feat(grafana): switch OIDC auth to authentik

[martinohmann]

Updates #168

[github-actions]

--- HelmRelease: monitoring/grafana ConfigMap: monitoring/grafana

+++ HelmRelease: monitoring/grafana ConfigMap: monitoring/grafana

@@ -20,24 +20,21 @@

     oauth_auto_login = false
     [auth.anonymous]
     enabled = false
     [auth.basic]
     enabled = false
     [auth.generic_oauth]
-    empty_scopes = false
     enabled = true
-    groups_attribute_path = groups
     icon = signin
-    login_attribute_path = preferred_username
-    name = Authelia
-    name_attribute_path = name
-    scopes = openid profile email groups
+    name = Authentik
+    scopes = openid profile email
+    skip_org_role_sync = true
     use_pkce = true
     [auth.generic_oauth.group_mapping]
     org_id = 1
-    role_attribute_path = contains(groups[*], 'admins') && 'Admin' || contains(groups[*], 'people') && 'Viewer'
+    role_attribute_path = contains(groups[*], 'admins') && 'Admin' || 'Viewer'
 
     [grafana_net]
     url = https://grafana.net
     [log]
     level = debug
     mode = console
--- HelmRelease: monitoring/grafana Deployment: monitoring/grafana

+++ HelmRelease: monitoring/grafana Deployment: monitoring/grafana

@@ -221,25 +221,23 @@

           value: /var/log/grafana
         - name: GF_PATHS_PLUGINS
           value: /var/lib/grafana/plugins
         - name: GF_PATHS_PROVISIONING
           value: /etc/grafana/provisioning
         - name: GF_AUTH_GENERIC_OAUTH_API_URL
-          value: https://auth.18b.haus/api/oidc/userinfo
+          value: https://identity.18b.haus/application/o/userinfo/
         - name: GF_AUTH_GENERIC_OAUTH_AUTH_URL
-          value: https://auth.18b.haus/api/oidc/authorization
+          value: https://identity.18b.haus/application/o/authorize/
         - name: GF_AUTH_GENERIC_OAUTH_CLIENT_ID
           value: grafana
         - name: GF_AUTH_GENERIC_OAUTH_TOKEN_URL
-          value: https://auth.18b.haus/api/oidc/token
+          value: https://identity.18b.haus/application/o/token/
         - name: GF_AUTH_SIGNOUT_REDIRECT_URL
-          value: https://auth.18b.haus/logout?rd=https://grafana.18b.haus/login
+          value: https://identity.18b.haus/application/o/grafana/end-session/
         - name: GF_EXPLORE_ENABLED
           value: 'true'
-        - name: GF_SECURITY_COOKIE_SAMESITE
-          value: grafana
         - name: GF_SERVER_ROOT_URL
           value: https://grafana.18b.haus
         envFrom:
         - secretRef:
             name: grafana
             optional: false

[github-actions]

--- kubernetes/apps/monitoring/grafana/app Kustomization: flux-system/grafana HelmRelease: monitoring/grafana

+++ kubernetes/apps/monitoring/grafana/app Kustomization: flux-system/grafana HelmRelease: monitoring/grafana

@@ -215,19 +215,18 @@

         deleteDatasources:
         - name: Prometheus
           orgId: 1
     deploymentStrategy:
       type: Recreate
     env:
-      GF_AUTH_GENERIC_OAUTH_API_URL: https://auth.18b.haus/api/oidc/userinfo
-      GF_AUTH_GENERIC_OAUTH_AUTH_URL: https://auth.18b.haus/api/oidc/authorization
+      GF_AUTH_GENERIC_OAUTH_API_URL: https://identity.18b.haus/application/o/userinfo/
+      GF_AUTH_GENERIC_OAUTH_AUTH_URL: https://identity.18b.haus/application/o/authorize/
       GF_AUTH_GENERIC_OAUTH_CLIENT_ID: grafana
-      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: https://auth.18b.haus/api/oidc/token
-      GF_AUTH_SIGNOUT_REDIRECT_URL: https://auth.18b.haus/logout?rd=https://grafana.18b.haus/login
+      GF_AUTH_GENERIC_OAUTH_TOKEN_URL: https://identity.18b.haus/application/o/token/
+      GF_AUTH_SIGNOUT_REDIRECT_URL: https://identity.18b.haus/application/o/grafana/end-session/
       GF_EXPLORE_ENABLED: true
-      GF_SECURITY_COOKIE_SAMESITE: grafana
       GF_SERVER_ROOT_URL: https://grafana.18b.haus
     envFromSecrets:
     - name: grafana
     grafana.ini:
       analytics:
         check_for_plugin_updates: false
@@ -238,25 +237,22 @@

         oauth_auto_login: false
       auth.anonymous:
         enabled: false
       auth.basic:
         enabled: false
       auth.generic_oauth:
-        empty_scopes: false
         enabled: true
-        groups_attribute_path: groups
         icon: signin
-        login_attribute_path: preferred_username
-        name: Authelia
-        name_attribute_path: name
-        scopes: openid profile email groups
+        name: Authentik
+        scopes: openid profile email
+        skip_org_role_sync: true
         use_pkce: true
       auth.generic_oauth.group_mapping:
         org_id: 1
         role_attribute_path: |
-          contains(groups[*], 'admins') && 'Admin' || contains(groups[*], 'people') && 'Viewer'
+          contains(groups[*], 'admins') && 'Admin' || 'Viewer'
       log:
         level: debug
       news:
         news_feed_enabled: false
     ingress:
       annotations: