Add Grafana ingress Terraform module with ALB, DNS, and ACM cert

argocd/config/regional-cluster/grafana/templates/auth-anonymous.yaml

@@ -0,0 +1,42 @@
+{{- if not .Values.grafana.sso.secretArn }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana
+  namespace: {{ .Release.Namespace }}
+data:
+  grafana.ini: |
+    [server]
+    root_url = %(protocol)s://%(domain)s:%(http_port)s/
+
+    [security]
+    disable_gravatar = true
+
+    [database]
+    type = sqlite3
+    path = /var/lib/grafana/grafana.db
+    wal = true
+
+    [auth]
+    disable_login_form = true
+
+    [auth.anonymous]
+    enabled = true
+    org_role = Admin
+
+    [auth.basic]
+    enabled = false
+
+    [users]
+    allow_sign_up = false
+    auto_assign_org_role = Admin
+
+    [analytics]
+    reporting_enabled = false
+    check_for_updates = false
+    check_for_plugin_updates = false
+
+    [log]
+    mode = console
+    level = info
+{{- end }}

argocd/config/regional-cluster/grafana/templates/auth-sso.yaml

@@ -0,0 +1,57 @@
+{{- if .Values.grafana.sso.secretArn }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana
+  namespace: {{ .Release.Namespace }}
+data:
+  grafana.ini: |
+    [server]
+    root_url = https://%(domain)s/
+
+    [security]
+    disable_gravatar = true
+
+    [database]
+    type = sqlite3
+    path = /var/lib/grafana/grafana.db
+    wal = true
+
+    [auth]
+    disable_login_form = false
+
+    [auth.anonymous]
+    enabled = false
+
+    [auth.basic]
+    enabled = false
+
+    [auth.generic_oauth]
+    enabled = true
+    name = Red Hat SSO
+    allow_sign_up = true
+    client_id = $__env{SSO_CLIENT_ID}
+    client_secret = $__env{SSO_CLIENT_SECRET}
+    scopes = openid email profile offline_access
+    email_attribute_path = email
+    login_attribute_path = preferred_username
+    name_attribute_path = name
+    auth_url = $__env{SSO_AUTH_URL}
+    token_url = $__env{SSO_TOKEN_URL}
+    api_url = $__env{SSO_API_URL}
+    skip_org_role_sync = true
+    auto_login = true
+
+    [users]
+    allow_sign_up = false
+    auto_assign_org_role = Admin
+
+    [analytics]
+    reporting_enabled = false
+    check_for_updates = false
+    check_for_plugin_updates = false
+
+    [log]
+    mode = console
+    level = info
+{{- end }}

argocd/config/regional-cluster/grafana/templates/sso-external-secret.yaml

@@ -0,0 +1,36 @@
+{{- if .Values.grafana.sso.secretArn }}
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grafana-sso
+  namespace: {{ .Release.Namespace }}
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: aws-secrets-manager
+    kind: ClusterSecretStore
+  target:
+    name: grafana-sso
+    creationPolicy: Owner
+    template:
+      engineVersion: v2
+      data:
+        SSO_CLIENT_ID: "{{ "{{ .client_id }}" }}"
+        SSO_CLIENT_SECRET: "{{ "{{ .client_secret }}" }}"
+        SSO_AUTH_URL: "{{ "{{ .oidc_url }}" }}/protocol/openid-connect/auth"
+        SSO_TOKEN_URL: "{{ "{{ .oidc_url }}" }}/protocol/openid-connect/token"
+        SSO_API_URL: "{{ "{{ .oidc_url }}" }}/protocol/openid-connect/userinfo"
+  data:
+    - secretKey: client_id
+      remoteRef:
+        key: {{ .Values.grafana.sso.secretArn }}
+        property: client_id
+    - secretKey: client_secret
+      remoteRef:
+        key: {{ .Values.grafana.sso.secretArn }}
+        property: client_secret
+    - secretKey: oidc_url
+      remoteRef:
+        key: {{ .Values.grafana.sso.secretArn }}
+        property: oidc_url
+{{- end }}

argocd/config/regional-cluster/grafana/templates/targetgroupbinding.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.grafana.targetGroup.arn }}
+---
+apiVersion: eks.amazonaws.com/v1
+kind: TargetGroupBinding
+metadata:
+  name: grafana
+  namespace: {{ .Release.Namespace }}
+spec:
+  serviceRef:
+    name: grafana
+    port: 80
+  targetGroupARN: {{ .Values.grafana.targetGroup.arn }}
+  targetType: ip
+{{- end }}

argocd/config/regional-cluster/grafana/values.yaml

@@ -36,40 +36,14 @@ grafana:
     create: true
     name: grafana
 
-  "grafana.ini":
-    server:
-      root_url: "%(protocol)s://%(domain)s:%(http_port)s/"
+  createConfigmap: false
 
-    security:
-      disable_gravatar: true
+  envFromSecrets:
+    - name: grafana-sso
+      optional: true
 
-    database:
-      type: sqlite3
-      path: /var/lib/grafana/grafana.db
-      wal: true
-
-    auth:
-      disable_login_form: true
-
-    "auth.anonymous":
-      enabled: true
-      org_role: Admin
-
-    "auth.basic":
-      enabled: false
-
-    users:
-      allow_sign_up: false
-      auto_assign_org_role: Admin
-
-    analytics:
-      reporting_enabled: false
-      check_for_updates: false
-      check_for_plugin_updates: false
-
-    log:
-      mode: console
-      level: info
+  envFromConfigMaps:
+    - name: grafana-region-env
 
   service:
     type: ClusterIP
@@ -79,9 +53,6 @@ grafana:
   persistence:
     enabled: false
 
-  envFromConfigMaps:
-    - name: grafana-region-env
-
   datasources:
     datasources.yaml:
       apiVersion: 1
@@ -179,3 +150,10 @@ grafana:
       provider:
         foldersFromFilesStructure: true
         allowUiUpdates: false
+
+  # Injected at runtime by ApplicationSet from cluster annotations.
+  # Empty defaults for helm lint.
+  targetGroup:
+    arn: ""
+  sso:
+    secretArn: ""

config/defaults.yaml

@@ -94,6 +94,12 @@ observability:
     # @used-by observability.pagerduty.escalation_policy_id pipeline-regional-cluster-inputs/terraform.json.j2
     escalation_policy_id: "P5KE444"
 
+  grafana_ingress:
+    # @doc observability.grafana_ingress.enabled Enable internet-facing Grafana ingress (ALB + ACM cert + DNS record).
+    # @used-by observability.grafana_ingress.enabled _context
+    # @used-by observability.grafana_ingress.enabled pipeline-regional-cluster-inputs/terraform.json.j2
+    enabled: false
+
   sns_alerting:
     # @doc observability.sns_alerting.enabled Enable SNS alerting for regional cluster alert consumption by automated/external services.
     # @used-by observability.sns_alerting.enabled _context

config/integration/defaults.yaml

@@ -15,3 +15,5 @@ management_cluster_defaults:
 observability:
   pagerduty:
     enabled: true
+  grafana_ingress:
+    enabled: true

config/templates/argocd-bootstrap/applicationset.yaml.j2

@@ -80,6 +80,11 @@ spec:
                 tableName: '{{ '{{ .metadata.annotations.zoa_table_name }}' }}'
                 auditTableName: '{{ '{{ .metadata.annotations.zoa_audit_table_name }}' }}'
                 bucketName: '{{ '{{ .metadata.annotations.zoa_bucket_name }}' }}'
+            grafana:
+              targetGroup:
+                arn: '{{ '{{ .metadata.annotations.grafana_target_group_arn }}' }}'
+              sso:
+                secretArn: '{{ '{{ .metadata.annotations.grafana_sso_secret_arn }}' }}'
             # Thanos Operator values (keys must match chart's values.yaml structure)
             thanos:
               kmsKeyArn: '{{ '{{ .metadata.annotations.thanos_kms_key_arn }}' }}'

config/templates/pipeline-regional-cluster-inputs/terraform.json.j2

@@ -15,6 +15,7 @@
   "enable_api_custom_domain": {{ regional_cluster.enable_api_custom_domain | default(false) | tojson }},
   "zone_shard_count": {{ regional_cluster.zone_shard_count | default(1) | tojson }},
   "enable_sns_alerting": {{ observability.sns_alerting.enabled | default(false) | tojson }},
+  "enable_grafana_ingress": {{ observability.grafana_ingress.enabled | default(false) | tojson }},
   "regional_id": "{% if eph_prefix %}{{ eph_prefix }}-regional{% else %}regional{% endif %}",
   "eph_prefix": "{{ eph_prefix | default('') }}",
   "iot_log_level": {{ applications['regional-cluster'].maestro.iotLogLevel | default('WARN') | tojson }}

deploy/ephemeral/us-east-1/_merged_config.yaml

@@ -97,6 +97,12 @@ observability:
     # @used-by observability.pagerduty.escalation_policy_id pipeline-regional-cluster-inputs/terraform.json.j2
     escalation_policy_id: "P5KE444"
 
+  grafana_ingress:
+    # @doc observability.grafana_ingress.enabled Enable internet-facing Grafana ingress (ALB + ACM cert + DNS record).
+    # @used-by observability.grafana_ingress.enabled _context
+    # @used-by observability.grafana_ingress.enabled pipeline-regional-cluster-inputs/terraform.json.j2
+    enabled: false
+
   sns_alerting:
     # @doc observability.sns_alerting.enabled Enable SNS alerting for regional cluster alert consumption by automated/external services.
     # @used-by observability.sns_alerting.enabled _context

deploy/ephemeral/us-east-1/argocd-bootstrap-management-cluster/applicationset.yaml

@@ -79,6 +79,11 @@ spec:
                 tableName: '{{ .metadata.annotations.zoa_table_name }}'
                 auditTableName: '{{ .metadata.annotations.zoa_audit_table_name }}'
                 bucketName: '{{ .metadata.annotations.zoa_bucket_name }}'
+            grafana:
+              targetGroup:
+                arn: '{{ .metadata.annotations.grafana_target_group_arn }}'
+              sso:
+                secretArn: '{{ .metadata.annotations.grafana_sso_secret_arn }}'
             # Thanos Operator values (keys must match chart's values.yaml structure)
             thanos:
               kmsKeyArn: '{{ .metadata.annotations.thanos_kms_key_arn }}'

deploy/ephemeral/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yaml

@@ -79,6 +79,11 @@ spec:
                 tableName: '{{ .metadata.annotations.zoa_table_name }}'
                 auditTableName: '{{ .metadata.annotations.zoa_audit_table_name }}'
                 bucketName: '{{ .metadata.annotations.zoa_bucket_name }}'
+            grafana:
+              targetGroup:
+                arn: '{{ .metadata.annotations.grafana_target_group_arn }}'
+              sso:
+                secretArn: '{{ .metadata.annotations.grafana_sso_secret_arn }}'
             # Thanos Operator values (keys must match chart's values.yaml structure)
             thanos:
               kmsKeyArn: '{{ .metadata.annotations.thanos_kms_key_arn }}'

deploy/ephemeral/us-east-1/pipeline-regional-cluster-inputs/terraform.json

@@ -15,6 +15,7 @@
   "enable_api_custom_domain": false,
   "zone_shard_count": 1,
   "enable_sns_alerting": true,
+  "enable_grafana_ingress": false,
   "regional_id": "regional",
   "eph_prefix": "",
   "iot_log_level": "WARN",

deploy/integration/us-east-1/_merged_config.yaml

@@ -97,6 +97,12 @@ observability:
     # @used-by observability.pagerduty.escalation_policy_id pipeline-regional-cluster-inputs/terraform.json.j2
     escalation_policy_id: "P5KE444"
 
+  grafana_ingress:
+    # @doc observability.grafana_ingress.enabled Enable internet-facing Grafana ingress (ALB + ACM cert + DNS record).
+    # @used-by observability.grafana_ingress.enabled _context
+    # @used-by observability.grafana_ingress.enabled pipeline-regional-cluster-inputs/terraform.json.j2
+    enabled: true
+
   sns_alerting:
     # @doc observability.sns_alerting.enabled Enable SNS alerting for regional cluster alert consumption by automated/external services.
     # @used-by observability.sns_alerting.enabled _context

deploy/integration/us-east-1/argocd-bootstrap-management-cluster/applicationset.yaml

@@ -79,6 +79,11 @@ spec:
                 tableName: '{{ .metadata.annotations.zoa_table_name }}'
                 auditTableName: '{{ .metadata.annotations.zoa_audit_table_name }}'
                 bucketName: '{{ .metadata.annotations.zoa_bucket_name }}'
+            grafana:
+              targetGroup:
+                arn: '{{ .metadata.annotations.grafana_target_group_arn }}'
+              sso:
+                secretArn: '{{ .metadata.annotations.grafana_sso_secret_arn }}'
             # Thanos Operator values (keys must match chart's values.yaml structure)
             thanos:
               kmsKeyArn: '{{ .metadata.annotations.thanos_kms_key_arn }}'

deploy/integration/us-east-1/argocd-bootstrap-regional-cluster/applicationset.yaml

@@ -79,6 +79,11 @@ spec:
                 tableName: '{{ .metadata.annotations.zoa_table_name }}'
                 auditTableName: '{{ .metadata.annotations.zoa_audit_table_name }}'
                 bucketName: '{{ .metadata.annotations.zoa_bucket_name }}'
+            grafana:
+              targetGroup:
+                arn: '{{ .metadata.annotations.grafana_target_group_arn }}'
+              sso:
+                secretArn: '{{ .metadata.annotations.grafana_sso_secret_arn }}'
             # Thanos Operator values (keys must match chart's values.yaml structure)
             thanos:
               kmsKeyArn: '{{ .metadata.annotations.thanos_kms_key_arn }}'

deploy/integration/us-east-1/pipeline-regional-cluster-inputs/terraform.json

@@ -15,6 +15,7 @@
   "enable_api_custom_domain": true,
   "zone_shard_count": 1,
   "enable_sns_alerting": true,
+  "enable_grafana_ingress": true,
   "regional_id": "regional",
   "eph_prefix": "",
   "iot_log_level": "WARN",