---
apiVersion: grafana.integreatly.org/v1beta1
kind: Grafana
metadata:
  # Arbitrary name for the Grafana CR, but make sure to update references and object names below when changing this!
  name: grafana-instance
  labels:
    dashboards: "default"
spec:
  # Add OpenShift OAuth annotation to ServiceAccount
  serviceAccount:
    metadata:
      annotations:
        serviceaccounts.openshift.io/oauth-redirectreference.grafana: '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"grafana-instance-route"}}'

  # This section configures the oauth-proxy sidecar
  deployment:
    spec:
      template:
        spec:
          containers:
            - name: oauth-proxy
              image: image-registry.openshift-image-registry.svc:5000/openshift/oauth-proxy:v4.4
              args:
                - '--provider=openshift'
                - '--http-address=:9090'
                - '--https-address='
                - '--openshift-service-account=grafana-instance-sa'
                - '--upstream=http://localhost:3000' # Points to Grafana in the same pod
                - '--cookie-secret-file=/var/run/secrets/kubernetes.io/serviceaccount/token'
              ports:
                - containerPort: 9090
                  name: oauth-proxy

  # Add additional port definition for oauth-proxy to Service
  service:
    spec:
      ports:
        - name: oauth-proxy
          port: 9090
          protocol: TCP
          targetPort: oauth-proxy

  # Point Route to oauth-proxy instead of directly to Grafana
  route:
    spec:
      port:
        targetPort: oauth-proxy
      tls:
        termination: edge
      to:
        kind: Service
        name: grafana-instance-service
        weight: 100
      wildcardPolicy: None


  # This configures the grafana.ini file
  config:
    auth:
      # Grafana should not offer authentication itself
      disable_login_form: "True"
      disable_signout_menu: "True"
    auth.proxy:
      enabled: "True"
      # automatically create accounts for "new" users
      auto_sign_up: 'True'
      enable_login_token: 'False'
      # this HTTP header is sent by the oauth-proxy to the Grafana server
      header_name: "X-Forwarded-User"
      header_property: username
      # additional information to identify the user
      headers: "Name:X-Forwarded-User Email:X-Forwarded-Email"
