Files

T

ericandClaude Opus 5.5 41943f1174

Initial Grafana role, split out of ansible-role-eom

Moves the Grafana Helm deployment and LDAP template out of
ericomeehan.eom into its own role, and:

- maps cn=DevOps Members,ou=Teams to Editor in the DevOps org (org 2),
  after DevOps Owners so owners keep Admin
- pins chart 11.4.2 from Bitnami's OCI registry (the HTTP index no
  longer carries it) so redeploys don't upgrade to Grafana 12
- pins the bitnamilegacy/grafana image the cluster is already running

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-06 14:00:23 -05:00

1.4 KiB

Raw Permalink Blame History

ansible-role-grafana

Deploys Grafana to the eom.dev Kubernetes cluster with the Bitnami Helm chart, with LDAP sign-in mapped to Grafana organizations.

Requirements

kubernetes.core collection, Helm on the target host
OpenLDAP at openldap.openldap.svc.cluster.local
Prometheus and Alertmanager in the prometheus namespace

Role Variables

Required (from secrets.yaml):

grafana_admin_password
openldap_readonly_password

Defaults (defaults/main.yml):

Variable	Default
`grafana_chart_ref`	`oci://registry-1.docker.io/bitnamicharts/grafana`
`grafana_chart_version`	`11.4.2`
`grafana_image_repository`	`bitnamilegacy/grafana`
`grafana_image_tag`	`11.4.0-debian-12-r0`
`grafana_domain`	`grafana.eom.dev`

LDAP group mappings

Defined in templates/ldap.toml.j2. Grafana uses the first mapping that matches per organization, so owner groups must come before member groups.

LDAP group	Org	Role
Grafana Administrators	1 (Main)	Admin + server admin
Grafana Users	1 (Main)	Viewer
DevOps Owners	2 (DevOps)	Admin
DevOps Members	2 (DevOps)	Editor
Finance Owners	3 (Finance)	Admin

Example Playbook

- hosts: alpha-control-plane
  become: true
  vars_files:
    - ../secrets.yaml
  roles:
    - role: ericomeehan.grafana

License

MIT-0

1.4 KiB Raw Permalink Blame History