1.2 KiB
Grafana
Private Grafana for the home observability stack. The pinned Grafana chart is
rendered as the independent grafana release in observability; the
kube-prometheus-stack embedded Grafana remains disabled.
The workload consumes, but never renders, these existing Secret contracts:
grafana-admin:admin-user,admin-passwordgrafana-keycloak-oidc:client-id,client-secret
The grafana PVC is fixed to observability-grafana-local-pv (2Gi, Retain).
Host Nginx terminates the exact-SAN certificate and forwards plain HTTP through
Traefik; the Kubernetes Ingress therefore contains no TLS material.
The Pod does not automount a service-account token. A 3600-second projected
token, CA, and namespace are mounted only into grafana-sc-dashboard, whose
namespaced Role can read ConfigMaps but not Secrets. Dashboard ConfigMaps must
carry grafana_dashboard: "1" in observability.
Provisioned datasource UIDs are prometheus, loki, and tempo. Tempo service
map configuration is present for future use, but the metrics-generator and
Prometheus remote-write path are intentionally not enabled, so service-graph
availability is not an initial acceptance condition.