Update Grafana Template for SSO
Bug
Description
grafana.ini file was not rendering properly to support the addition of custom CA's from our values file. Currently the rendered output looks like this in the monitoring-grafana container.
cat /etc/grafana/grafana.ini
tls_client_ca = /etc/oidc/ca.pem
[analytics]
check_for_updates = false
reporting_enabled = false
[auth.generic_oauth]
allow_sign_up = true
api_url = https://keycloak.dev-int.proj.org/auth/realms/baby-yoda/protocol/openid-connect/userinfo
auth_url = https://keycloak.dev-int.proj.org/auth/realms/baby-yoda/protocol/openid-connect/auth
client_id = $__file{/etc/secrets/auth_generic_oauth/client_id}
client_secret = secret
enabled = true
name = PROJ
role_attribute_path = Viewer
scopes = openid Grafana
token_url = https://keycloak.dev-int.proj.org/auth/realms/baby-yoda/protocol/openid-connect/token
[grafana_net]
url = https://grafana.net
[log]
mode = console
[paths]
data = /var/lib/grafana/
logs = /var/log/grafana
plugins = /var/lib/grafana/plugins
provisioning = /etc/grafana/provisioning
[plugin.grafana-piechart-panel]
path = /var/lib/bb-plugins/piechart-panel
[plugin.grafana-polystat-panel]
path = /var/lib/bb-plugins/polystat-panel
[plugin.redis-datasource]
path = /var/lib/bb-plugins/redis-datasource
[security]
angular_support_enabled = false
[server]
domain = ''
root_url = https://grafana.dev-int.proj.org/
The tls_client_ca = /etc/oidc/ca.pem is outside of the [auth.generic_oauth] heading, so grafana does not know to trust this custom CA. The fix should look like the below.
[auth.generic_oauth]
...
allow_sign_up = true
tls_client_ca = /etc/oidc/ca.pem
...
grafana values.yaml template needs to be updated.
BigBang Version
Bug originally found in 2.30.0, still present in 3.12.0 which is what I tested against.
Edited by Matt Goloski