kind: Namespace
apiVersion: v1
metadata:
  name: grafana-test
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: grafana-config
  namespace: grafana-test
data:
  grafana.ini: |+
    [auth]
    disable_login_form = false
    disable_signout_menu = true

    [auth.anonymous]
    enabled = true

    [auth.basic]
    enabled = true

    [log]
    level = warn
    mode = console

    [paths]
    data = /var/lib/grafana
    logs = /var/log/grafana
    plugins = /var/lib/grafana/plugins
    provisioning = /etc/grafana/provisioning/
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: grafana-datasources
  namespace: grafana-test
---
kind: ServiceAccount
apiVersion: v1
metadata:
  name: grafana-serviceaccount
  namespace: grafana-test
  annotations:
    serviceaccounts.openshift.io/oauth-redirectreference.primary: >-
      {"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"grafana-route"}}
---
kind: Secret
apiVersion: v1
metadata:
  name: grafana-admin-credentials
  namespace: grafana-test
data:
  GF_SECURITY_ADMIN_PASSWORD: ck03RFh6Q0g3VExrV2c9PQ==
  GF_SECURITY_ADMIN_USER: YWRtaW4=
---
kind: Secret
apiVersion: v1
metadata:
  name: grafana-k8s-proxy
  namespace: grafana-test
data:
  session_secret: >-
    S0gxWUxYVDhVOThUcmR2cU0zMS9zWmFCK2pSeU5yWGdqUmNsRmw5OFdDUmlaTXdObld2Y2duOVFuUT09
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: grafana-serviceaccount-rbac1
rules:
  - verbs:
      - '*'
    apiGroups:
      - authorization.k8s.io
    resources:
      - subjectaccessreviews
  - verbs:
      - '*'
    apiGroups:
      - authentication.k8s.io
    resources:
      - tokenreviews
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: grafana-serviceaccount-rbac1
subjects:
  - kind: ServiceAccount
    name: grafana-serviceaccount
    namespace: grafana-test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: grafana-serviceaccount-rbac1
---
kind: Service
apiVersion: v1
metadata:
  name: grafana-service
  namespace: grafana-test
  annotations:
    service.alpha.openshift.io/serving-cert-secret-name: grafana-k8s-tls
spec:
  ipFamilies:
    - IPv4
  ports:
    - name: grafana
      port: 3000
      targetPort: grafana-http
    - name: grafana-proxy
      port: 9091
      targetPort: 9091
  selector:
    app: grafana
---
kind: Route
apiVersion: route.openshift.io/v1
metadata:
  name: grafana-route
  namespace: grafana-test
spec:
  path: /
  to:
    kind: Service
    name: grafana-service
  port:
    targetPort: grafana-proxy
  tls:
    termination: reencrypt
---
kind: Deployment
apiVersion: apps/v1
metadata:
  name: grafana-deployment
  namespace: grafana-test
spec:
  selector:
    matchLabels:
      app: grafana
  template:
    metadata:
      name: grafana-deployment
      labels:
        app: grafana
      annotations:
        prometheus.io/port: '3000'
        prometheus.io/scrape: 'true'
    spec:
      serviceAccountName: grafana-serviceaccount
      containers:
        - resources:
            limits:
              cpu: 500m
              memory: 1Gi
            requests:
              cpu: 100m
              memory: 256Mi
          readinessProbe:
            httpGet:
              path: /api/health
              port: 3000
              scheme: HTTP
            initialDelaySeconds: 5
            timeoutSeconds: 3
            failureThreshold: 1
          terminationMessagePath: /dev/termination-log
          name: grafana
          livenessProbe:
            httpGet:
              path: /api/health
              port: 3000
              scheme: HTTP
            initialDelaySeconds: 60
            timeoutSeconds: 30
            failureThreshold: 10
          env:
            - name: LAST_CONFIG
            - name: LAST_DATASOURCES
            - name: GF_SECURITY_ADMIN_USER
              valueFrom:
                secretKeyRef:
                  name: grafana-admin-credentials
                  key: GF_SECURITY_ADMIN_USER
            - name: GF_SECURITY_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: grafana-admin-credentials
                  key: GF_SECURITY_ADMIN_PASSWORD
          ports:
            - name: grafana-http
              containerPort: 3000
          volumeMounts:
            - name: grafana-config
              mountPath: /etc/grafana/
            - name: grafana-data
              mountPath: /var/lib/grafana
            - name: grafana-plugins
              mountPath: /var/lib/grafana/plugins
            - name: grafana-provision-plugins
              mountPath: /etc/grafana/provisioning/plugins
            - name: grafana-provision-dashboards
              mountPath: /etc/grafana/provisioning/dashboards
            - name: grafana-provision-notifiers
              mountPath: /etc/grafana/provisioning/notifiers
            - name: grafana-logs
              mountPath: /var/log/grafana
            - name: grafana-datasources
              mountPath: /etc/grafana/provisioning/datasources
            - name: secret-grafana-k8s-tls
              mountPath: /etc/grafana-secrets/grafana-k8s-tls
            - name: secret-grafana-k8s-proxy
              mountPath: /etc/grafana-secrets/grafana-k8s-proxy
          image: >-
            registry.redhat.io/rhel9/grafana@sha256:5a09740c0b2cbefbc5bc95c649bbf575b917a35256d1f06afee7a9ea8142ffc3
          args:
            - '-config=/etc/grafana/grafana.ini'
        - resources: {}
          terminationMessagePath: /dev/termination-log
          name: grafana-proxy
          ports:
            - name: grafana-proxy
              containerPort: 9091
          volumeMounts:
            - name: secret-grafana-k8s-tls
              mountPath: /etc/tls/private
            - name: secret-grafana-k8s-proxy
              mountPath: /etc/proxy/secrets
          image: >-
            registry.redhat.io/openshift4/ose-oauth-proxy@sha256:bfb4a7588b20a8e011f087f5fa68d3cc6960887a432dcb27292aa8a8dd5abe99
          args:
            - '-provider=openshift'
            - '-pass-basic-auth=false'
            - '-https-address=:9091'
            - '-http-address='
            - '-email-domain=*'
            - '-upstream=http://localhost:3000'
            - '-openshift-sar={"resource":"namespaces","verb":"get"}'
            - >-
              -openshift-delegate-urls={"/":{"resource":"namespaces","verb":"get"}}
            - '-tls-cert=/etc/tls/private/tls.crt'
            - '-tls-key=/etc/tls/private/tls.key'
            - >-
              -client-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token
            - '-cookie-secret-file=/etc/proxy/secrets/session_secret'
            - '-openshift-service-account=grafana-serviceaccount'
            - '-openshift-ca=/etc/pki/tls/cert.pem'
            - '-openshift-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
            - '-skip-auth-regex=^/metrics'
      serviceAccount: grafana-serviceaccount
      volumes:
        - name: grafana-provision-plugins
          emptyDir: {}
        - name: grafana-provision-dashboards
          emptyDir: {}
        - name: grafana-provision-notifiers
          emptyDir: {}
        - name: grafana-config
          configMap:
            name: grafana-config
        - name: grafana-logs
          emptyDir: {}
        - name: grafana-data
          emptyDir: {}
        - name: grafana-plugins
          emptyDir: {}
        - name: grafana-datasources
          configMap:
            name: grafana-datasources
        - name: secret-grafana-k8s-tls
          secret:
            secretName: grafana-k8s-tls
            optional: true
        - name: secret-grafana-k8s-proxy
          secret:
            secretName: grafana-k8s-proxy
            optional: true
      priorityClassName: rhoam-pod-priority