ansible-role-grafana
====================

Deploys Grafana to the eom.dev Kubernetes cluster with the Bitnami Helm chart,
with LDAP sign-in mapped to Grafana organizations.

Requirements
------------

- `kubernetes.core` collection, Helm on the target host
- OpenLDAP at `openldap.openldap.svc.cluster.local`
- Prometheus and Alertmanager in the `prometheus` namespace

Role Variables
--------------

Required (from `secrets.yaml`):

- `grafana_admin_password`
- `openldap_readonly_password`

Defaults (`defaults/main.yml`):

| Variable | Default |
|---|---|
| `grafana_chart_ref` | `oci://registry-1.docker.io/bitnamicharts/grafana` |
| `grafana_chart_version` | `11.4.2` |
| `grafana_image_repository` | `bitnamilegacy/grafana` |
| `grafana_image_tag` | `11.4.0-debian-12-r0` |
| `grafana_domain` | `grafana.eom.dev` |

LDAP group mappings
-------------------

Defined in `templates/ldap.toml.j2`. Grafana uses the first mapping that
matches per organization, so owner groups must come before member groups.

| LDAP group | Org | Role |
|---|---|---|
| Grafana Administrators | 1 (Main) | Admin + server admin |
| Grafana Users | 1 (Main) | Viewer |
| DevOps Owners | 2 (DevOps) | Admin |
| DevOps Members | 2 (DevOps) | Editor |
| Finance Owners | 3 (Finance) | Admin |

Example Playbook
----------------

    - hosts: alpha-control-plane
      become: true
      vars_files:
        - ../secrets.yaml
      roles:
        - role: ericomeehan.grafana

License
-------

MIT-0