etc/grafana/rcon-auth
                  readOnly: true
                - name: rcon-ca
                  mountPath: /etc/ssl/certs/quorate.crt
                  subPath: ca.crt
                  readOnly: true
              env:
                - name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
                  valueFrom:
                    secretKeyRef:
                      name: grafana-oidc-zitadel
                      key: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
                - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
                  valueFrom:
                    secretKeyRef:
                      name: grafana-oidc-zitadel
                      key: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
                - name: GF_DATABASE_TYPE
                  value: postgres
                - name: GF_DATABASE_HOST
                  value: main-rw.postgres.svc.cluster.local:5432
                - name: GF_DATABASE_NAME
                  value: grafana
                - name: GF_DATABASE_USER
                  valueFrom:
                    secretKeyRef:
                      name: grafana-db
                      key: username
                - name: GF_DATABASE_PASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: grafana-db
                      key: password
                - name: GF_DATABASE_SSL_MODE
                  value: require
              startupProbe:
                httpGet:
                  path: /api/health
                  port: 3000
                failureThreshold: 30
                periodSeconds: 2
              readinessProbe:
                httpGet:
                  path: /api/health
                  port: 3000
                failureThreshold: 3
                periodSeconds: 10
                timeoutSeconds: 3
              resources:
                requests:
                  cpu: 100m
                  memory: 256Mi
                limits:
                  memory: 1Gi