238 lines
8.3 KiB
YAML
238 lines
8.3 KiB
YAML
---
|
|
apiVersion: grafana.integreatly.org/v1beta1
|
|
kind: Grafana
|
|
metadata:
|
|
name: grafana
|
|
namespace: grafana
|
|
labels:
|
|
dashboards: grafana
|
|
spec:
|
|
version: 13.3.0
|
|
client:
|
|
useKubeAuth: true
|
|
disableDefaultAdminSecret: true
|
|
config:
|
|
log:
|
|
mode: console
|
|
server:
|
|
root_url: https://grafana.quorate.internal/
|
|
auth:
|
|
disable_login_form: "true"
|
|
disable_signout_menu: "false"
|
|
managed_service_accounts_enabled: "true"
|
|
auth.basic:
|
|
enabled: "false"
|
|
auth.anonymous:
|
|
enabled: "false"
|
|
auth.jwt:
|
|
enabled: "true"
|
|
header_name: Authorization
|
|
expect_claims: '{"aud": ["operator.grafana.com"]}'
|
|
username_claim: sub
|
|
email_claim: sub
|
|
auto_sign_up: "true"
|
|
role_attribute_strict: "true"
|
|
role_attribute_path: "contains(sub, 'system:serviceaccount:grafana:grafana-operator') && 'GrafanaAdmin' || 'None'"
|
|
jwk_set_url: https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}/openid/v1/jwks
|
|
jwk_set_bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
tls_client_ca: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
|
|
auth.generic_oauth:
|
|
enabled: "true"
|
|
name: Zitadel
|
|
allow_sign_up: "true"
|
|
auto_login: "false"
|
|
scopes: openid profile email groups
|
|
auth_url: https://auth.quorate.dev/oauth/v2/authorize
|
|
token_url: https://auth.quorate.dev/oauth/v2/token
|
|
api_url: https://auth.quorate.dev/oidc/v1/userinfo
|
|
use_pkce: "true"
|
|
use_refresh_token: "true"
|
|
role_attribute_strict: "true"
|
|
role_attribute_path: "contains(groups[*], 'grafana_admin') && 'GrafanaAdmin' || contains(groups[*], 'grafana_editor') && 'Editor' || contains(groups[*], 'grafana_viewer') && 'Viewer' || ''"
|
|
allow_assign_grafana_admin: "true"
|
|
security:
|
|
disable_initial_admin_creation: "true"
|
|
plugins:
|
|
allow_loading_unsigned_plugins: quorate-rcon-app,quorate-rcon-panel,quorate-datasource
|
|
feature_toggles:
|
|
enable: externalServiceAccounts
|
|
deployment:
|
|
spec:
|
|
replicas: 2
|
|
minReadySeconds: 5
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 0
|
|
maxSurge: 1
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: grafana
|
|
app.kubernetes.io/instance: grafana
|
|
gateway.quorate.internal/allow-gateway-client: "true"
|
|
quorate.dev/zitadel-relay: "true"
|
|
spec:
|
|
imagePullSecrets:
|
|
- name: grafana-pull
|
|
securityContext:
|
|
fsGroup: 10001
|
|
initContainers:
|
|
- name: plugins
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
|
|
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec, /installer/run.fsx]
|
|
env:
|
|
- name: SSL_CERT_FILE
|
|
value: /s3/ca.crt
|
|
- name: DOTNET_NOLOGO
|
|
value: "true"
|
|
- name: DOTNET_CLI_TELEMETRY_OPTOUT
|
|
value: "1"
|
|
- name: AWS_EC2_METADATA_DISABLED
|
|
value: "true"
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: [ALL]
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 512Mi
|
|
volumeMounts:
|
|
- name: installer
|
|
mountPath: /installer
|
|
readOnly: true
|
|
- name: rcon-config
|
|
mountPath: /config
|
|
readOnly: true
|
|
- name: plugin-auth
|
|
mountPath: /s3
|
|
readOnly: true
|
|
- name: rcon-plugins
|
|
mountPath: /plugins
|
|
- name: plugin-tmp
|
|
mountPath: /tmp
|
|
volumes:
|
|
- name: installer
|
|
configMap:
|
|
name: grafana-plugins
|
|
- name: rcon-config
|
|
configMap:
|
|
name: grafana-rcon
|
|
- name: rcon-auth
|
|
secret:
|
|
secretName: grafana-rcon
|
|
defaultMode: 0440
|
|
- name: rcon-ca
|
|
secret:
|
|
secretName: grafana-ca
|
|
defaultMode: 0444
|
|
items:
|
|
- key: ca.crt
|
|
path: ca.crt
|
|
- name: plugin-auth
|
|
projected:
|
|
defaultMode: 0440
|
|
sources:
|
|
- secret:
|
|
name: grafana-s3
|
|
items:
|
|
- key: secretAccessKey
|
|
path: secretAccessKey
|
|
- secret:
|
|
name: grafana-ca
|
|
items:
|
|
- key: ca.crt
|
|
path: ca.crt
|
|
- name: rcon-plugins
|
|
emptyDir: {}
|
|
- name: plugin-tmp
|
|
emptyDir: {}
|
|
affinity:
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: grafana
|
|
app.kubernetes.io/instance: grafana
|
|
topologyKey: kubernetes.io/hostname
|
|
containers:
|
|
- name: grafana
|
|
volumeMounts:
|
|
- name: rcon-plugins
|
|
mountPath: /var/lib/grafana/plugins
|
|
- name: rcon-plugins
|
|
mountPath: /var/lib/grafana/plugins/quorate-rcon-app
|
|
subPath: quorate-rcon-app
|
|
readOnly: true
|
|
- name: rcon-config
|
|
mountPath: /etc/grafana/rcon/config.json
|
|
subPath: config.json
|
|
readOnly: true
|
|
- name: rcon-config
|
|
mountPath: /etc/grafana/provisioning/plugins/rcon.yaml
|
|
subPath: apps.yaml
|
|
readOnly: true
|
|
- name: rcon-auth
|
|
mountPath: /etc/grafana/rcon-auth
|
|
readOnly: true
|
|
- name: rcon-ca
|
|
mountPath: /etc/ssl/certs/quorate.crt
|
|
subPath: ca.crt
|
|
readOnly: true
|
|
env:
|
|
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: grafana-oidc-zitadel
|
|
key: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
|
|
- name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: grafana-oidc-zitadel
|
|
key: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
|
|
- name: GF_DATABASE_TYPE
|
|
value: postgres
|
|
- name: GF_DATABASE_HOST
|
|
value: main-rw.postgres.svc.cluster.local:5432
|
|
- name: GF_DATABASE_NAME
|
|
value: grafana
|
|
- name: GF_DATABASE_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: grafana-db
|
|
key: username
|
|
- name: GF_DATABASE_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: grafana-db
|
|
key: password
|
|
- name: GF_DATABASE_SSL_MODE
|
|
value: require
|
|
startupProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: 3000
|
|
failureThreshold: 30
|
|
periodSeconds: 2
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: 3000
|
|
failureThreshold: 3
|
|
periodSeconds: 10
|
|
timeoutSeconds: 3
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 1Gi
|