From 54b96bf14e0aa21d67291f35c518b42d30153a79 Mon Sep 17 00:00:00 2001 From: Aleksandr Albekov Date: Mon, 12 Oct 2026 20:43:23 +0200 Subject: [PATCH] Add the grafana OIDC client for cluster monitoring grafana.int.bulbashenko.com signs in through Hydra; only infra-admins pass consent. Grafana uses PKCE and sends the secret in the Authorization header (client_secret_basic). The secret comes from the Secret auth (key OIDC_GRAFANA_CLIENT_SECRET, added in infra together with the monitoring stack). Co-Authored-By: Claude Opus 5.5 --- compose.yml | 1 + deploy/k8s/ui.yaml | 1 + e2e/test.env | 1 + kustomization.yaml | 1 + ory/hydra/clients/grafana.json | 13 +++++++++++++ 5 files changed, 17 insertions(+) create mode 100644 ory/hydra/clients/grafana.json diff --git a/compose.yml b/compose.yml index 98beb33..93d50b1 100644 --- a/compose.yml +++ b/compose.yml @@ -266,6 +266,7 @@ services: OIDC_COOLIFY_CLIENT_SECRET: ${OIDC_COOLIFY_CLIENT_SECRET:?} OIDC_HEADSCALE_CLIENT_SECRET: ${OIDC_HEADSCALE_CLIENT_SECRET:?} OIDC_FLUXWEB_CLIENT_SECRET: ${OIDC_FLUXWEB_CLIENT_SECRET:?} + OIDC_GRAFANA_CLIENT_SECRET: ${OIDC_GRAFANA_CLIENT_SECRET:?} volumes: - ./ory/hydra/clients:/app/clients:ro # Plain-text secrets of the confidential clients; Hydra stores only their hashes. diff --git a/deploy/k8s/ui.yaml b/deploy/k8s/ui.yaml index 685527a..2171d9c 100644 --- a/deploy/k8s/ui.yaml +++ b/deploy/k8s/ui.yaml @@ -87,6 +87,7 @@ spec: - { name: OIDC_COOLIFY_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_COOLIFY_CLIENT_SECRET } } } - { name: OIDC_HEADSCALE_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_HEADSCALE_CLIENT_SECRET } } } - { name: OIDC_FLUXWEB_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_FLUXWEB_CLIENT_SECRET } } } + - { name: OIDC_GRAFANA_CLIENT_SECRET, valueFrom: { secretKeyRef: { name: auth, key: OIDC_GRAFANA_CLIENT_SECRET } } } resources: requests: { cpu: 10m, memory: 48Mi } securityContext: diff --git a/e2e/test.env b/e2e/test.env index bdb63cb..c11c55b 100644 --- a/e2e/test.env +++ b/e2e/test.env @@ -17,6 +17,7 @@ OIDC_SITE_CLIENT_SECRET=test-site-secret OIDC_COOLIFY_CLIENT_SECRET=test-coolify-secret OIDC_HEADSCALE_CLIENT_SECRET=test-headscale-secret OIDC_FLUXWEB_CLIENT_SECRET=test-fluxweb-secret +OIDC_GRAFANA_CLIENT_SECRET=test-grafana-secret # The suite signs in many times a minute from one machine; the rate-limit test checks the per-client limit. AUTH_RATE_LIMIT_PER_CLIENT=60 AUTH_RATE_LIMIT_TOTAL=1000 diff --git a/kustomization.yaml b/kustomization.yaml index 2a005a1..7209800 100644 --- a/kustomization.yaml +++ b/kustomization.yaml @@ -34,6 +34,7 @@ configMapGenerator: - ory/hydra/clients/bulbashenko-site.json - ory/hydra/clients/coolify.json - ory/hydra/clients/flux-web.json + - ory/hydra/clients/grafana.json - ory/hydra/clients/headscale.json - ory/hydra/clients/stalwart-webui.json - ory/hydra/clients/thunderbird.json diff --git a/ory/hydra/clients/grafana.json b/ory/hydra/clients/grafana.json new file mode 100644 index 0000000..aba1776 --- /dev/null +++ b/ory/hydra/clients/grafana.json @@ -0,0 +1,13 @@ +{ + "client_id": "grafana", + "client_name": "Grafana (cluster monitoring)", + "client_secret": "${OIDC_GRAFANA_CLIENT_SECRET}", + "token_endpoint_auth_method": "client_secret_basic", + "grant_types": ["authorization_code", "refresh_token"], + "response_types": ["code"], + "scope": "openid offline_access profile email groups", + "redirect_uris": ["https://grafana.int.bulbashenko.com/login/generic_oauth"], + "post_logout_redirect_uris": ["https://grafana.int.bulbashenko.com/login"], + "skip_consent": true, + "metadata": { "required_group": "infra-admins" } +}