apiVersion: grafana.integreatly.org/v1beta1
kind: Grafana
metadata:
  name: grafana
  labels:
    dashboards: grafana
spec:
  version: 13.3.0
  persistentVolumeClaim:
    metadata:
      labels:
        recurring-job.longhorn.io/source: enabled
        recurring-job-group.longhorn.io/encrypted-backup: enabled
    spec:
      storageClassName: longhorn-encrypted
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: 5Gi
  config:
    plugins:
      # Failed updates unload bundled plugins on the read-only filesystem.
      preinstall_auto_update: "false"
    server:
      domain: "grafana.okwilkins.dev"
      root_url: "https://%(domain)s/"
    auth.generic_oauth:
      enabled: "true"
      name: Authelia
      icon: signin
      client_id: grafana
      client_secret: $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
      scopes: openid profile email groups
      empty_scopes: "false"
      auth_url: https://auth.okwilkins.dev/api/oidc/authorization
      token_url: https://auth.okwilkins.dev/api/oidc/token
      api_url: https://auth.okwilkins.dev/api/oidc/userinfo
      role_attribute_path: contains(groups[*], 'admins') && 'Admin' || 'Viewer'
      allow_sign_up: "true"
      use_pkce: "true"
      tls_client_ca: /etc/grafana/vault-ca.crt
  deployment:
    spec:
      strategy:
        type: Recreate
      template:
        spec:
          securityContext:
            fsGroup: 10001
            fsGroupChangePolicy: OnRootMismatch
          volumes:
            - name: grafana-data
              persistentVolumeClaim:
                claimName: grafana-pvc
            - name: vault-ca
              secret:
                secretName: grafana-okwilkins-dev-tls
                items:
                  - key: ca.crt
                    path: ca.crt
          containers:
            - name: grafana
              volumeMounts:
                - name: vault-ca
                  mountPath: /etc/grafana/vault-ca.crt
                  subPath: ca.crt
              env:
                - name: GF_SECURITY_ADMIN_USER
                  valueFrom:
                    secretKeyRef:
                      name: grafana-admin-credentials
                      key: GF_SECURITY_ADMIN_USER
                - name: GF_SECURITY_ADMIN_PASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: grafana-admin-credentials
                      key: GF_SECURITY_ADMIN_PASSWORD
                - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
                  valueFrom:
                    secretKeyRef:
                      name: authelia-grafana-client-secret
                      key: client-secret-plaintext