apiVersion: grafana.integreatly.org/v1beta1
kind: Grafana
metadata:
  name: grafana
  namespace: grafana
  labels:
    app: grafana
spec:
  disableDefaultAdminSecret: true
  config:
    log:
      mode: console
    auth:
      disable_login_form: "true"
    server:
      root_url: https://grafana.stonegarden.dev
    auth.generic_oauth:
      enabled: "true"
      name: Authelia
      client_id: $__env{OIDC_CLIENT_ID}
      client_secret: $__env{OIDC_CLIENT_SECRET}
      auth_style: InHeader
      scopes: openid email profile offline_access grafana
      empty_scopes: "false"
      use_pkce: "true"
      use_refresh_token: "true"
      auth_url: https://authelia.stonegarden.dev/api/oidc/authorization
      token_url: https://authelia.stonegarden.dev/api/oidc/token
      api_url: https://authelia.stonegarden.dev/api/oidc/userinfo
      signout_redirect_url: https://authelia.stonegarden.dev/logout
      login_attribute_path: preferred_username
      name_attribute_path: name
      allow_assign_grafana_admin: "true"
      role_attribute_path: contains(grafana[*], 'grafana_admin') && 'GrafanaAdmin' || contains(grafana[*], 'admin') && 'Admin' || contains(grafana[*], 'editor') && 'Editor' || 'Viewer'
      auto_login: "true"
  version: 12.2.1 # renovate: docker=docker.io/grafana/grafana
  deployment:
    spec:
      template:
        spec:
          containers:
            - name: grafana
              env:
                - name: GF_SECURITY_ADMIN_USER
                  valueFrom:
                    secretKeyRef: { key: username, name: admin-credentials }
                - name: GF_SECURITY_ADMIN_PASSWORD
                  valueFrom:
                    secretKeyRef: { key: password, name: admin-credentials }
              envFrom:
                - secretRef: { name: oidc-credentials }