Skip to content

Grafana

Grafana is installed with the upstream Helm Chart. Running the installation is simple and can be done with our integration script.

Before running the script, you will need to create a secret file with your database username and passwords.

Information about the secretes used

Manual secret generation is only required if you haven't run the create-secrets.sh script located in /opt/genestack/bin.

Example secret generation 
kubectl --namespace grafana \
        create secret generic grafana-db \
        --type Opaque \
        --from-literal=password="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
        --from-literal=root-password="$(< /dev/urandom tr -dc _A-Za-z0-9 | head -c${1:-32};echo;)" \
        --from-literal=username=grafana

Custom Values

Before running the deployment script, you must set the custom_host value grafana-helm-overrides.yaml to the correct FQDN you wish to use within the deployment.

grafana-helm-overrides.yaml

custom_host: grafana.api.your.domain.tld

Installation

The default installation is simple. The grafana-helm-overrides.yaml file is located at /etc/genestack/helm-configs/grafana/ and overrides can be set there to customize the installation.

Before running installation when integrating with Azure AD, you must create te azure-client-secret

You can base64 encode your client_id and client_secret by using the echo and base64 command.

echo -n "YOUR CLIENT ID OR SECRET" | base64

Apply your base64 encoded values to the azure-client-secret.yaml file and apply it to the grafana namespace.

azure-client-secret.yaml

apiversion: v1
data:
  client_id: base64_encoded_client_id
  client_secret: base64_encoded_client_secret
kind: secret
metadata:
  name: azure-client
  namespace: grafana
type: opaque

Once you have created the secret file, update your grafana-helm-overrides.yaml file with the Azure AD values.

azure-overrides.yaml

tenant_id: 122333 # TODO: update this value.  Can be set in CLI.

extraSecretMounts:
  - name: azure-client-secret-mount
    secretName: azure-client
    defaultMode: 0440
    mountPath: /etc/secrets/azure-client
    readOnly: true
  - name: grafana-db-secret-mount
    secretName: grafana-db
    defaultMode: 0440
    mountPath: /etc/secrets/grafana-db
    readOnly: true

grafana.ini:
  auth.azuread:
    name: Azure AD
    enabled: true
    allow_sign_up: true
    auto_login: false
    client_id: $__file{/etc/secrets/azure-client/client_id}
    client_secret: $__file{/etc/secrets/azure-client/client_secret}
    scopes: openid email profile
    auth_url: "https://login.microsoftonline.com/{{ .Values.tenant_id }}/oauth2/v2.0/authorize"
    token_url: "https://login.microsoftonline.com/{{ .Values.tenant_id }}/oauth2/v2.0/token"
    allowed_organizations: "{{ .Values.tenant_id }}"
    role_attribute_strict: false
    allow_assign_grafana_admin: false
    skip_org_role_sync: false
    use_pkce: true

Listeners and Routes

Listeners and Routes should have been configureed when you installed the Gateway API. If so some reason they were not created, please following the install guide here: Gateway API

Deployment

Run the Grafana deployment Script /opt/genestack/bin/install-grafana.sh

Run the Grafana deployment Script /opt/genestack/bin/install-grafana.sh 
#!/bin/bash
# shellcheck disable=SC2124,SC2145,SC2294
GLOBAL_OVERRIDES_DIR="/etc/genestack/helm-configs/global_overrides"
SERVICE_CONFIG_DIR="/etc/genestack/helm-configs/grafana"
BASE_OVERRIDES="/opt/genestack/base-helm-configs/grafana/grafana-helm-overrides.yaml"

# Read grafana version from helm-chart-versions.yaml
VERSION_FILE="/etc/genestack/helm-chart-versions.yaml"
if [ ! -f "$VERSION_FILE" ]; then
    echo "Error: helm-chart-versions.yaml not found at $VERSION_FILE"
    exit 1
fi

# Extract grafana version using grep and sed
GRAFANA_VERSION=$(grep 'grafana:' "$VERSION_FILE" | sed 's/.*grafana: *//')

if [ -z "$GRAFANA_VERSION" ]; then
    echo "Error: Could not extract grafana version from $VERSION_FILE"
    exit 1
fi

HELM_CMD="helm upgrade --install grafana grafana/grafana \
  --version ${GRAFANA_VERSION} \
  --namespace=grafana \
  --create-namespace \
  --timeout 120m \
  --post-renderer /etc/genestack/kustomize/kustomize.sh \
  --post-renderer-args grafana/overlay"

HELM_CMD+=" -f ${BASE_OVERRIDES}"

for dir in "$GLOBAL_OVERRIDES_DIR" "$SERVICE_CONFIG_DIR"; do
    if compgen -G "${dir}/*.yaml" > /dev/null; then
        for yaml_file in "${dir}"/*.yaml; do
            HELM_CMD+=" -f ${yaml_file}"
        done
    fi
done

HELM_CMD+=" $@"

helm repo add grafana https://grafana.github.io/helm-charts
helm repo update

echo "Executing Helm command:"
echo "${HELM_CMD}"
eval "${HELM_CMD}"