Grafana deployment with Google SSO configuration

A basic example of a Grafana Deployment that overrides SSO configuration, it’s important to note that most configuration that is valid in the grafana container can be done with grafana-operator.

Make sure that you have DNS and HTTPS already configured with your Grafana instance, as Google SSO requires HTTPS to work with SSO applications.

Steps

Generate Google OAuth Keys

Follow official Grafana guide in how to create Google Oauth Keys here.

Create a Kubernetes Secret

In order to safely manage the OAuth keys/credentials we recommend you creating a Kubernetes secrets to store the clientId and clientSecret that Google will use.

The grafana-operator is agnostic to any secret management solution you might use to get this secret (Vault, external-secrets, vanilla K8s secrets, etc).

apiVersion: v1
data:
  client-id: c29tZXJlYWxseWxvbmdzZWNyZXRqdXN0dG9jb3ZlcnN0dWZmCg==
  client-secret: c29tZXJlYWxseWxvbmdzZWNyZXRqdXN0dG9jb3ZlcnN0dWZmCg==
kind: Secret
metadata:
  name: grafana-admin-credentials
  namespace: monitoring
type: Opaque

Creating our Grafana Instance

Create a Grafana instance overriding the configuration for auth.google.

Haven’t tested this with other means of authentication (Github, Okta, etc) but configuration should be pretty similar in case you want to use any other solution.

apiVersion: grafana.integreatly.org/v1beta1
kind: Grafana
metadata:
  name: grafana
  labels:
    dashboards: "grafana"
spec:
  config:
    log:
      mode: "console"
    auth:
      disable_login_form: "false"
    auth.google:
      enabled: "true"
      scopes: https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email
      auth_url: https://accounts.google.com/o/oauth2/auth
      token_url: https://accounts.google.com/o/oauth2/token
      allowed_domains: your-domain.com
      allow_sign_up: "true"
    server:
      root_url: https://grafana.your-domain.com
...

Now, we need to override some of the deployment spec, in order to add the secrets, make sure to point to the right secret name and key.

...
deployment:
    spec:
      template:
        spec:
          containers:
            - name: grafana
              env:
                - name: GF_AUTH_GOOGLE_CLIENT_ID
                  valueFrom:
                    secretKeyRef:
                      name: grafana-admin-credentials
                      key: client-id
                - name: GF_AUTH_GOOGLE_CLIENT_SECRET
                  valueFrom:
                    secretKeyRef:
                      name: grafana-admin-credentials
                      key: client-secret
              image: grafana/grafana:10.0.3
...

Make sure that have ingress and tls already configured as they are a prerequisite to work with Google SSO.

...
  ingress:
    metadata:
      annotations:
        kubernetes.io/ingress.class: nginx
        external-dns.alpha.kubernetes.io/hostname: grafana.your-domain.com
        cert-manager.io/cluster-issuer: letsencrypt-prod
    spec:
      ingressClassName: nginx
      rules:
        - host: grafana.your-domain.com
          http:
            paths:
              - backend:
                  service:
                    name: grafana-service
                    port:
                      number: 3000
                path: /
                pathType: Prefix
      tls:
        - hosts:
            - grafana.your-domain.com
          secretName: grafana-tls-secret

Full configuration is below.

apiVersion: v1
data:
  client-id: c29tZXJlYWxseWxvbmdzZWNyZXRqdXN0dG9jb3ZlcnN0dWZmCg==
  client-secret: c29tZXJlYWxseWxvbmdzZWNyZXRqdXN0dG9jb3ZlcnN0dWZmCg==
kind: Secret
metadata:
  name: grafana-admin-credentials
  namespace: monitoring
type: Opaque
---
apiVersion: grafana.integreatly.org/v1beta1
kind: Grafana
metadata:
  name: grafana
  labels:
    dashboards: "grafana"
spec:
  config:
    log:
      mode: "console"
    auth:
      disable_login_form: "false"
    auth.google:
      enabled: "true"
      scopes: https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email
      auth_url: https://accounts.google.com/o/oauth2/auth
      token_url: https://accounts.google.com/o/oauth2/token
      allowed_domains: your-domain.com
      allow_sign_up: "true"
    server:
      root_url: https://grafana.your-domain.com
  deployment:
    spec:
      template:
        spec:
          containers:
            - name: grafana
              env:
                - name: GF_AUTH_GOOGLE_CLIENT_ID
                  valueFrom:
                    secretKeyRef:
                      name: grafana-admin-credentials
                      key: client-id
                - name: GF_AUTH_GOOGLE_CLIENT_SECRET
                  valueFrom:
                    secretKeyRef:
                      name: grafana-admin-credentials
                      key: client-secret
              image: grafana/grafana:10.0.3
  ingress:
    metadata:
      annotations:
        kubernetes.io/ingress.class: nginx
        external-dns.alpha.kubernetes.io/hostname: grafana.your-domain.com
        cert-manager.io/cluster-issuer: letsencrypt-prod
    spec:
      ingressClassName: nginx
      rules:
        - host: grafana.your-domain.com
          http:
            paths:
              - backend:
                  service:
                    name: grafana-service
                    port:
                      number: 3000
                path: /
                pathType: Prefix
      tls:
        - hosts:
            - grafana.your-domain.com
          secretName: grafana-tls-secret