apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-configuration
  namespace: monitoring
data:
  # Configure the DNS name associated with Grafana
  GF_SERVER_DOMAIN: grafana.crownlabs.polito.it
  GF_SERVER_ROOT_URL: https://grafana.crownlabs.polito.it
  # Disable the user/password authentication
  GF_AUTH_DISABLE_LOGIN_FORM: "true"
  # Enable OAuth authentication (i.e. with Keycloak)
  GF_AUTH_GENERIC_OAUTH_ENABLED: "true"
  GF_AUTH_OAUTH_AUTO_LOGIN: "true"
  # Allow access via OAuth even if the account does not yet exist
  GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP: "true"
  # Client configuration in Keycloak (ID and Secret)
  GF_AUTH_GENERIC_OAUTH_CLIENT_ID: monitoring
  GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: <monitoring-secret>
  GF_AUTH_GENERIC_OAUTH_SCOPES: email
  # Keycloak URLs
  GF_AUTH_GENERIC_OAUTH_AUTH_URL: https://auth.crownlabs.polito.it/auth/realms/crownlabs/protocol/openid-connect/auth
  GF_AUTH_GENERIC_OAUTH_TOKEN_URL: https://auth.crownlabs.polito.it/auth/realms/crownlabs/protocol/openid-connect/token
  GF_AUTH_GENERIC_OAUTH_API_URL: https://auth.crownlabs.polito.it/auth/realms/crownlabs/protocol/openid-connect/userinfo
  GF_AUTH_SIGNOUT_REDIRECT_URL: https://auth.crownlabs.polito.it/auth/realms/crownlabs/protocol/openid-connect/logout?redirect_uri=https%3A%2F%2Fgrafana.crownlabs.polito.it
  # Map the 'grafana_role' configured in keycloak to the role in Grafana
  GF_AUTH_GENERIC_OAUTH_ROLE_ATTRIBUTE_PATH: contains(grafana_role, 'Admin') && 'Admin'
    || contains(grafana_role, 'Editor') && 'Editor' || 'Viewer'
