feat(add-ons): Add observability stack with kube-prometheus-stack, loki and alloy

2026-09-30 01:18:44 +05:30
parent 148890fb86
commit 1b97727981
18 changed files with 668 additions and 0 deletions
@@ -67,3 +67,32 @@ data:
          domain: authentik-default
        attrs:
          flow_authentication: !KeyOf google-flow
+  grafana.yaml: |
+    version: 1
+    metadata:
+      name: Grafana
+    entries:
+      - model: authentik_providers_oauth2.oauth2provider
+        id: grafana-provider
+        identifiers:
+          name: grafana
+        attrs:
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_id: grafana
+          client_secret: !Env GRAFANA_CLIENT_SECRET
+          redirect_uris:
+            - matching_mode: strict
+              url: https://grafana.whyredfire.dev/login/generic_oauth
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+      - model: authentik_core.application
+        identifiers:
+          slug: grafana
+        attrs:
+          name: Grafana
+          provider: !KeyOf grafana-provider
+          meta_launch_url: https://grafana.whyredfire.dev
@@ -11,6 +11,7 @@ spec:
    AUTHENTIK_SECRET_KEY: AgAHHDs8mbJRc45DFgap2VUZn/F+m59hm9u2lebuJv70HSBxLLsHEn8nXLGUO3b2ScyPt1Qi2wbmRDENTjOHOYHtAQAjwV25r6RUiZ5TosRH2KhGx5N6gceorYQyk18l2CkKv4ObXjeGLJA0EqMarmFWiT24SFZdtIrOvWygLxg4XGful2h1Fw5uXK9PiUHgptrp/G5M5Htv0bvtD6m/FrgOlK6C6tK1D4vLL3VLX3/SceqNWVDIJmJao5JKO4IZTQxN8TN5k9K2CGrtOUhjCn4vLbYQKTPhiiidoQaipQ9FR+4KJMO0y8FbIy+3q7C/UZPyOTOu/2zI4t5h4TJY1+477A80GTLpE0aCBDpmFwgZY728wbTW4NyfIm15u0Um7OXhnJkXC1EqDbvlK4HYHiSDUjGChvlfMEY+D1datDlF1fEuIaeXtTqowpz3uy9qIEa0f1emS2J8TjIrKH3oW3mfmrJKSiySnCX1704ZPlwOJfnF5Z2vM6Oqo/mWHa6PSwPPRxSxEKVtSqD4KynzrUmx3GkrUs+7tntepA3yQoiDjyUyE71FwhJXO4sE3XcRGDUf4rB8CFO4+NgTbBAqFzNKYG32GIDhGjbMxBAJQMNXZhVcKceiaXf7G8LuaOEw39BkdtiFCdK3uXl9xaQPuStRsOYYQR2Dt0vt3AvDGjAW+McauCbYUD3rcAtVMo+rxEbejrotojWnb1OpGX0JqD5gHC68qlqY6BYkDbWpYojoKWJHuHlYxHIm8k7ghSq6npw94R526bxripNtcNq4Lh1NeM55LKruOEGr7n0dFcyAmQ==
    GOOGLE_CLIENT_ID: AgCV2Rwe/bHbkQ3nkkIs4EFTbsEqQWRaWlXa/fHzkDyNKpd0CTOgqVb6Rd2KYyvoT9iDR0xt/8reLPd9e7B3G3V1oVFV7G1XiErBmzvxr6591+tXzo8JLVpIy0363R87idi2xIKGVii+G5aJvxxhua8IRsNfi4SRtoqpDzjgNbFtm5UDhhlCzcRKkm0zHgLw83d4Uwszu9X9II2A4FuMPD6KvsTFrgHevR1v3OerKl5kvTlUx0O3XEg5mnNUVk46J+D9wfg58bIlgUhMV8NtfKa8I5zmRKhCJySks1zlCgIudCLX7wPYupFgt0nrZjJGx7a546ntPdMVE4IJ+VhlQ94gjdWsVFm07espaQLph9T4CZDKxb6TwyNswhfFxH1Z9auyFf3Cfk2wx5GChNOL0mZ8Zrzcw008c8IUShF8je8JZ60teBffbBNao7XN6JM6a4ac5aKnNwFch9IJUU1qkvcJaZk5hAkeGO9uHrICb6lkr5Rj7t4h9l4mvgfIKXP5YCCKZ+yqrSI8Jpkch/cB0Sphgp7m7QXgGwmWRgdKEk1rP7ioIfoF66mLsfgvOkc+1ySvPgW/rCLbHwzMqJn1Fkk/afbRoWp/guFj1cOY9MrEQIn8ftugeV/0xWiL+y5RyJm7QZc1z5fSj/NTrVCZV0LhBHttPZzoGGWEqjLYQnyJ8p38lK7EU6Pmk4WrEMj7mmdYHEijyPhab+b7guOc+ULbPT7k7sBHXbKrTTUJa09jIqSS4jl2PNrzPCPDIvRpG/cMgNklhNPfvpDQcLdVRA7bsf7navZvDsQ=
    GOOGLE_CLIENT_SECRET: AgDNFpqV5LGekTMvOBtPE9c6ZVPtT6wN+nCFRhZnvBKIz4I7U9jzisEN7yhc4ud22XJXpS5oR8hN4H+V6Js/bCZMDJefYcdstmHku14kUvoLRUtwPV9tdjiihmb57VLTnT1s1OzbnOqZPwXoCAmGAPLDgZrghBi0id21GgjU41jCHDJCcH1j9RHhE20JwsVG2uz9Tcp6MVYh94aq53V4//bvFXz4xQgVlN8c1jJ/W4rrNM9vmYdMwKyB5509oVWJigowsRlji0FXurR8ovz1AXpMuGj6hUGxLp0uHsqz7FV/0lsd4B2BR9cVRChAR8zDCiiKb4TH2Kmn676/Z+gtJ8vcOQg/WDT1ENzOr6dyndCLVxJvJuvl1EqinzhSqJjUy11HxqULApKKbX1iRJIAIGb6dpeKVoHDKg5xtcWGwaD6epG/tz20agkWBMCFNq5aS80npz28W5GeOQ8aF4X/rpjuEHVLrN+n0pgyS4wjwniB6UJMYRIYk45r0ICUtqyFjOiNzpU70NsPmEjDyItW1EVo+6tb0lRmOI5apm/9yayZXjFISwTAFPdBMrQL+ij4AGw4HMWMmN0aqDO+Kd1c9Jg6wUKluN2Lb6CaxehWeSJiz2wTEhEz8KBkInfezgSekNkw4wjJiBEZ4/M3G6Y/C61ekuVFarRc87cY+S3SomVZDGQcPysfQlieMVpHlfXq/CSDgHhZV3Q+S/wqpy5ZcfsyaU+v4PmvyEc12MZxQ1RGngVJow==
+    GRAFANA_CLIENT_SECRET: AgBSE0QjGwtnyAjO/cy/TBKg+fuyKMSRgeQM/i7tPi9QcLpDjEHquGKmdBHUaeSaon3LRH3CPYQJ61T4d4xsp7EXzCM47MhO/rJ+6Xx+dGiIg071Ijj1qOBYszMNPXLZCst/9EfDEBRXQYmtr8X5UfcyXv8RHewvuqxcwy8qzsPsP5G/CpchGWlZRV3x+R+yCjVmTP7VuatPAltvGuAHsAv3Gh1aEXMJ1F3SsW/SP025V/bMiz1wKWe7/bkqJnXjLkNXWI/lpwzYWQl4/9v1Oiiw+1osH6fHNzXM6RA0ei1/FmlRwS9EqnUnl9hGE76GSllhwU9L6K9boJrKRnZIP6xBOJfrqimZciutTfiu6urghyimVACafQLWkeEB8m/zX1CSxVQ5M95n/dtdlBsWofMVyEtoeTip1HXZF1iee4yMv2yEg8yNSWmnb87fSYIMwpMiv5dYQTLg2WslnEe0DxcnyH+O0/MsmWHFz2f/Z4J6h+kWwMEv1pt8l+xkgbUthGGDx+HIcU9SZ/jyZjnzTt4i4BIbejAoXzMmm6q4zE0BD+9AbAQvEDOg6DW1TIu2mupoKVlqYljNE/9zVOAIBcFL0cJ4HNnW13+ufS4KoptZE3Rfv1tpU6g2MZ4y+QBCOczd+5HgXMtv3P9OweZg/l/LRdbFyH3OZviW/4suJFNbWZNgGUlqT/xyk/C5rn7uGSjSinp0lwkAqfxx7To/KP0jE7hJkVOH1vh+7COpFABJEx/cLAXAaIaVJsio38p5i4s+SMEq85Ew3uI46YKD8ljY7AQN3k66U7xQkLgjAT170Q==
  template:
    metadata:
      name: authentik-secrets
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-admin
+  namespace: monitoring
+spec:
+  encryptedData:
+    admin-password: AgAvoctRn9pH4kx3i0Q75rwFQYuAavZ7/1sgIHzmuOhzR8qPJVLeMwgmbZHz/dcNwD59tKpk1WmzrazUSdTAgkAKCs+CsxXxmxYoaDx+tUEMxHzpUKtW3On6a9YMzhp1e7iTewSMQVW+JZxnubxgT8Ws5N6iDlb/SVKGqrGMMk0436L4qRrXJvtmFRbcjn0h6dZHjuBNDBsGXh5TJCk07IIDYkaCpkZoJvH4Brf3Zla0jgRI3FQ2qFygButR1HLZQ6n7CPq9rhKhzSt3NWktV4zuU3GnZXgk8h9TML09UVEfv8W3NkKmIoXb7DewMhTbtcGw61eV6oCAERv0G2lVIBUQ6Zrfj942QB3KKvXLWzKNlCOMgV/JJUtEFw+lnsB9CLJzEl7eSodsIIFQIaby4iEozjaB2QtWtrROmR7mQDEqk1N0AUHx8oiuJFtJDeTn/0dzswPT+SRWlYoGr54uxHo0nFwkAZyEQehdrsd0Tor9BlXYt510fTSC4VZKHjFbDggyLPn+rmNrShQKB8yfeouovR/SaMa9LG0GpGR51dmDmtH64pN8ukCvMyjXrttD8qiArj+ysywTA2Fge61m1bw4dhen5v7HUrfZW5TxualndhhcUA1VWB9rljZvCqrzeYAwbdj36uTC37mqqhwa36SNKG/AHjKBJ0968TQRgf+DvP+xyIeqFk/tBA4FIfYkDM1jHrSlydWQ7vPca6pbXFtTVA6xUYpqraeCdcIK1n9mxFBG513W
+    admin-user: AgAzRobKF4UVBc21QSAN42jmMSULMTO5F6wkOYIBqgUMyVAdSD1yW+9KP8s7Bu0+1efiqeAJGtB74IJ/8Py7szgHVv1jqHpKz9hqd8A+nJjAhAXvCaERMzM5KZu1ArAmRX6X6H2OdveOgii8la5mrOBDOXVFiG7AMYzjlP+Ia5H/5HBHsEAEKUUNZF1DCznOS448dGftyKK8XEDkCca9B62rFyV+fjEhnTVkvqlg++wgCv/YqHOWzT1uSXLtOBQzoTiYJM6D1oC4n8+xuQx6o7Z/sy6K1Cc5Ypx0ENPpuPwrIUgfpWt84XgKKM94tzN3szFXrlZe2uGkh5gNTEiSnjRa5azsGU/pp8uNV01FUwCORKbWtvyHm+mLM3V1qMhlQpenF92pOVlsMspvxMMaE9iWz5CaQl7QWEH25rjrlI1FGIQx5tQwZrOD2u7qRZ1xv1rsG/GfvKN3tTj7HkhbHL+OIkJHxEx4Doc6yoW57M8sV3b/18TuUWuRazBxn9RkNhcEd/CP/ZhKW13OhMm/U1fuzPDGqgWHoz+jVM7XCb9/p+X0vxUAt2ZiOAc1n8tGDglxkSYhoZX6agn6fviSaEWskalqpisiSpvpzQra/HxoyWqNG4+ovHiRM1yCdSxdsZoziVuVdnjP2wDV525nuU+38uDxMgAxWEigEFr5sOb5LFKKC+nnSwxaQ/+vk4NPJGqTuu9tGA==
+  template:
+    metadata:
+      name: grafana-admin
+      namespace: monitoring
@@ -0,0 +1,13 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-db
+  namespace: monitoring
+spec:
+  encryptedData:
+    password: AgCHwt3pHs+dvK/Dg3/PlRvDnC+LjOg42GXKVl61+wXcJdeIc2dtAHLnu1/OOyOOuIYFvovgS02GVH2RmWQ5kkfZ/lD7XRTJxmYBsBiiYqU5rMENy+EJ4bBLcDw7AoPZBowR3y+nl49qHSuCqPWvLwpQ4hh9OXtB0XpEOD8Vqdpr7t3reEMA0T3xd8TrdriNo2sHro5v8o8qMJvZ/6QGmqZWr0yOPMuNSfm4cTaJLCL/MsYQRsUuJ4+1+LLoldrNjSalYqhamQvA6UsVOnuH0Ajp8rj7lnbyf/PbUx+cvqT+4IkDxDnDffdN66Q5s+oND+fMEM64QhFBP7KPrw1rWQMTC+awe5mjf37h0J1JFtnty4p4gJ6eXjc2wQVleuxDzZP9m26bp0Lf00cMTxxWDSHeZsKg4aQ0aqsSKYyXg2i2Nu/UEX/NBrNGTCFNk8+QIGowYr8KJkgC/WmaUNBLxpiNW6YIPwYPqUQw1Kg8EIUOTFeCOMolnafeGC4DmHHEQzN/jbIdlCaIyBBC4sd48v/e3Cx6+Idz+8al27OnHzHCzD+2NGf+n10i8wJq6+YvOjgHuqWLjQ8G1pATTmdEZ2N++1q9EkY6GCvMn/iUfKZGrmW9ozeXrOr6ZMNKOyiv6wgNUpVf7Y0DERVRcwjdvJKu8UNtSJXD3MVj8Q0G/SyE2wVDf6PYiQHEirlUxCJQpZPAJAqnuqcNQ0QJG3caJZ3nCUNDT8Qp3PqjB5AjKlGYIblwYZuHj2xnDoDWwORVA3jHm25Niv9KTB/Qow/oz7i8
+  template:
+    metadata:
+      name: grafana-db
+      namespace: monitoring
@@ -0,0 +1,13 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-oidc
+  namespace: monitoring
+spec:
+  encryptedData:
+    client-secret: AgB2ONbIJxJkVYHuH8kTXuMX5UEFOrOw+UMASkYVQeDT9RBlswBTjtAOuQoZ/++H735rWvV2SD/Hq6PI0rX42lIbasElI83Hnc3PtwvUXajHpvvvB+mM9DH6iPwKzP7M+xgCFXib/4xgWCGa+OnmwfcmYKvWfvBClWQ7t3F0z3jQZNQOytFlXlD8hSCK8w38NwNc4E7JT1YVoH5oUPQq1PE7blsNtM9xqfPqQ+vPfRYjp/j3xXxQhqUHEN7oVZyWDH3UKnhbP+Vd4DzyPvdGZbNbFkzrEqB7ogJOzZAgcsDVs/3NyfDChlCE8MLQ7EnEE7puOdMt8gZhel8kVwBwyARZxy9Y+gvXe//qTyIPcvUdROzycI0QLj5Y8R/QH+AywX70Y7oyezaqcpaS7mRjl8duG8Jg52xFL8z2AjwMZo01vh2GkhxhuQ0ys+jJarQYRUk+cE28ZEZTT22KWmmCo/X1zarymgXO/hzUZwZTDy+GaTh30nCyXOwVipKirQhZCPEVVrT0GOyNz8iMgvbcQgOIFsgSF50vwo5yq2zTTPTtcNJUnfDkN/se/HNpyoEKXaNu2dsio3t7KE8VTaa6rBqw7GvZ81k+nR9stQh4a0U5uxC5Req/CHKvVxtFJXn3TZhlzpYN11zvWjpRMF505jOQVbqYa7xyLio17XF3tYuGUVUJK3AQklL7sO+9ilZhJG5GiqhERxexwEjgKO2j3GFkIPjjnk0BxXLrZtiNDCbW9UvtCBto0Q1qdOoyQTg0Dm0s/B4SmEaRl+9Bfd2943aSxnD799TePoIvgWjXeH9NBA==
+  template:
+    metadata:
+      name: grafana-oidc
+      namespace: monitoring
@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: grafana
+  namespace: monitoring
+spec:
+  hostnames:
+    - grafana.whyredfire.dev
+  parentRefs:
+    - kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  rules:
+    - backendRefs:
+        - name: kube-prometheus-stack-grafana
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - grafana-admin-sealedsecret.yaml
+  - grafana-db-sealedsecret.yaml
+  - grafana-oidc-sealedsecret.yaml
+  - httproute.yaml
+  - scrapeconfigs.yaml
@@ -0,0 +1,59 @@
+# k3s control plane (bound in /etc/rancher/k3s/config.yaml); every endpoint also serves apiserver series.
+apiVersion: monitoring.coreos.com/v1alpha1
+kind: ScrapeConfig
+metadata:
+  name: kube-controller-manager
+  namespace: monitoring
+spec:
+  jobName: kube-controller-manager
+  scheme: HTTPS
+  tlsConfig:
+    insecureSkipVerify: true
+  authorization:
+    credentials:
+      name: kube-prometheus-stack-prometheus-token
+      key: token
+  staticConfigs:
+    - targets:
+        - 192.168.2.5:10257
+  metricRelabelings:
+    - action: drop
+      sourceLabels: [__name__]
+      regex: (apiserver|etcd|kine)_.*
+---
+apiVersion: monitoring.coreos.com/v1alpha1
+kind: ScrapeConfig
+metadata:
+  name: kube-scheduler
+  namespace: monitoring
+spec:
+  jobName: kube-scheduler
+  scheme: HTTPS
+  tlsConfig:
+    insecureSkipVerify: true
+  authorization:
+    credentials:
+      name: kube-prometheus-stack-prometheus-token
+      key: token
+  staticConfigs:
+    - targets:
+        - 192.168.2.5:10259
+  metricRelabelings:
+    - action: drop
+      sourceLabels: [__name__]
+      regex: (apiserver|etcd|kine)_.*
+---
+apiVersion: monitoring.coreos.com/v1alpha1
+kind: ScrapeConfig
+metadata:
+  name: kube-proxy
+  namespace: monitoring
+spec:
+  jobName: kube-proxy
+  staticConfigs:
+    - targets:
+        - 192.168.2.5:10249
+  metricRelabelings:
+    - action: drop
+      sourceLabels: [__name__]
+      regex: (apiserver|etcd|kine)_.*
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - s3-sealedsecret.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: loki-s3
+  namespace: monitoring
+spec:
+  encryptedData:
+    LOKI_S3_ACCESS_KEY_ID: AgDIqzolb+yePeOimTq+WJwLyTsPnCJcivE3UmRURoRHklxpNUyJl6Webd0vEhIsa5rLlb/4UQkz+Lv5MCoqFJJ42z1mZWh3okHFRkf3S8cZlOo11KUlitUbz2YsVuWXEascbb0ScyM0iXvp2BeZSOB2cXX8FnOXs7uw1Zy9lKAEsKaT02p0IceXItCzYmQtNFt94Rzeq0Qej3rXHnXP33XgEsq40JvhAmENAEcfUwWKWksDraGNgBVDHntTRIYUbE4UuSF2ON12baNye7IQyPQJ08FtCYEokLLbcgCe58oUjyecEa2Gx9sGqEyRuumru7bpeQ0N4Uu6O0udhlY3Xpk+Oeo5pt0fJc0b82wG0obVo+/htbVvGvx40vAyjRIVsjJJB03/aMvM0qUystor92PnSn7jxZoe7XS8VS/bq9dqvWDe3CohoxBHU1oib7DB4uKGstUHIqgNQJHZYCtmnNYWEQLfZZlam5qks53nMmlB/BIR3Mzeiui59kjv5peP1JEHEduxOIjRKEP2FPNCds92fNTaIfvbrbrfxWUgeMJNMwauG7krTTgMEosMAM2fQzbQSgzcQS3tGzBDXZBTUSqcadrL4onvlthmh9XrHEsu7m3Ig62BJi2dIWcuHB4345hcaR/B2wtpJJIg+Sy9J8Gu/RfbeiKY80lQFDM4IVX2OExmcp3OTIoDmygyTIj91ydz9HPT8Ly+Jz2oYsmojhWxBeySp6Lm3mH+Ng==
+    LOKI_S3_SECRET_ACCESS_KEY: AgDE/X9NIn7vSjjQQjStswNmTw1Xg/40GlyCUTYWMtL3AizRG8h4BI/NftlM3AfmBeoE0guSOB7S9NG318Wa3wzT9/NB3qW/oHB/Mck+jx+mTvso1jsgTilcKgF1L9HoORG+uvlKp35WX1+8PupdBX9GJ6fvOSimzmBDbukhgjBbf3XMj1obrT89nKHUP5PJYNj/6RSeE7X9jjl6Q2IVH9J5WOt044kSDPliyP9iw09E/70RWxE/KJ4fBZEO/oe1diy3if580rdAG/po3txgs7x0NwC9cHR8V6KehdoJRjzq0a1mgabrn6bbVtfWHzIiKIX47eyjmyPqYMrBG3mXu1SnvbLlyVjG2u67eK+zO07ii5BMF8CzLtuGcMiqusY4HKWVQMYRQRk+A/pTEWWTyAcuwhBfhdF6bVttIQiTia4Uo6qJ2ddwqm5k0Gk46KzfMYcQFn0SAJYfO3s41F0PxfdQ4qEQN+1gb7yw4wZXPCwUYkX+Isc25lslf62R8Aj9NV/rxvFMAFoDNwhLjQZlU2KW1CxfkNpYDaxcLdcXccidHvGrqohPnfDqEEhDDlZIn0xTmM8DcszO3/Pwqz63gX7fBA7zBoRH4ecK3rAFlbeg2vxj+zgtqA/rQ2RUbpmYpI4UiF7xvwKJ7LY5EljPjOiUW7QZ9C158v1jD5sSoWY7AUkfZNX6XUwXq9Cqr7ovA2cxlP7cfZwNb/t3j99KhIEiZVup7PlL8kMJ9tJNqf7iQdM1poq+DpWP+kBjGmwAWk91DMJ8JvSBWePmOf0rJBti
+  template:
+    metadata:
+      name: loki-s3
+      namespace: monitoring
@@ -14,6 +14,11 @@ spec:
        name: authentik
        passwordSecret:
          name: authentik-db
+      - ensure: present
+        login: true
+        name: grafana
+        passwordSecret:
+          name: grafana-db
  postgresql:
    # Each app role may only connect to the database of the same name.
    pg_hba:
@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: grafana
+  namespace: postgres
+spec:
+  cluster:
+    name: postgres
+  databaseReclaimPolicy: retain
+  name: grafana
+  owner: grafana
@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: grafana-db
+  namespace: postgres
+spec:
+  encryptedData:
+    password: AgCVRR7/XrxDHRCzJwfWhC8sPCXuWSMiAQt82cHikAjyDWbTllBVVcZTA5M4U/I1Lz5SVm7rrBNjZuRGYk0q0UXKEJ35HjLAPkAYJ/1/uVy9EdwuzofS0UtzxkcCHwdkgfwHXKRFjCBKP+JoK3bsC2QVJwon9y1FdALv/2lsf+Eed2ncirk3RCyop7R4by9cYvzNt9BU5RYTSO+PtHRF1s2LkmCV+68FQHiVXu7tTw2DfDaTHlflWWIWYNx466+0qZIA0VxZO4wBtzN2q4BxWb/e5pL1Vr3F7HqkAVTAauUoLadc9x8fye2HYfI5MHJSsMhk6OrheqmUaiYZGvWaWHcBTa7HimEAp69sMPv7FSKUME1/g6vh5rQVbX5osmWwKQr68/8Q9CY7uFQfnT7G+C6k0h2dSkbiaczDlOGn2qzrLD1UsKjtaVHxZKzb6FWrbbaCJxiZLm/2Jn0JXZKFpjdk1CYy4xB6ZTNWyqrPkaLqPpMoQV5Zgw44vnhudsTlNWDPYNMdSVJXXsFplxnaxhbzbBjy7JZmO/B3snaxqlZCk57yXW88ZSaNbrRQs1hS+MTNbviy4a6fjcrE5UIBfSFtOle5hPVeLsCOV7h5cdXsZDBYveha2eHC1fnCgK0A7GS65XByJ/wW1J1XDcSz5AIULjLWcLa37W2ftMgYiyOeZsP1vEto3ceKia+vMdY9uyJVmAwN7EiVVGzF0CGbrlTbNRAoMWH/tpKewdkSKLyGHcOp5hWFE+5YxRdSY3maxg+ZskYhJcrWwKK8XIdim+SM
+    username: AgC75g98/7Jys5LOEM2ik0fY+mGxfVisA59k/cJPBdARI1uGApIZ27/BE668Ga0WsDl8aSbybGAZIdEFlPYFs3fGBaJIO3I9ZyOEBH1+KQVto4BkZ+SwqfrUBOw37QFQIbO/Fx3ScONYz9iC5koK857I+G8+ZptRg7ZMRWwFSCynaPu4ju5+3lpPDoaeykvp+wKFt2cPY0r1xcOWGBXbQhTPoCj6UQW1LSClws2pV8I4GIgTW2IvEdx+CT42cTWqZXQO7aCQUxxpgHUXVsB+t6mldQYwn4tEAuPU3IzvCjf7xqGi5XgRGlxfJayUdAOglzSNmaK++YW48YzvWLDSk4/G0oDQzdiHqWldKD4Z3gVnKdhqK07duK7+I2CzusixzoYkjZWATtIC4VWeQKDKNXKwQ513QrHFhjQDYzGQsEdpR5A38Y+S5yNduY+TkivNvx5O24/J/OIR9U1MOqTKsAURl6rAbWGndBlYi2X8/jtFMADo7PO2xZdDSaPlRpM3PvDcD3Iz+7d3LDZUg/L45HJMlp5WmP84ciKL/YfnQgbQWYT4qg+JpvEv5TlDB9aPPt3JDKWJhe6LK1zM59tRsg3YCZNoLp6DdqNnw6TG74ZhaPES/HVLOxt7Efer4vUMPjIOVXZoGmtGlrC5BLN4M7q2ktmj2xUGct68t6NVfPxnhFnHV56QpghLoMZOULLBKaXc+FGHKKst
+  template:
+    metadata:
+      labels:
+        cnpg.io/reload: "true"
+      name: grafana-db
+      namespace: postgres
+    type: kubernetes.io/basic-auth
@@ -4,3 +4,5 @@ resources:
  - cluster.yaml
  - authentik-db-sealedsecret.yaml
  - authentik-database.yaml
+  - grafana-db-sealedsecret.yaml
+  - grafana-database.yaml