grafana.yml.erb

apiVersion: v1
kind: Service
metadata:
  name: service
spec:
  selector:
    app: grafana
  ports:
    - port: 80
      targetPort: 3000
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: deployment
  labels:
    app: grafana
spec:
  replicas: 1
  selector:
    matchLabels:
      app: grafana
  template:
    metadata:
      labels:
        app: grafana
    spec:
      containers:
        - name: grafana
          image: "docker.ocf.berkeley.edu/grafana:<%= version %>"
          resources:
            limits:
              memory: 512Mi
              cpu: 175m
          ports:
            - containerPort: 3000
          volumeMounts:
            - mountPath: /etc/secrets
              name: secrets
          env:
            - name: GF_SERVER_ROOT_URL
              value: https://grafana.ocf.berkeley.edu/
            - name: GF_DATABASE_TYPE
              value: mysql
            - name: GF_DATABASE_HOST
              value: mysql
            - name: GF_DATABASE_NAME
              value: ocfgrafana
            - name: GF_DATABASE_USER
              value: ocfgrafana
            - name: GF_SESSION_PROVIDER
              value: mysql
            - name: GF_SESSION_COOKIE_SECURE
              value: "true"

            - name: GF_DATABASE_PASSWORD__FILE
              value: /etc/secrets/mysql-pass
            - name: GF_SECURITY_ADMIN_PASSWORD__FILE
              value: /etc/secrets/admin-pass
            - name: GF_SESSION_PROVIDER_CONFIG__FILE
              value: /etc/secrets/provider-config
            - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET__FILE
              value: /etc/secrets/keycloak-secret

            - name: PROMETHEUS_AUTH_USER
              valueFrom:
                secretKeyRef:
                  name: prometheus-auth
                  key: username
            - name: PROMETHEUS_AUTH_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: prometheus-auth
                  key: password

      volumes:
        - name: secrets
          hostPath:
            path: /opt/share/kubernetes/secrets/grafana
            type: Directory

      dnsPolicy: ClusterFirst
      dnsConfig:
        searches:
          - ocf.berkeley.edu
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: virtual-host-ingress
spec:
  rules:
    - host: grafana.ocf.berkeley.edu
      http:
        paths:
          - backend:
              serviceName: service
              servicePort: 80
---
apiVersion: v1
kind: Secret
metadata:
  name: prometheus-auth
type: Opaque
stringData:
  username: ocfgrafana
  password: "<%= prometheus_pass %>"