rock/homelab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(grafana): give homelab-admins Admin org role, akadmin GrafanaAdmin

Browse Source 
GrafanaAdmin is server admin only — no org membership, so users couldn't
see dashboards. Now:
- akadmin: GrafanaAdmin (server admin, can impersonate)
- homelab-admins: Admin (org admin, dashboard access)
- others: Viewer
This commit is contained in:
rock
2026-09-04 23:41:22 -07:00
parent ed794befdb
commit 6db4d7dcb0
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/infra/logging/grafana-values.yaml
+3 -4
View File
@@ -68,9 +68,8 @@ grafana.ini:
# doesn't return localhost redirects in its token responses. # doesn't return localhost redirects in its token responses.
# #
# role_attribute_path: JMESPath expression evaluated against the userinfo # role_attribute_path: JMESPath expression evaluated against the userinfo
# response. Members of the 'grafana-admins' Authentik group get Admin role; # response. akadmin gets GrafanaAdmin (server admin, can impersonate);
# everyone else gets Viewer. The group name must match exactly what Authentik # homelab-admins members get Admin (org admin); everyone else Viewer.
# sends in the 'groups' claim.
auth.generic_oauth: auth.generic_oauth:
enabled: true enabled: true
name: Authentik name: Authentik
@@ -87,7 +86,7 @@ grafana.ini:
email_attribute_path: email email_attribute_path: email
login_attribute_path: preferred_username login_attribute_path: preferred_username
name_attribute_path: name name_attribute_path: name
role_attribute_path: "contains(groups[*], 'homelab-admins') && 'GrafanaAdmin' || 'Viewer'" role_attribute_path: "preferred_username == 'akadmin' && 'GrafanaAdmin' || contains(groups[*], 'homelab-admins') && 'Admin' || 'Viewer'"
allow_assign_grafana_admin: true allow_assign_grafana_admin: true
use_pkce: false use_pkce: false
use_refresh_token: false use_refresh_token: false