kind: Deployment
apiVersion: apps/v1
metadata:
  name: grafana
  labels:
    app: grafana
    app.kubernetes.io/part-of: custom-app-1
  annotations:
    app.openshift.io/connects-to: influxdb
spec:
  replicas: 1
  selector:
    matchLabels:
      app: grafana
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: grafana
    spec:
      initContainers:
        - name: wait-for-client-secret
          image: registry.access.redhat.com/ubi8-minimal
          imagePullPolicy: IfNotPresent
          command:
            - bash
            - -c
            - |
              echo "Waiting for client secret to be populated (/etc/client-secret/CLIENT_SECRET)..."
              while test -z "$(cat /etc/client-secret/CLIENT_SECRET)"; do
                sleep 1
              done
          volumeMounts:
            - mountPath: /etc/client-secret
              name: client-secret
              readOnly: true
      containers:
        - name: grafana
          image: docker.io/grafana/grafana:7.5.6
          imagePullPolicy: IfNotPresent
          env:
            - name: GF_SECURITY_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: grafana
                  key: admin.password
            - name: GF_ANALYTICS_REPORTING_ENABLED
              value: "false"

            - name: GF_LOG_LEVEL
              value: "debug"

            - name: GF_AUTH_GENERIC_OAUTH_ENABLED
              value: "true"
            - name: GF_AUTH_GENERIC_OAUTH_NAME
              value: "Drogue IoT cloud"
            - name: GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP
              value: "true"
            - name: GF_AUTH_GENERIC_OAUTH_TEAM_IDS
              value: ""
            - name: GF_AUTH_GENERIC_OAUTH_ALLOWED_ORGANIZATIONS
              value: ""
            - name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: keycloak-client-secret-grafana
                  key: CLIENT_ID
            - name: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: keycloak-client-secret-grafana
                  key: CLIENT_SECRET
            - name: GF_AUTH_GENERIC_OAUTH_SCOPES
              value: "openid profile email"

            - name: SSO_URL
              value: http://localhost

            - name: GF_AUTH_GENERIC_OAUTH_AUTH_URL
              value: $(SSO_URL)/auth/realms/drogue/protocol/openid-connect/auth
            - name: GF_AUTH_GENERIC_OAUTH_TOKEN_URL
              value: $(SSO_URL)/auth/realms/drogue/protocol/openid-connect/token
            - name: GF_AUTH_GENERIC_OAUTH_API_URL
              value: $(SSO_URL)/auth/realms/drogue/protocol/openid-connect/userinfo
            - name: GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH
              value: "contains(roles[*], 'grafana-admin') && 'Admin' || contains(roles[*], 'grafana-editor') && 'Editor' || 'Viewer'"

            - name: DS_USERNAME
              valueFrom:
                secretKeyRef:
                  name: influxdb-secret
                  key: read.username
            - name: DS_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: influxdb-secret
                  key: read.password
            - name: DS_DATABASE
              valueFrom:
                configMapKeyRef:
                  name: influxdb-config
                  key: databaseName
          readinessProbe:
            httpGet:
              path: /
              port: 3000
            initialDelaySeconds: 15
            timeoutSeconds: 1
          livenessProbe:
            httpGet:
              path: /
              port: 3000
            initialDelaySeconds: 15
            timeoutSeconds: 1
          ports:
            - containerPort: 3000
              name: web
              protocol: TCP
          resources:
            limits:
              memory: 1Gi
          volumeMounts:
            - mountPath: /var/lib/grafana
              name: grafana-storage
            - mountPath: /etc/grafana/provisioning/datasources
              name: grafana-datasources
            - mountPath: /etc/grafana/provisioning/dashboards
              name: grafana-dashboard-providers
            - mountPath: /var/lib/grafana/dashboards
              name: grafana-dashboards
      volumes:
        - name: grafana-storage
          persistentVolumeClaim:
            claimName: grafana-pvc
        - name: grafana-datasources
          configMap:
            name: grafana-datasources
        - name: grafana-dashboard-providers
          configMap:
            name: grafana-dashboard-providers
        - name: grafana-dashboards
          configMap:
            name: grafana-dashboards
        - name: client-secret
          secret:
            secretName: keycloak-client-secret-drogue