# Grafana

Private Grafana for the home observability stack. The pinned Grafana chart is
rendered as the independent `grafana` release in `observability`; the
kube-prometheus-stack embedded Grafana remains disabled.

The workload consumes, but never renders, these existing Secret contracts:

- `grafana-admin`: `admin-user`, `admin-password`
- `grafana-keycloak-oidc`: `client-id`, `client-secret`

The `grafana` PVC is fixed to `observability-grafana-local-pv` (2Gi, Retain).
Host Nginx terminates the exact-SAN certificate and forwards plain HTTP through
Traefik; the Kubernetes Ingress therefore contains no TLS material.

The Pod does not automount a service-account token. A 3600-second projected
token, CA, and namespace are mounted only into `grafana-sc-dashboard`, whose
namespaced Role can read ConfigMaps but not Secrets. Dashboard ConfigMaps must
carry `grafana_dashboard: "1"` in `observability`.

Provisioned datasource UIDs are `prometheus`, `loki`, and `tempo`. Tempo service
map configuration is present for future use, but the metrics-generator and
Prometheus remote-write path are intentionally not enabled, so service-graph
availability is not an initial acceptance condition.