mirror of
https://github.com/dredx/prole.git
synced 2026-09-24 16:34:31 +00:00
885fa99a29
- monitoring/kps-values-k3s.yaml: Grafana helm values for k3s homelab with dual auth (auth.proxy Kerberos + auth.google for prole.org Workspace) - grafana-proxy-configmap.yaml: nginx passthrough for /grafana/login/google and /grafana/login to allow Google OAuth flow without knoe-auth redirect - grafana-google-oidc-secret-prole.example.yaml: Secret template for Grafana Google OAuth client (svc.prole.org, Internal consent, prole.org Workspace) - oauth2-proxy-google-oidc-secret-prole.example.yaml: Secret template for oauth2-proxy gating db.prole.org Studio - oauth2-proxy-deployment-prole.yaml: k3s oauth2-proxy deployment for db.prole.org (prole.org domain, no BackendConfig) - init_grafana_oauth_prole.sh: Bootstrap script for Grafana OAuth secret - init_oauth2_proxy_prole.sh: Bootstrap script for Studio oauth2-proxy Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
30 lines
1.3 KiB
YAML
30 lines
1.3 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: grafana-google-oidc
|
|
namespace: monitoring
|
|
labels:
|
|
app: grafana
|
|
app.kubernetes.io/managed-by: knoe-installer
|
|
# Google OAuth 2.0 client credentials for Grafana's native Google sign-in
|
|
# (Grafana auth.google plugin) on the prole.org k3s homelab cluster.
|
|
# Mounted into kps-grafana via `envFromSecret: grafana-google-oidc` in
|
|
# monitoring/kps-values-k3s.yaml. Grafana reads GF_AUTH_GOOGLE_CLIENT_ID /
|
|
# GF_AUTH_GOOGLE_CLIENT_SECRET and uses them as auth.google.client_id / client_secret.
|
|
#
|
|
# Create the OAuth client at: https://console.cloud.google.com/apis/credentials
|
|
# (in the prole.org GCP project — separate from the knoey.com project)
|
|
# - Application type: Web application
|
|
# - Name: prole.org Grafana
|
|
# - Authorized JavaScript origins: https://svc.prole.org
|
|
# - Authorized redirect URIs: https://svc.prole.org/grafana/login/google
|
|
# - OAuth consent screen: Internal (prole.org Workspace only)
|
|
# - Scopes: openid, email, profile
|
|
#
|
|
# Why a separate client from prole.org Studio: independent rotation surface.
|
|
# Companion to oauth2-proxy-google-oidc-secret-prole.example.yaml.
|
|
type: Opaque
|
|
stringData:
|
|
GF_AUTH_GOOGLE_CLIENT_ID: "${GRAFANA_GOOGLE_CLIENT_ID}"
|
|
GF_AUTH_GOOGLE_CLIENT_SECRET: "${GRAFANA_GOOGLE_CLIENT_SECRET}"
|