feat: adjustments to Grafana team permissions (#1563)

Co-authored-by: Jehoszafat Zimnowoda <[email protected]>

Author: merll

Diff for: helmfile.d/helmfile-60.teams.yaml

@@ -108,6 +108,8 @@ releases:
           nameOverride: {{ $teamId }}-po-grafana
           fullnameOverride: {{ $teamId }}-po-grafana
           grafana.ini:
+            "auth.generic_oauth":
+              role_attribute_path: contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'team-admin') && 'Admin' || contains(groups[*], 'team-{{ $teamId }}') && 'Editor'{{ if not ($team | get "managedMonitoring.private" false) }} || 'Viewer'{{- end }}
             server:
               root_url: https://grafana-{{ $teamId }}.{{ $domain }}
           sidecar:

Diff for: helmfile.d/snippets/grafana.gotmpl

@@ -11,11 +11,12 @@
   auth_url: {{ printf "%s/protocol/openid-connect/auth" .keycloakBase }}
   token_url: {{ printf "%s/protocol/openid-connect/token" .keycloakBase }}
   api_url: {{ printf "%s/protocol/openid-connect/userinfo" .keycloakBase }}
-  role_attribute_path: contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'team-admin') && 'Admin' || 'Editor'
+  role_attribute_path: contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'team-admin') && 'Admin'
+  role_attribute_strict: true
 log:
   level: error
 users:
-  allow_sign_up: true
+  allow_sign_up: false
   auto_assign_org: true
   # fall back to admin for anonymous when no auth is available
   auto_assign_org_role: Viewer

Diff for: values-changes.yaml

@@ -125,6 +125,7 @@ changes:
   - version: 20
     networkPoliciesMigration: true
     additions:
+      - 'teamConfig.{team}.managedMonitoring.private': true
       - 'apps.loki.storage.gcs.serviceAccount'
     deletions:
       - 'apps.loki.storage.gcs.project'

Diff for: values-schema.yaml

@@ -1246,6 +1246,9 @@ definitions:
           alertmanager:
             type: boolean
             default: false
+          private:
+            type: boolean
+            default: false
       networkPolicy:
         ingressPrivate:
           title: Enable filtering of ingress traffic inside the cluster