7 files changed, 151 insertions, 0 deletions
diff --git a/kubernetes/namespaces/monitoring/grafana/README.md b/kubernetes/namespaces/monitoring/grafana/README.md
new file mode 100644
index 0000000..03a9682
--- /dev/null
+++ b/kubernetes/namespaces/monitoring/grafana/README.md
@@ -0,0 +1,11 @@
+# Grafana
+
+This folder contains the manifests for deploying our Grafana instance, the service we use to query our data.
+
+This deployment expects a number of secrets and environment variables to exist in a secret called `grafana-secret-env`.
+
+| Environment                  | Description                                         |
+|------------------------------|-----------------------------------------------------|
+| GF_AUTH_GITHUB_CLIENT_ID     | The client ID of the Github app to use for auth     |
+| GF_AUTH_GITHUB_CLIENT_SECRET | The client secret of the Github app to use for auth |
+| GF_SECURITY_ADMIN_PASSWORD   | The admin password the the grafana admin console    |
diff --git a/kubernetes/namespaces/monitoring/grafana/configmap.yaml b/kubernetes/namespaces/monitoring/grafana/configmap.yaml
new file mode 100644
index 0000000..931e2da
--- /dev/null
+++ b/kubernetes/namespaces/monitoring/grafana/configmap.yaml
@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-default
+  namespace: monitoring
+data:
+  # Root settings
+  GF_INSTANCE_NAME: "pythondiscord"
+  GF_SERVER_DOMAIN: "grafana.pythondiscord.com"
+  GF_SERVER_ROOT_URL: "https://grafana.pythondiscord.com"
+  GF_SECURITY_COOKIE_SECURE: "true"
+
+  # GitHub Auth
+  GF_AUTH_GITHUB_ENABLED: "true"
+  GF_AUTH_GITHUB_SCOPES: "user:email,read:org"
+  # IDs can be retrieved via `gh api orgs/python-discord/teams`.
+  GF_AUTH_GITHUB_TEAM_IDS: "2638565,3854739,3114246,7361120,9120709"
+  GF_AUTH_GITHUB_ROLE_ATTRIBUTE_PATH: "contains(groups[*], '@python-discord/directors') && 'Admin' || contains(groups[*], '@python-discord/sudo-devops') && 'Admin' || contains(groups[*], '@python-discord/admins') && 'Editor' || 'Viewer'"
+  GF_AUTH_GITHUB_AUTH_URL: "https://github.com/login/oauth/authorize"
+  GF_AUTH_GITHUB_TOKEN_URL: "https://github.com/login/oauth/access_token"
+  GF_AUTH_GITHUB_API_URL: "https://api.github.com/user"
+  GF_AUTH_ALLOW_SIGN_UP: "true"
+
+  # Image storage
+  GF_EXTERNAL_IMAGE_STORAGE_PROVIDED: "local"
+
+  # Metrics
+  GF_METRICS_ENABLED: "false"
+
+  # User sign up
+  GF_USERS_AUTO_ASSIGN_ORG: "true"
+  GF_USERS_AUTO_ASSIGN_ORG_ID: "2"
+
+  # Feature toggles
+  GF_FEATURE_TOGGLES_ENABLE: "autoMigrateOldPanels,nestedFolders,newVizTooltips,prometheusMetricEncyclopedia,datatrails"
+
+  # Plugins
+  GF_INSTALL_PLUGINS: "https://storage.googleapis.com/integration-artifacts/grafana-lokiexplore-app/grafana-lokiexplore-app-latest.zip;grafana-lokiexplore-app"
diff --git a/kubernetes/namespaces/monitoring/grafana/deployment-grafana.yaml b/kubernetes/namespaces/monitoring/grafana/deployment-grafana.yaml
new file mode 100644
index 0000000..87e3059
--- /dev/null
+++ b/kubernetes/namespaces/monitoring/grafana/deployment-grafana.yaml
@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: grafana
+  namespace: monitoring
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: grafana
+  template:
+    metadata:
+      labels:
+        app: grafana
+    spec:
+      containers:
+        - name: grafana
+          image: grafana/grafana:11.0.0-preview
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 3000
+          resources:
+            requests:
+             cpu: 200m
+             memory: 100Mi
+            limits:
+              cpu: 300m
+              memory: 250Mi
+          envFrom:
+            - configMapRef:
+                name: grafana-default
+            - secretRef:
+                name: grafana-secret-env
+          volumeMounts:
+            - mountPath: /var/lib/grafana
+              name: grafana-volume
+            - mountPath: /tmp
+              name: grafana-tmp
+          securityContext:
+            readOnlyRootFilesystem: true
+      volumes:
+        - name: grafana-volume
+          persistentVolumeClaim:
+            claimName: grafana-storage
+        - name: grafana-tmp
+          emptyDir:
+            medium: Memory
+      securityContext:
+        fsGroup: 2000
+        runAsUser: 1000
+        runAsNonRoot: true
diff --git a/kubernetes/namespaces/monitoring/grafana/ingress.yaml b/kubernetes/namespaces/monitoring/grafana/ingress.yaml
new file mode 100644
index 0000000..4331333
--- /dev/null
+++ b/kubernetes/namespaces/monitoring/grafana/ingress.yaml
@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
+    nginx.ingress.kubernetes.io/auth-tls-secret: "kube-system/mtls-client-crt-bundle"
+    nginx.ingress.kubernetes.io/auth-tls-error-page: "https://www.youtube.com/watch?v=dQw4w9WgXcQ"
+  name: grafana
+  namespace: monitoring
+spec:
+  tls:
+  - hosts:
+      - "*.pythondiscord.com"
+    secretName: pythondiscord.com-tls
+  rules:
+  - host: grafana.pythondiscord.com
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: grafana
+            port:
+              number: 3000
diff --git a/kubernetes/namespaces/monitoring/grafana/secrets.yaml b/kubernetes/namespaces/monitoring/grafana/secrets.yaml
new file mode 100644
index 0000000..b817eca
--- /dev/null
+++ b/kubernetes/namespaces/monitoring/grafana/secrets.yaml
diff --git a/kubernetes/namespaces/monitoring/grafana/services.yaml b/kubernetes/namespaces/monitoring/grafana/services.yaml
new file mode 100644
index 0000000..de2d76b
--- /dev/null
+++ b/kubernetes/namespaces/monitoring/grafana/services.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: grafana
+  namespace: monitoring
+spec:
+  ports:
+    - port: 3000
+  selector:
+    app: grafana
diff --git a/kubernetes/namespaces/monitoring/grafana/volume.yaml b/kubernetes/namespaces/monitoring/grafana/volume.yaml
new file mode 100644
index 0000000..735a4c5
--- /dev/null
+++ b/kubernetes/namespaces/monitoring/grafana/volume.yaml
@@ -0,0 +1,14 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: grafana-storage
+  namespace: monitoring
+  labels:
+    app: grafana
+spec:
+  storageClassName: linode-block-storage-retain
+  accessModes:
+    - ReadWriteOncePod
+  resources:
+    requests:
+      storage: 10Gi