apiVersion: v1
kind: ConfigMap
metadata:
  name: blueprint-grafana
  namespace: authentik
data:
  grafana.yaml: |
    version: 1
    metadata:
      name: Grafana
    entries:
      - model: authentik_providers_oauth2.oauth2provider
        id: grafana-provider
        identifiers:
          name: grafana
        attrs:
          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
          client_id: grafana
          client_secret: !Env GRAFANA_CLIENT_SECRET
          grant_types:
            - authorization_code
            - refresh_token
          redirect_uris:
            - matching_mode: strict
              url: https://grafana.whyredfire.dev/login/generic_oauth
          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
          property_mappings:
            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-email]]
            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
      - model: authentik_core.application
        identifiers:
          slug: grafana
        attrs:
          name: Grafana
          provider: !KeyOf grafana-provider
          meta_launch_url: https://grafana.whyredfire.dev