ericandClaude Opus 5.5
41943f1174
Moves the Grafana Helm deployment and LDAP template out of ericomeehan.eom into its own role, and: - maps cn=DevOps Members,ou=Teams to Editor in the DevOps org (org 2), after DevOps Owners so owners keep Admin - pins chart 11.4.2 from Bitnami's OCI registry (the HTTP index no longer carries it) so redeploys don't upgrade to Grafana 12 - pins the bitnamilegacy/grafana image the cluster is already running Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
60 lines
1.4 KiB
Markdown
60 lines
1.4 KiB
Markdown
ansible-role-grafana
|
|
====================
|
|
|
|
Deploys Grafana to the eom.dev Kubernetes cluster with the Bitnami Helm chart,
|
|
with LDAP sign-in mapped to Grafana organizations.
|
|
|
|
Requirements
|
|
------------
|
|
|
|
- `kubernetes.core` collection, Helm on the target host
|
|
- OpenLDAP at `openldap.openldap.svc.cluster.local`
|
|
- Prometheus and Alertmanager in the `prometheus` namespace
|
|
|
|
Role Variables
|
|
--------------
|
|
|
|
Required (from `secrets.yaml`):
|
|
|
|
- `grafana_admin_password`
|
|
- `openldap_readonly_password`
|
|
|
|
Defaults (`defaults/main.yml`):
|
|
|
|
| Variable | Default |
|
|
|---|---|
|
|
| `grafana_chart_ref` | `oci://registry-1.docker.io/bitnamicharts/grafana` |
|
|
| `grafana_chart_version` | `11.4.2` |
|
|
| `grafana_image_repository` | `bitnamilegacy/grafana` |
|
|
| `grafana_image_tag` | `11.4.0-debian-12-r0` |
|
|
| `grafana_domain` | `grafana.eom.dev` |
|
|
|
|
LDAP group mappings
|
|
-------------------
|
|
|
|
Defined in `templates/ldap.toml.j2`. Grafana uses the first mapping that
|
|
matches per organization, so owner groups must come before member groups.
|
|
|
|
| LDAP group | Org | Role |
|
|
|---|---|---|
|
|
| Grafana Administrators | 1 (Main) | Admin + server admin |
|
|
| Grafana Users | 1 (Main) | Viewer |
|
|
| DevOps Owners | 2 (DevOps) | Admin |
|
|
| DevOps Members | 2 (DevOps) | Editor |
|
|
| Finance Owners | 3 (Finance) | Admin |
|
|
|
|
Example Playbook
|
|
----------------
|
|
|
|
- hosts: alpha-control-plane
|
|
become: true
|
|
vars_files:
|
|
- ../secrets.yaml
|
|
roles:
|
|
- role: ericomeehan.grafana
|
|
|
|
License
|
|
-------
|
|
|
|
MIT-0
|