From 6db4d7dcb05189d16fd112be8374c01ec50efdd3 Mon Sep 17 00:00:00 2001 From: rock Date: Fri, 4 Sep 2026 23:41:22 -0700 Subject: [PATCH] fix(grafana): give homelab-admins Admin org role, akadmin GrafanaAdmin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GrafanaAdmin is server admin only — no org membership, so users couldn't see dashboards. Now: - akadmin: GrafanaAdmin (server admin, can impersonate) - homelab-admins: Admin (org admin, dashboard access) - others: Viewer --- k8s/infra/logging/grafana-values.yaml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/k8s/infra/logging/grafana-values.yaml b/k8s/infra/logging/grafana-values.yaml index 578bd24..c27e4f2 100644 --- a/k8s/infra/logging/grafana-values.yaml +++ b/k8s/infra/logging/grafana-values.yaml @@ -68,9 +68,8 @@ grafana.ini: # doesn't return localhost redirects in its token responses. # # role_attribute_path: JMESPath expression evaluated against the userinfo - # response. Members of the 'grafana-admins' Authentik group get Admin role; - # everyone else gets Viewer. The group name must match exactly what Authentik - # sends in the 'groups' claim. + # response. akadmin gets GrafanaAdmin (server admin, can impersonate); + # homelab-admins members get Admin (org admin); everyone else Viewer. auth.generic_oauth: enabled: true name: Authentik @@ -87,7 +86,7 @@ grafana.ini: email_attribute_path: email login_attribute_path: preferred_username name_attribute_path: name - role_attribute_path: "contains(groups[*], 'homelab-admins') && 'GrafanaAdmin' || 'Viewer'" + role_attribute_path: "preferred_username == 'akadmin' && 'GrafanaAdmin' || contains(groups[*], 'homelab-admins') && 'Admin' || 'Viewer'" allow_assign_grafana_admin: true use_pkce: false use_refresh_token: false