feat(grafana): oauth/oidc integration

Signed-off-by: Vegard Hagen <[email protected]>

k8s/infra/auth/authelia/README.md

@@ -0,0 +1,5 @@
+# Generate Random Client Secret
+
+```shell
+docker run --rm authelia/authelia:latest authelia crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
+```

k8s/infra/auth/authelia/clients/grafana.yaml

@@ -0,0 +1,12 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: client-grafana
+  namespace: authelia
+spec:
+  encryptedData:
+    clientSecret: AgCafFCQXtfqrnqC0Wbeuso1WW4IyutCmKLY9q4yewHGAahBDLhVqsDDV3mMrX81JSd9Y95rA5UnUUWjWmivKORoMrLimCl9DEJBy8r5VMhu09a9GXQtp0wy09N3X3sXBRwu9OKx8Koaj1aZoXTWMrAJLOiV5V17muukGbq+oIUg62FnOCPQIbfufdxWwvhLK5MSNcJrHun1Yl8Lc5ovlr6rq349Grl2dNnu05nz7SZ3NhwjoZTumCejVbuSi3hVhpbCM3Va507NoqKxx0hb2XfvG0PAP43RDuSX8IkKWa9spkbkIDbiJVidoF6sKtYp+Wth35uFHpL30evnRm9cC8U1uxTrkgZF+D2VK2/9UkXbvTwb1N7gpop6dCkhQb+M1PiG+dLtTX1oplILP2iZXX47Rd9hdCPC5PRwCrmuasjrDb6Jlxa0ZfjgGlpgwLsX4Z1jO+WBG4i3stYr/I4/IOjex3gxDBSYuMr4MiC0/Is0HDjeScvdO7LY+tglWlxtZFdytrV1cqMRdIKGYqNeOULea74vcoxOEWtpNtRyejimZ8iWvlaYcg8z45nYZ1RTFb2AS5EfKzzNjlJWuh1ULuoTZ5DMjRrauaJ16wH+TCt7KfKvTiCTs6jag7yN6RWUHj1m/+keA6ZMaoXcSDC/iivY21vPox9YzsKXAhfrx8AcY5Nsy7roKsJ6nvHjII/SCuWZhz/aVOF4uCsPg1tOJe1Dev3TkG+sCsatNsWHieyK2bxbw/IImN11JmAjaRpRbS5IgYPz8ZOKM5A06W9QjG5HhdEYM341vsBmx0IJSNqffo7Qk7Zt6NowXAT/T401EMYSKEU22ALu0RVFW4M7/g02tOXXinxV9k0+kVQq0fh65qcZFQ==
+  template:
+    metadata:
+      name: client-grafana
+      namespace: authelia

k8s/infra/auth/authelia/kustomization.yaml

@@ -19,6 +19,7 @@ resources:
   - cnpg-db.yaml
   - clients/argocd.yaml
   - clients/audiobookshelf.yaml
+  - clients/grafana.yaml
   - clients/netbird.yaml
 
 helmCharts:

k8s/infra/auth/authelia/locales/en/consent.json

@@ -45,7 +45,8 @@
     "website": "Website URL",
     "zoneinfo": "Timezone",
     "argocd_claim": "Argo CD Membership",
-    "audiobookshelf": "Audiobookshelf Membership"
+    "audiobookshelf": "Audiobookshelf Membership",
+    "grafana": "Grafana Membership"
   },
   "scopes": {
     "address": "Access your address",
@@ -57,6 +58,7 @@
     "phone": "Access your phone number",
     "profile": "Access your profile information",
     "argocd_scope": "Access Argo CD memberships",
-    "audiobookshelf": "Access Audiobookshelf memberships"
+    "audiobookshelf": "Access Audiobookshelf memberships",
+    "grafana": "Access Grafana memberships"
   }
 }

k8s/infra/auth/authelia/values.yaml

@@ -68,6 +68,7 @@ configMap:
         extra:
           argocd: { multi_valued: true, value_type: string }
           audiobookshelf: { multi_valued: true, value_type: string }
+          grafana: { multi_valued: true, value_type: string }
 
   identity_providers:
     oidc:
@@ -94,8 +95,10 @@ configMap:
           id_token: [ email, email_verified, alt_emails, name, preferred_username, argocd_claim ]
         audiobookshelf:
           custom_claims: { audiobookshelf: { attribute: audiobookshelf } }
-        # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter
+        grafana:
+          custom_claims: { grafana: { attribute: grafana } }
         legacy:
+          # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter
           id_token: [ email, email_verified, alt_emails, name, preferred_username, groups ]
         username_email:
           id_token: [ email, email_verified, alt_emails, name, preferred_username ]
@@ -104,6 +107,8 @@ configMap:
           claims: [ argocd_claim ]
         audiobookshelf:
           claims: [ audiobookshelf ]
+        grafana:
+          claims: [ grafana ]
       clients:
         - client_id: argocd
           client_secret: { path: /secrets/client-argocd/client_secret.txt }
@@ -111,7 +116,7 @@ configMap:
           public: false
           authorization_policy: two_factor
           claims_policy: argocd_policy
-          pre_configured_consent_duration: 1 month
+          pre_configured_consent_duration: 3 months
           require_pkce: false
           redirect_uris:
             - https://argocd.stonegarden.dev/auth/callback
@@ -127,7 +132,7 @@ configMap:
           public: true
           authorization_policy: two_factor
           claims_policy: argocd_policy
-          pre_configured_consent_duration: 1 month
+          pre_configured_consent_duration: 3 months
           redirect_uris: [ http://localhost:8085/auth/callback ]
           scopes: [ openid, email, profile, offline_access, argocd_scope ]
           id_token_signed_response_alg: ES256
@@ -142,7 +147,7 @@ configMap:
           public: false
           authorization_policy: one_factor
           claims_policy: audiobookshelf
-          pre_configured_consent_duration: 1 month
+          pre_configured_consent_duration: 3 months
           require_pkce: true
           redirect_uris:
             - https://abs.stonegarden.dev/audiobookshelf/auth/openid/callback
@@ -153,12 +158,30 @@ configMap:
           id_token_signed_response_alg: ES256
           access_token_signed_response_alg: ES256
 
+        - client_id: grafana
+          client_secret: { path: /secrets/client-grafana/client_secret.txt }
+          client_name: Grafana
+          public: false
+          authorization_policy: two_factor
+          claims_policy: grafana
+          pre_configured_consent_duration: 3 months
+          require_pkce: true
+          pkce_challenge_method: S256
+          redirect_uris: [ https://grafana.stonegarden.dev/login/generic_oauth ]
+          scopes: [ openid, email, profile, offline_access, grafana ]
+          response_types: [ code ]
+          grant_types: [ authorization_code, refresh_token ]
+          userinfo_signed_response_alg: none
+          id_token_signed_response_alg: ES256
+          access_token_signed_response_alg: ES256
+          token_endpoint_auth_method: client_secret_basic
+
         - client_id: kubectl
           client_name: kubectl
           public: true
           authorization_policy: two_factor
           claims_policy: legacy
-          pre_configured_consent_duration: 1 month
+          pre_configured_consent_duration: 3 months
           require_pkce: true
           redirect_uris: [ http://localhost:8000, http://localhost:18000 ]
           scopes: [ openid, email, profile, offline_access, groups ]
@@ -173,7 +196,7 @@ configMap:
           public: false
           authorization_policy: two_factor
           claims_policy: username_email
-          pre_configured_consent_duration: 1 month
+          pre_configured_consent_duration: 3 months
           require_pkce: true
           pkce_challenge_method: S256
           audience: [ netbird ]
@@ -206,5 +229,7 @@ secret:
       items: [ { key: clientSecret, path: client_secret.txt } ]
     client-audiobookshelf:
       items: [ { key: clientSecret, path: client_secret.txt } ]
+    client-grafana:
+      items: [ { key: clientSecret, path: client_secret.txt } ]
     client-netbird:
       items: [ { key: clientSecret, path: client_secret.txt } ]

k8s/infra/auth/lldap/lldap-bootstrap.yaml

@@ -5,9 +5,9 @@ metadata:
   namespace: lldap
 spec:
   encryptedData:
-    groups.json: AgA+5dJGIkRcjNOIm+ockeAF7Qp2nr8SQdBWLGHomXiO8DraOkH6yFuNLuU/wROiGOpJ8OUxOshQajtnDyEXqZ/gKBZsUsfd14+5AuIe+vrVvvixyDW2bykANLeakmUepVBMpnIFz8Rj7GvMzQr+Zl6CCwi+GGjn6m2LaoLHWfCKVJ5+21Be+wEz6E6AuHaNKD6bPCWuu+a2PYIRarMHOlwZ4+mFsZN3/991ND+5O81MEZJLeatpgLDelsL7uWDmIu1+oEqWo/FRZmo2tIXQ+8QNnSkYx3fOhmraKrPdssgiaRQ48+h22iq10b5hJxjMaJiuPqlU21R6h/qsgilXXGiraZjdCASo/H6tEObNtCxx/Y+gAumHHOUI/fPttGX9GZFE+Ak6W0c/VgkOoywfjnMIC6YRn8XZtNzV52QSu/kuyzMHPZF+fQgUR/FzxnpOJF32yaON43EX6j4P/eI7NAI5jbiXCabMtZPWKqsrziUKYfKAhWzV99bAITnuZFDBAPz9qwB6f6GUFRVeFuvxHr/fUK9O+SLuiaI0aoWGiFvxkqigypbMGfYrqmYvJNwHdLOqSm1h+PAqp0sell68yteeuu74gSqJm2fZcMXVPd2ZxNgUAyzohlrxyspLBAIAfjrULOpIb3efr+m5HlzY0/9100pTw3eWdY4fJnKkJleE7CKJ6CD9gHnRfRWY6JICyMRvQmJkOFmteD+U2c3f5A7vtQSdWhTJ30YXCVmHmHGHovdZ
-    user-schemas.json: AgAiliTJHZWq3YcKksoGQHnZx5HAgV8JeESAdp+nDWdC7aiTOgPhozwsjydLDwa+lzIPyKOQzXx2XgQNOPuDfiKJ5dZgpwmCX9xV9NjUXZd2ZSLS37l8QwEp99dYIbiu1eqULyV3OnaNTHxwVaoF1Mhodz7GWMYl8u5W4azUPoLSmEt4jScNWfFdteFyabHeHgGBo98uqemiW2t9J4XKYYiv4Ynf25Hc5Wke9KrMO/jiGvBbvpaEDNi7mCRSReUBDPswBBhqC7ieSXaolDpqLlfmcfVX3XXzhtobXY1L8gPV2MNXxahp+DcFxIlMIUwteKpDopzyW6cL/VwH9DTnJTohoIvk1I0LhH2afZBpwKeYVEaa3GhE0OJSwEn7ejpUVhLIMILmt7r10HmBg8uvwOkA1t9HqUm98IDFrLTBiHB3SiOy/a4bLREvFsdOLtgXyr6GIEleOamCGGl+XvaNnhskggyjTLFeYMrqbMH0lRUUeublR4HDGQZD4uqOgn8UR4MEz4onRXfj/zw50Y2x46wW2kNRDKVs7cnIXGWfDGIv2obcADdJEONtjLDLrM50dVIU1f7Ue18W5h0D/sLxBGJxmfJHOAhlOc0BaRDsIUNntZZBg3Uw3G9bFNBBLqOUiTgnIhKrEoFUfU88tXB3JKSPQZBzFS8P0a5KEy1XGKZzZuiT/qXjo/+pfEL7iq3bgJ+S0/zUjVOzASMLiS5sQLrH4UUT4Jmbr7kogFtkgnM2xkIoWOTep6OnfXOe80i0/nPTcr6jQ53OsERp+MMSpzwTog1cq0cXH47iRJO3RNqFn6pES4167wHHZh4rPP40LPq2u8C4Bp0ehQd1j+rS0cq4xnYeJVrmcC2GqOuRNvmBcSXzWZscKrks7NWZVF9Gn2irPEPfymmfxEiuET6IZEaRO22pwLKRMOHXD9kfJqLdPn6mQNqIufTuJFd4BuFUR1ze1xXvOdGC5wsJQg5emMOje3LbYIGG0W83bGYAq78GYfFiSu8nlRTXNlqzZP3FtWsaGwIDYnmQG90m/QIyFzrfbdyrJMElze2KSUU=
-    users.json: AgByc/anHTe1+B1NZvB/azqe9Z8voMD/wlYRLB58vCTECYR/WkGttxXWx7rFtgsnUYkE7CUjyTCXRcNjvV/ZF3OebIiGK26RIwsIZM7TOmrfSK0q6DxATSwbYjpoaUbe8YDE2HpyotELOo7PXlD3wgVHbvN4CZB3Q4UfhVdqoCkpM27J4jYQAci2z1u1eAFK1XJJnmBpVlDyqgsrhnNul+DOPae7+TVBTaiVoWcWptFzVZ5GinqixUpNOw6Ena7KsHpRhXCYjRv6Fu8a6T8NmwVCS6mIbZhMKDyyfvnqewuwfiVWIrCuaShj6vHV756Oo8yY0f6dbaIfuGQIWE6Gs4m1N8554IQvg/DkXXXLS22A0YU84KmMO4CYWsNUX3bX6vpFmsws9vpe7siekm7hnDSu+PcJA8j4JOxoAdyVhOw2CyeAZAPKhkh7+Dc9kt9BxU4cscUZIruQpji5qIW9WVvR7K6IsKbDFsbVWqmIWUgGUAAJ9qSRSf87SMJR2RZTaCfkKm3XJhfdL0JYi2aFsPJmQhqF0zb4WGQ7xMSMdbY1BgqzNnUsJXnHgCK36VFQUSKLwrKUr4ByL1Ot2eO725yShq8JgQKmIeXakPlaLw64dtNZP1QxcV9qqDTz4mahE252EpBG8eVEa0HJsRT6tV1yO3Fiwj/b31Z2JiJs6UQNT8YBLA7/1IUaKxo1o4ewZ96VZhGNXkVc4ZdODvyFRZuvKS+yivnqOCrS9+yjSNi6dcNbDct0nNS9MGK/kHJaw18j7OCKkakt8cpni8XSCBXp0pxXKhPMq2vjz09v77Pa5CbsyNCjXc3Z9t+nCgvlvWNFQSmNEPYTmv7gn3Qd+wJRLossNKo+kH5xL1UqjFshtulzIKhkKTaq6WDTKKFGxImrSO3tRCKFofC6uO18aWAm9lrn0cZOfjaaq4M3Om1L792DSbKMAxdPBkRXBuwyoIoCYQOIG8jGjs5NserjMreSihv1el4enf3XKx4jCLyQFK2y0dFTfIHYC+Kwt5ulLUAWTuouJ73KbEmltobKRChkP3QZQte0wxSD10boi0ehGFs3m8wNgqtI0weho1UMNFi+rHlQ6TGpyS5av+9J/q4cTXFnDMomNAazT71R4FHnAWDefOQW8ev8Y4JUJFTKm5XAnuwxZAP7lNOSNRUZM9sZbH9e6kuRwM0mNv6iWVTkntHBFvGx824qMl9ow8Fmou+rQNzxsQRrgOeYl2VTtGqjXduPXnoxUnsMFe76q8gAtSQHNbckZRDNU/VjYMunQ9nROFRyfwswki0jD2h17FOa1XYhGvr9Sy4reW/Lq+2zpMZzjFnJmQ8zKWlY2h/Hb3XYbz7BKOlNDR/b8CS9NC4qUHrYSptgY3lDP+EorBPDha3rfiWakT+XSpMrXqHPUSIqeInm6WOL7KuaIc03/9+5EsIQsjkZiTe5kU2f2Fjjn6qhCj3Y51kCnb4Xp6TMdaQzNQqxVcYmiTYXmsC/B5XZyFsQJqU9U2DSAW9/PtTp1YpNH8GcNCjB/DxJe7Bym8hZW2shvR/0PbQiMerYdbvzOudX6OLaPzi6edfNHl02mACS4wAhJCqCZPFb8+M/ubhMmtklLA3/ob0Bg12f4u4v2lFLKMHAyA3zkohL/gydZb57vrF1loy9cgeVeY4JahWN0/Zn7gNCYabzcVgFPSlGGS6MMMyzzVYi3OXckXhPhEhgm/3tOIi3Pr4xKNqidPRmWRSPWrv+dZlUbAQg8KL5Vl4P4gTQ7M372VET4skpIyWf7BACdsIS0bmRfuvBHkYARRtRC2KlUaI5/6qmaTlzhYCNGrqkk3cvW9OsOE09pislwmbexP8KvN21fkXXov1+g0BnbEm69gk3FucspQPdp4YZftFCJ1D7yPcLh1t0KQJWfeEwWpWEMo1mlF3RpYGEFH7QKkhexE5i8M/IO9DVlmhwRtYSO24IX3h7yVxkW/HUg9OjQ2SWa3bJPyleqUUZIKfLWdpedH9wkq7TBPOW27KJrsWQfcJ3lbYUasyW9+e7Qon1sQschQ2qM+xEWj83J0ok2rBGxtxcRrbxKGBLegivUWJOqyW/IYZ8wsBaKq94MZFneACaTl77sb/vzulR7z1/RkwSColHPHZnRee35VTbCufPvJYQ2NYumW3f3vDUtsmA/qYFg2T15kRMSt/7ChL0EZJ3bUG3h34=
+    groups.json: AgABOLCgqEYybXfcpfzv6Kcf5Zwsw+nUX9t9sDftix9RWNlSX3ZE7+m7pONph07luNly9eFAxW1ztPvaU8ZDhNjEAApV2P42d+Rapp/niIE4xVBjLkhvo4tz8sCSjBCiL5d6VwzhXTB/rL1+998ZdEGz1K2isfvYt7rbjMfiNAftN+YBphYD/UAPXlQTpmf6APjk0z0chzSoT6LNs8qmUwrBfjsHT/8CY73jZWrf1v0OfH8QtePqNKWieguSsLMj34kVXvPlpEvOlMKldUhIDihIK+8tvRwFpWxyXj7NXmtbBve0evZPfrc+Zy3CguYdFuAmyzKI9/1wTBB9fzFVIY6zBoFBAhMk2qcWc0s7zimTOwLPYdexQBfPtqBCrySDmSaTmAeaOzpXRdx/BLUnySL9AdrEgj6z4Z8l4U8E2qfd4cl4SAq3omY7eNC2sKddvx5FWBqqFMpwB67QGcQ4VbISXSGClD3GYALS3mtnzq19XVpi35pvEO8bAwjwzgv8ZsWbrWwAQAAFc/lULTVD6Q5A7Rx1fvm1ARNyK0e+QDl/MYRpsUyS7FBmhweJlOM+1B+D8tWkk2pDFFMGPEITp0WwqbxblJBQt5HBdqgYmTBv4qUcRUEKZYEp5csEkQFIqS7NEqXLeZYAzKayyVycXlZDIxeW/rv28P2t7knbF0Avl2bGc89hmQcByFU/mVFHtdl+Zs8Mz+U2xKk7/6iGYBUoP4bUoRkcWhIYv36WG7N1kS1r
+    user-schemas.json: AgCt+QoucHhbK/vrP0NCjd2Nj0Ud2KdoINjvN/MEAtiNfl3yD1QUNaUPZM6J9ko7UlYyLCjkks3ycQNsQ8WmMhWMt1FTtYbSH+vRNRT8ZI63VA3PKuv6axVymp1rQvppfa5AvK3RYj5kv1lTSWuJnDbdg+YEakbXD4yBEsEt93reWSemeMfcmWiDnU2/840YE3mMVBdWbSKAcIgVqHzo13D86tjzuKc/zjxoxtULDLNogNt0hGimeE/q11j56k2hvomyzBCkdVrXB2aOTAFvu/MdLjhPIbNByklwi9aPQmvGH9tBVCIaTlLRs/hVOmansre9dMT+YbpxYKZIE2q6ywxZVJ32Lc5QIRcIHaNjaCFkG2oAOUZauyR3Nhm/O5AIQRIkH70CgyNjjvUCgdTTm6BqlKpH5oE3jTH/q7da8KT0SLSzh6K4OphvQwFTCiG7l6jmLF5GcvCp9DY7qohFSh8bYf3Et8HPugrU4mOrwLrWX6clrSS0VthryzBq5Yygu6/ST5rL4zh6w4Dfd0Ga9x9tlXWL+fh4DrOXxoV3Px5XcqeHQ2D8U6p74D8NLEBEYyXLf+KtPDB/LwNuQp585GqENPuAOrC8xD1DPvk3/l7V8B62n+akFTacAI4YU+OtTGGJEPcfOM4fzgfESVZKVwFTPPlPbVuuHqLH148n3Go7d/VJCda/7jf0z5Xj+FUKr78LA9dioiEWZ/kPOcW9M9msIFnCPbTFaMvZISfvbwI0kZ1sj3UaSNblcxTlTgzeD4bDZhlFvOjW7E0Yk8/djcKvGdCo45ziEB0Mundy5XopRDqygqOwpapEKxM9g52fg2QTKQv841RNXJB2C4DK8yljr4qnZGgkEihNyMn7u7VIByMskmwqAdUz0P1yWKEAUjq+9VDOTTlJ5ir0LWwgO8PGxtTyTWvW8ZaedEimGi1xtmexiBWQUC+WLrMYelOD+W/1AowgAfDbkJ1Fih6zJMNmKf5pKR0qOSENJnbrQATxSTwWych0+fURuAyL3l4m7u//oOHAqOgIdB9+2bRY7RAwWZi20xEEVQSPEfEUF8Zk5UC1fuf2t4KS7iHKgXe2KuFXpwgsPOWQXrURVqEdPOLj4pi8vll34ePOweFhSTS5RkTE1jEQaECiFUumngtxNG6eqfElwFqNEckDxpJ9Hs5ErUrEH/Oqszs2UV9HdLZC3hFzIyX5I81v0smURS4hmV06aS+/Dbuq65lVqO8=
+    users.json: AgAMaQAe9HlrIiXVRD/UX7x5TXSA+eQInv1Jpw+7BRTjuDN9a2cMYjCfbp1Dw76csq+FkbkpfNVCBqx3un9N34A3v5c3n4WN0DqETS6cFM6V8dxb8ywccs6hsezXmSz/EotO9kHNm3DzoSO1LN8axBL6LeXbhlcAycuJPF/UPSOJknA/svdtE4UNqv8ZEAGLabbSg8crVtm/+pi3H2off3Bd6fIbOxNpW5oGJaacT3x3q0ccqtkBzFEhoSHJIWzjT0HPsXhRTl0M/AaEdwvmslx6pKpobQEi+Z1InTiOTIj/8XL6hf2WEPhmRXO4BEVE9hEfM2bnOSgp37p/sCurb6TqaGtlD0Tlgj0AmmxbWAF54muJbD1km6nq5oap+ZNQ+aY0E9k9ReIqR9LAodMLsCBDEtuCiKLqSnDJlD4zspiP+VqQwAw9Xxpl2JeEUGW9CMIOhgkrMqj85+eweDPDJPnsnG106Q+TKM14yWpncERSX6eptxZfwIG6OCDiKgwvhwxXrIZfJGSQi0l/AcbZMVp+kyXbJ2ZUXRXE4wBXxwW9QDzjNcrhRy7WlQN+pe074cxGVgzze9mimNiY+XwoZZLpPNWZSTW3rKzAh07HU4TPShW+d4GXJClrl3ae8r2ppCa+Q2S3B/Vs3JGNamhhvX7mtcvG9L2Dq59viOz+uXez45S1jUypFJR44dzD2jknkGdA/FcZuNOF7PqzWTO3Dcx0koldUcIbXnRJHS5sDrRR9Lnx3iYwklZ3/QoBI6xccqvo/NqjascwyeyrOoj+vaywF6wo4SXco0ry0MjyNvI+KgBp54oyvzwYJOc7Q74f87eCSDwKCdJYPXTYmD6uPf+GInROM7uJeErYsI+oet4o0kMyGfJoQLzvhe1YoTOwMiFbDHvI0hxoHSW306QWx18nsXvxnpQGfYNgUic80HlwOKpvEk3Ed4L8lvSSzIHp3PGU+uCVGmaO3WvB5Mvb1qk9mnZM4D8UeG3oUaMBJ37kUb78YghNFCqeJv2C7MYbLTNNvH0dDtF8jZ+gDu8LQ3IbhCCqs35NlUpjPCiRDxmR4bzIysXGk45h+/4prU09gMz+xIsXOL3lM+4QYj80y2anYZe/kQsSd76ZttkZ3Kf1lt0GqcmcvttF8XXw1CfoDFxaNeeGSvQvD4pLmSB4ODXxzKbgx0pxID+uPHpBYLvUXqKIVM/P9GlrUoTVS0DTPys17MAldcx0GDmmzodHEODZp/LVvYFknRLtT3gkn+iW/pcGvNeMGhq7RG3Gn/VoHDx/2EdFb39O5wHSD+Sjs14Pc+4fAEulptSSNVWHqWgXmq/nwmWp96bk+zqqybIrBoiJJeNzKXZ5lHOs6z8AFQnaJp88XE1gpUgY6CciCO8cE32pWMhngRRk/2G9K+TSVvqT/MEJmxYjoh+HsN0rVLj/rk9le3KNT+86rQEVDZSt6M+kwQGR8YjBXqpcTVj6Gkv1r9jNLOLhBZkMwkjN094O8a0w4fEuImPlvOuSsTx/w43bpE5dyZkpPLGSqzbrFDobo1cRcB+/J+Hn2Bz+XlHzN79DL4HoOVIYmEWFx0JE9ZHHNas+3W0s9b/4vHqrLU5XH5up8bLmcMSm/6y0iPAZGRaEgY8UeEe7G0I8EQkOIwHE3QtEQn/Pbj8WXlF7ozlsZl3AbSeFykneKGrZNk+2kXa4QCznU9jL1cus5EZlAdRbytVyQH47jv6gd7o/lZGdn6uuRkrVMMwj8GNLtz6Z2pBH+gKeCGHbciNYN3BUDQM5yvbqVyAu5exOONBbpfbfIZKhY1QyHKkKCzRs5RiWJuUOUl0juDIMspYbwIiIHJGE7faUVO6LIlusa8imrrGjF+DptBk8TPcQ1Ruhc39Wb3ITUWvLcBteMX74oDter3gwxwmwGLfn126DbvnW/ePsO/5W2MW3U35myFPTGklEBr3u4MUvurZCg6dQFbi19Om/SJSjkL28kCZ9N0yQICjLMLnGpjEv1wvbyxaW7UJXc/7Ob3LZVgbuvjVMUc6M+8Cgm6JPpWt9ebKTTdKDIUVifrkPDUoo3wcJnpJ4sFShVZQyTAlT2RMe7U4IskZ92UiU9ZMweN+cE+RyawZLcYAw4nD2QfvT2Fhjj3z0GCt3O/JTTtEyzJkljLAgr9TObFCLF9NHATVNxpvqN/ecemNoryGMY+xdcqkd3UMJ93p0zCuJidJSoBulFhdw97fBIUnbx9LspuCp0S5be85o
   template:
     metadata:
       name: lldap-bootstrap

k8s/infra/monitoring/prometheus-stack/grafana-oidc-credentials.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: grafana-oidc-credentials
+  namespace: monitoring
+spec:
+  encryptedData:
+    OIDC_CLIENT_ID: AgBwGjdwv90PrLAO4MmMbNUgrXwe+BHWkkIsYQFsjAk0+VhhVOTwMm7bChwJxv8MY73RUisO2mHOvpUm0l08t9MaRmFKdMmFJ7LT600VrTVag+3s3gRrW0mgwuOBR2KQrQ+G4c59jJMgOwJQEHLXG8+rsXUWJAjE2+l9oSuBwe54C7ozniwJXzuO+rgkI9Ha+dVXiuFuCkkKI3SgFgVb4G/mZduJrWoWAhIPG2lj0KmIUB5Bqqu47nuDMOQtQb3JKXJyXEsxHDuC35J+IKztXp28tb/JL7XaxlWF0TumAX74ZKOd3S+L8hcuXq3g0lC5962bNRyLMbheq+zYzle7sXdkLXikrD0TTXKfTOlF1uAGykJgkJ12HJvqwrUO/ErTOpb5nUwGVmBbq9d0gC0SLJkowe27smmtWtN/RJuaxg3xwBAN3r4DOADVWtzeR8Eb1oLDPPeV/xO6ZyAo2r1rEQ/a+q2H7nCeVIszAJaZVrLlWZH8UcZbMxxfjuOmZoACaDOHmqjAIysJhrQQySFIrL45DuQ+unw44M2Bzz/hl+YDQz843UAbqSJeLg/+u6o/jOgc3DVMeCIFNkvUVScdh3Ro/IRY840kTu8fI0xlhQdGFwIWQ7Htak5PhlzViaoqfMQyhq8znbqubmBaGEgyrrYp0y7v2b3DdZqzyCRAOBJj5HQaXPaSFSIsnQXI/tEfmmEIgNY9ylZQ
+    OIDC_CLIENT_SECRET: AgBaZdbost10rZ+IQ3ANklom15k8N+5xj2gVZW/cYPF0tgh71OUgLiDBPpMxgM7yB2UMdVeLryr53rs2dvL/aJ8d9wScZNYAOKgSQczEe8XsK1N0BhEAgcaOsoXJ7O5aIub/J3kH67i2l6O+75U1CB4ELFWBzZDbiObn7aVTeCj5W1/Q0xavRTxPwz93ZppubsyNothISYf0O4C/tYS6GuugZpUgvYHsIuWlB09maQy3MXXcVTdvq5uFLFs/QmmOFyOOKXatTywSFBVdxTW9DfZaKeUn6Q+YoglXHrei00Yw31k7rirwGfUsWj8luRbb18eLgkDcBH6VonXufvI5q2YY7M3nEnyc0G9s7D9O6wDVRJRD2yeHZJCAG843wSbNP87OYf9UtQBzXmC4/xtseHMN7bMIC1wf0sBvanjvJz47OduTCfTkPPFKGzDJyD3lWBA/XKzk3sBPc3V8De9frt4tDsfRbi8YQp0ftx3U5sPJHD9EOwDmyz7xOOBnn8So0Hsavwc+9WXPDWURcfxETmoHiLM0zaHosHkDQmMCe5rLuJWQiHePTNNbNd7jBFLZZOfBds9nvmSrskd+AMXq86MiT8kae7nT82ntLxeWUN+Fmo/nK0Aq2Hhwu3D7iNdTZCrzvJospDaVEBOZeCZGyu5nlrFG9HXYksdggPMG/Gsqswn9z3T5hnp4KESbZkfl09eHWNk/gicl8zQwR12wZ2slaDPNdqD8n8DFUfXX5Pfv1nlnr2R8Lt/DGytmyFSebowen5itK3p8eAudpXbdQf2Gfh1MvXSuVN0=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: grafana-oidc-credentials
+      namespace: monitoring
+    type: Opaque

k8s/infra/monitoring/prometheus-stack/kube-prometheus-stack.yaml

@@ -1,29 +0,0 @@
-# Need an extra Argo CD Application here to do server side apply
-# https://github.com/prometheus-community/helm-charts/issues/3345
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: kube-prometheus-stack
-  namespace: argocd
-spec:
-  project: monitoring
-  sources:
-    - repoURL: https://prometheus-community.github.io/helm-charts
-      chart: kube-prometheus-stack
-      targetRevision: 75.12.0 # renovate: docker=ghcr.io/prometheus-community/charts/kube-prometheus-stack
-      helm:
-        valueFiles:
-          - $values/k8s/infra/monitoring/prometheus-stack/values.yaml
-    - repoURL: https://github.com/vehagn/homelab
-      targetRevision: HEAD
-      ref: values
-  destination:
-    name: in-cluster
-    namespace: monitoring
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - ApplyOutOfSyncOnly=true
-      - ServerSideApply=true

k8s/infra/monitoring/prometheus-stack/kustomization.yaml

@@ -3,10 +3,10 @@ kind: Kustomization
 
 resources:
   - ns.yaml
-#  - kube-prometheus-stack.yaml
   - alertmanager-http-route.yaml
   - grafana-http-route.yaml
   - prometheus-http-route.yaml
+  - grafana-oidc-credentials.yaml
 
 helmCharts:
   - name: kube-prometheus-stack

k8s/infra/monitoring/prometheus-stack/values.yaml

@@ -28,6 +28,42 @@ nodeExporter:
 
 grafana:
   enabled: true
+  envFromSecrets: [ {name: grafana-oidc-credentials } ]
+  grafana.ini:
+    security:
+      disable_initial_admin_creation: true
+    paths:
+      data: "/var/lib/grafana/"
+      logs: "/var/log/grafana"
+      plugins: "/var/lib/grafana/plugins"
+      provisioning: "/etc/grafana/provisioning"
+    analytics:
+      check_for_updates: false
+    log:
+      mode: console
+    server:
+      root_url: https://grafana.stonegarden.dev
+    auth.basic:
+      enabled: false
+    auth.generic_oauth:
+      enabled: true
+      name: Authelia
+      client_id: "${OIDC_CLIENT_ID}"
+      client_secret: "${OIDC_CLIENT_SECRET}"
+      auth_style: InHeader
+      scopes: openid email profile offline_access grafana
+      empty_scopes: false
+      use_pkce: true
+      use_refresh_token: true
+      auth_url: https://authelia.stonegarden.dev/api/oidc/authorization
+      token_url: https://authelia.stonegarden.dev/api/oidc/token
+      api_url: https://authelia.stonegarden.dev/api/oidc/userinfo
+      signout_redirect_url: https://authelia.stonegarden.dev/logout
+      login_attribute_path: preferred_username
+      name_attribute_path: name
+      allow_assign_grafana_admin: true
+      role_attribute_path: contains(grafana[*], 'grafana_admin') && 'GrafanaAdmin' || contains(grafana[*], 'admin') && 'Admin' || contains(grafana[*], 'editor') && 'Editor' || 'Viewer'
+      auto_login: true
   defaultDashboardsEnabled: true
   defaultDashboardsTimezone: Europe/Oslo
   # https://github.com/grafana/helm-charts/issues/527#issuecomment-982319638