Erich Blume
0cdc143227
## Summary - Deploys Dex OIDC identity provider on ringtail k3s cluster as central authentication service - Integrates Grafana as first SSO client via `auth.generic_oauth` - Uses Kubernetes CRD storage backend (no PVC needed) - All secrets (bcrypt hash, client secrets) injected via ExternalSecrets from 1Password item "Dex (blumeops)" - NixOS-built container image via `containers/dex/default.nix` ## Pre-requisites (manual, before deployment) 1. Create 1Password item "Dex (blumeops)" in `blumeops` vault with fields: - `password`: strong generated password for Dex login - `static-password-hash`: bcrypt hash of above (`htpasswd -BnC 10 eblume`, copy hash after `eblume:`) - `grafana-client-secret`: random 32-char hex (`openssl rand -hex 16`) 2. Build container: `mise run container-tag-and-release dex v1.0.0` ## Deployment sequence 1. Build container: `mise run container-tag-and-release dex v1.0.0` 2. Deploy Caddy: `mise run provision-indri -- --tags caddy` 3. Sync ArgoCD: `argocd app sync apps` → `argocd app sync dex` 4. Verify Dex: `curl https://dex.ops.eblu.me/.well-known/openid-configuration` 5. Sync Grafana: `argocd app sync grafana-config` → `argocd app sync grafana` 6. Test SSO: Visit `https://grafana.ops.eblu.me/login`, click "Sign in with Dex" ## Verification - [ ] Container image exists: `mise run container-list` shows `dex:v1.0.0-nix` - [ ] `curl https://dex.ops.eblu.me/.well-known/openid-configuration` returns valid OIDC discovery - [ ] `curl https://dex.ops.eblu.me/healthz` returns healthy - [ ] Grafana login shows "Sign in with Dex" button alongside local login - [ ] OIDC flow: click Dex → enter credentials → redirect back → logged in as Admin - [ ] Break-glass: local admin login still works - [ ] `mise run services-check` passes ## Files changed | File | Action | Purpose | |------|--------|---------| | `containers/dex/default.nix` | Create | NixOS container build | | `argocd/apps/dex.yaml` | Create | ArgoCD app targeting ringtail | | `argocd/manifests/dex/*` (8 files) | Create | K8s manifests (RBAC, ExternalSecret, Deployment, Service, Ingress) | | `argocd/manifests/grafana-config/external-secret-dex-oauth.yaml` | Create | Grafana OIDC client secret | | `argocd/manifests/grafana-config/kustomization.yaml` | Modify | Add new ExternalSecret resource | | `argocd/manifests/grafana/values.yaml` | Modify | Add `auth.generic_oauth` config + envFromSecrets | | `ansible/roles/caddy/defaults/main.yml` | Modify | Add `dex.ops.eblu.me` reverse proxy entry | | `docs/changelog.d/feature-dex-oidc.feature.md` | Create | Changelog fragment | Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/222
108 lines
2.7 KiB
YAML
108 lines
2.7 KiB
YAML
# Grafana Helm values for blumeops
|
|
# Chart: https://github.com/grafana/helm-charts/tree/main/charts/grafana
|
|
|
|
# Admin credentials from pre-created secret
|
|
# Secret must exist before deploying - see grafana-config/README.md
|
|
admin:
|
|
existingSecret: grafana-admin
|
|
userKey: admin-user
|
|
passwordKey: admin-password
|
|
|
|
# Environment variables from secrets (for datasource credentials)
|
|
envFromSecrets:
|
|
- name: grafana-teslamate-datasource
|
|
optional: true
|
|
- name: grafana-dex-oauth
|
|
optional: true
|
|
|
|
# Persistence with PVC for SQLite database
|
|
persistence:
|
|
enabled: true
|
|
type: pvc
|
|
size: 1Gi
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
|
|
# Grafana configuration via grafana.ini
|
|
grafana.ini:
|
|
server:
|
|
root_url: https://grafana.ops.eblu.me
|
|
security:
|
|
# Embedding disabled - iframe approach didn't work well for Homepage
|
|
allow_embedding: false
|
|
auth.generic_oauth:
|
|
enabled: true
|
|
name: Dex
|
|
client_id: grafana
|
|
client_secret: $__env{GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET}
|
|
scopes: openid profile email
|
|
auth_url: https://dex.ops.eblu.me/auth
|
|
token_url: https://dex.ops.eblu.me/token
|
|
api_url: https://dex.ops.eblu.me/userinfo
|
|
allow_sign_up: true
|
|
role_attribute_path: "'Admin'"
|
|
auto_login: false
|
|
analytics:
|
|
check_for_updates: false
|
|
reporting_enabled: false
|
|
|
|
# Datasources - point to k8s-internal services
|
|
datasources:
|
|
datasources.yaml:
|
|
apiVersion: 1
|
|
datasources:
|
|
- name: Prometheus
|
|
type: prometheus
|
|
access: proxy
|
|
orgId: 1
|
|
uid: prometheus
|
|
url: http://prometheus.monitoring.svc.cluster.local:9090
|
|
isDefault: true
|
|
editable: false
|
|
- name: Loki
|
|
type: loki
|
|
access: proxy
|
|
orgId: 1
|
|
uid: loki
|
|
url: http://loki.monitoring.svc.cluster.local:3100
|
|
editable: false
|
|
- name: TeslaMate
|
|
type: postgres
|
|
access: proxy
|
|
orgId: 1
|
|
uid: TeslaMate
|
|
url: blumeops-pg-rw.databases.svc.cluster.local:5432
|
|
database: teslamate
|
|
user: teslamate
|
|
editable: false
|
|
jsonData:
|
|
sslmode: disable
|
|
maxOpenConns: 5
|
|
maxIdleConns: 2
|
|
connMaxLifetime: 14400
|
|
secureJsonData:
|
|
password: $TESLAMATE_DB_PASSWORD
|
|
|
|
# Dashboard provisioning - sidecar watches for ConfigMaps with label
|
|
sidecar:
|
|
dashboards:
|
|
enabled: true
|
|
label: grafana_dashboard
|
|
labelValue: "1"
|
|
folderAnnotation: grafana_folder
|
|
provider:
|
|
foldersFromFilesStructure: false
|
|
|
|
# Service configuration (Ingress will handle external access)
|
|
service:
|
|
type: ClusterIP
|
|
port: 80
|
|
|
|
# Resource limits for minikube
|
|
resources:
|
|
requests:
|
|
memory: "128Mi"
|
|
cpu: "100m"
|
|
limits:
|
|
memory: "512Mi"
|
|
cpu: "500m"
|