fix(grafana): add admin credentials

admin credentials are needed by the sidecards in order to update datasources and dashboards

Signed-off-by: Vegard Hagen <[email protected]>

k8s/infra/monitoring/kube-prometheus-stack/grafana-admin-credentials.yaml

@@ -0,0 +1,14 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-admin-credentials
+  namespace: monitoring
+spec:
+  encryptedData:
+    password: AgANbqUu0Et5sui+wnqfDRUeoraff5YQPN3SVTJIe2FUEvAnDemFwr5LJXns8BWaU0ePwTOl4kefrcstoCFkOv0T0kDtOA10iaFsGXlGFg2mfB9jhfevcYaFL1v0lJNp6nKDRPE+7p8xYKQ2g98TPh1wouZL+CUD74Xu5prP8H0996t+rN4GQwaCiKB6A0RgWcl6dHB7kJG2Ai7it3iggw1njwzJi+j0BOdOG+hsZSndXxj4DXti4HUYT098n2HKa+zJsFlYMZdlRiB3MrcijJqJ0zCSZI+chxFqifHRI/fq1Tul4PIzl5PwkfjouGAiUarHUkaFgQwF0iYwT+T/aLKPt81JXCP6t5vfrV267gKXIV9e/5wt76psTg4/rziaXpk7qQSElPsXYKwh13CgjHZlFnRix3wML/fujCrKxFuDLpfDEcBLvupYMfTjPz/UeZsYHZhilzKG6pXKp0S7S6jy8R4mezQ6pbLnM3jiKCSB62TR86OCNotoU709Iyhvydm16N3bkXv/omXEwAfrnrTY6bLGrW2gGQUewp9b32ICfinO5+tmEXRc1fc3Gg+Q2UGTZ/TxJ6GpIjOprpZw713wupR4gwrXgUWIIWA+RlwAVSbRov2c8P6kz5Xv5RSbEI8NfjMkDMu4P62vUqR1qSIEbE2ZOSgGCVyiz+wiOTWJjqStuAluGBA5f71iGVTAMeWvRpwbxjyuse2XvjhbTCHdMJoBc4502gxm5DRxIY53IeP8Xlk=
+    username: AgCU0NGesHrF8lhshT1YgyxW4K4DioTHfDqyUzIWbAFRjMb4tj8xRASQfd2JnGTdUY933IFDu8OutILYErLN/TT1oyhFtMFxnIWXp+WP6YzO3WxxLYYkxP692SCZfc8l4eccdUPmmH1EYkpKyQU1TSZtFBWBJpYt/l8Pn5+VG960S3Fx1Ldp5l9kEF4UtUYpPcFUHTzORxW5vpI7wg2SK9I+PqTGLywZfv5Rz0oY9lhQnBGkr/Tg/Wpnn4/o3+kg2b5RaA+kzXymaeM8JOEvDwwJWhVXDqA8xYwLGQAOgatRDNeVs8q6Ck4iQ5ZATN3IeDHjeVw1098y7HK5ew5hbjr9Bbfm2y0I03Ft3pCzrPH1A5ZLpAVwF11aT/M5f7bowgCKPrCJMQ95JU7SEJ/1KHiNOpdtGwArSaAc7DKHTpdGGSo+JXg27FJJsxTPLp6zZWR6SuSdBxQOlSx59rAkydacnk0b0qY2HQ8+FzdIUojjepSW0V/iNAgSwF6wZY+dYowPOxohWc/MqmqK7n0YhnMmHKkN2Ii7QDRsQ2GbH/rl8b0l7Fd3D1vy38864N9t2RKNLWy0yStC+YgnJNcRrX0ULRjAnOJerYv5F7qoVK7yETTr+oLzyJZ6XLfec69FVyOrBYycs4+iIHQyo8xrNdnSzumh85w9WfUcxOTyMCSHasePUujy4Wa9HguLPfGH87ZNooZV7g==
+  template:
+    metadata:
+      name: grafana-admin-credentials
+      namespace: monitoring
+    type: Opaque

k8s/infra/monitoring/kube-prometheus-stack/grafana-oidc-credentials.yaml

@@ -1,8 +1,6 @@
----
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
-  creationTimestamp: null
   name: grafana-oidc-credentials
   namespace: monitoring
 spec:
@@ -11,7 +9,6 @@ spec:
     OIDC_CLIENT_SECRET: AgBaZdbost10rZ+IQ3ANklom15k8N+5xj2gVZW/cYPF0tgh71OUgLiDBPpMxgM7yB2UMdVeLryr53rs2dvL/aJ8d9wScZNYAOKgSQczEe8XsK1N0BhEAgcaOsoXJ7O5aIub/J3kH67i2l6O+75U1CB4ELFWBzZDbiObn7aVTeCj5W1/Q0xavRTxPwz93ZppubsyNothISYf0O4C/tYS6GuugZpUgvYHsIuWlB09maQy3MXXcVTdvq5uFLFs/QmmOFyOOKXatTywSFBVdxTW9DfZaKeUn6Q+YoglXHrei00Yw31k7rirwGfUsWj8luRbb18eLgkDcBH6VonXufvI5q2YY7M3nEnyc0G9s7D9O6wDVRJRD2yeHZJCAG843wSbNP87OYf9UtQBzXmC4/xtseHMN7bMIC1wf0sBvanjvJz47OduTCfTkPPFKGzDJyD3lWBA/XKzk3sBPc3V8De9frt4tDsfRbi8YQp0ftx3U5sPJHD9EOwDmyz7xOOBnn8So0Hsavwc+9WXPDWURcfxETmoHiLM0zaHosHkDQmMCe5rLuJWQiHePTNNbNd7jBFLZZOfBds9nvmSrskd+AMXq86MiT8kae7nT82ntLxeWUN+Fmo/nK0Aq2Hhwu3D7iNdTZCrzvJospDaVEBOZeCZGyu5nlrFG9HXYksdggPMG/Gsqswn9z3T5hnp4KESbZkfl09eHWNk/gicl8zQwR12wZ2slaDPNdqD8n8DFUfXX5Pfv1nlnr2R8Lt/DGytmyFSebowen5itK3p8eAudpXbdQf2Gfh1MvXSuVN0=
   template:
     metadata:
-      creationTimestamp: null
       name: grafana-oidc-credentials
       namespace: monitoring
     type: Opaque

k8s/infra/monitoring/kube-prometheus-stack/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - alertmanager-http-route.yaml
   - grafana-http-route.yaml
   - prometheus-http-route.yaml
+  - grafana-admin-credentials.yaml
   - grafana-oidc-credentials.yaml
 
 helmCharts:
@@ -16,3 +17,8 @@ helmCharts:
     version: 75.12.0
     releaseName: kube-prometheus-stack
     valuesFile: ./values.yaml
+
+patches:
+  - path: patches/grafana-admin-user-credentials.yaml
+  - path: patches/grafana-sc-dashboard-admin-user-credentials.yaml
+  - path: patches/grafana-sc-datasources-admin-user-credentials.yaml

k8s/infra/monitoring/kube-prometheus-stack/patches/grafana-admin-user-credentials.yaml

@@ -0,0 +1,23 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kube-prometheus-stack-grafana
+  namespace: monitoring
+spec:
+  template:
+    spec:
+      containers:
+        - name: grafana
+          env:
+            - name: GF_SECURITY_ADMIN_USER
+              valueFrom:
+                secretKeyRef:
+                  key: username
+                  name: grafana-admin-credentials
+                  $patch: replace
+            - name: GF_SECURITY_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: password
+                  name: grafana-admin-credentials
+                  $patch: replace

k8s/infra/monitoring/kube-prometheus-stack/patches/grafana-sc-dashboard-admin-user-credentials.yaml

@@ -0,0 +1,23 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kube-prometheus-stack-grafana
+  namespace: monitoring
+spec:
+  template:
+    spec:
+      containers:
+        - name: grafana-sc-dashboard
+          env:
+            - name: REQ_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  key: username
+                  name: grafana-admin-credentials
+                  $patch: replace
+            - name: REQ_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: password
+                  name: grafana-admin-credentials
+                  $patch: replace

k8s/infra/monitoring/kube-prometheus-stack/patches/grafana-sc-datasources-admin-user-credentials.yaml

@@ -0,0 +1,23 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kube-prometheus-stack-grafana
+  namespace: monitoring
+spec:
+  template:
+    spec:
+      containers:
+        - name: grafana-sc-datasources
+          env:
+            - name: REQ_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  key: username
+                  name: grafana-admin-credentials
+                  $patch: replace
+            - name: REQ_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: password
+                  name: grafana-admin-credentials
+                  $patch: replace

k8s/infra/monitoring/kube-prometheus-stack/values.yaml

@@ -31,7 +31,9 @@ grafana:
   envFromSecrets: [ {name: grafana-oidc-credentials } ]
   grafana.ini:
     security:
-      disable_initial_admin_creation: true
+      disable_initial_admin_creation: false
+      admin_user: $__env{GF_SECURITY_ADMIN_USER}
+      admin_password: $__env{GF_SECURITY_ADMIN_PASSWORD}
     paths:
       data: "/var/lib/grafana/"
       logs: "/var/log/grafana"
@@ -44,12 +46,12 @@ grafana:
     server:
       root_url: https://grafana.stonegarden.dev
     auth.basic:
-      enabled: false
+      enabled: true
     auth.generic_oauth:
       enabled: true
       name: Authelia
-      client_id: "${OIDC_CLIENT_ID}"
-      client_secret: "${OIDC_CLIENT_SECRET}"
+      client_id: $__env{OIDC_CLIENT_ID}
+      client_secret: $__env{OIDC_CLIENT_SECRET}
       auth_style: InHeader
       scopes: openid email profile offline_access grafana
       empty_scopes: false