Grafana helm & postgres example - Revision history

Busk at 16:01, 3 August 2025

2025-08-03T16:01:12Z

Busk at 23:15, 31 July 2025

2025-07-31T23:15:57Z

Busk at 19:10, 28 July 2025

2025-07-28T19:10:39Z

Busk at 19:09, 28 July 2025

2025-07-28T19:09:34Z

Busk: Created page with "# Simple Example of Grafana with Postgres Backend ## Configs ### Grafana override.values.yaml.envsubst ``` image: repository: grafana/grafana # Overrides the Grafana i..."

2025-07-28T19:02:28Z

Created page with "# Simple Example of Grafana with Postgres Backend ## Configs ### Grafana override.values.yaml.envsubst ``` image: repository: grafana/grafana # Overrides the Grafana i..."

New page

# Simple Example of Grafana with Postgres Backend

## Configs

### Grafana

override.values.yaml.envsubst

```
image:
repository: grafana/grafana
# Overrides the Grafana image tag whose default is the chart appVersion
# tag: 10.3.3
# sha256: f8f7d338b2ecd278599e7f1cfc84a0a7bd4f549312218a54696edb38d709100d
pullPolicy: IfNotPresent

replicas: 1

ingress:
enabled: true
ingressClassName: nginx
annotations: {}
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
labels: {}
path: /

pathType: Prefix

hosts:
- grafana${DOT_ENV_NAME}.example.com
tls:
- secretName: grafana${DASH_ENV_NAME}-example-com
hosts:
- grafana${DOT_ENV_NAME}.example.com

persistence:
type: pvc
enabled: false
# storageClassName: default
accessModes:
- ReadWriteOnce
size: 10Gi
# annotations: {}
finalizers:
- kubernetes.io/pvc-protection
extraPvcLabels: {}
inMemory:
enabled: true
## The maximum usage on memory medium EmptyDir would be
## the minimum value between the SizeLimit specified
## here and the sum of memory limits of all containers in a pod
##
sizeLimit: 900Mi

initChownData:
enabled: true
image:
repository: busybox
tag: "1.31.1"
sha: ""
pullPolicy: IfNotPresent

securityContext:
runAsNonRoot: false
runAsUser: 0

# Administrator credentials when not using an existing secret (see below)
adminUser: admin
adminPassword: ${GF_SECURITY_ADMIN_PASSWORD}

# Use an existing secret for the admin user.
admin:
existingSecret: ""
userKey: admin-user
passwordKey: admin-password
#
# admin:
# existingSecret: "grafana-external-secrets"

grafana.ini:
paths:
data: /var/lib/grafana/
logs: /var/log/grafana
plugins: /var/lib/grafana/plugins
provisioning: /etc/grafana/provisioning
analytics:
check_for_updates: true
log:
mode: console
grafana_net:
url: https://grafana.net
server:
domain: "{{ if (and .Values.ingress.enabled .Values.ingress.hosts) }}{{ .Values.ingress.hosts | first }}{{ else }}''{{ end }}"
auth.ldap:
enabled: true
allow_sign_up: true
config_file: /etc/grafana/ldap.toml
smtp:
enabled: true
user: ""
host: "${SMTP_RELAY_HOST}"
fromAddress: "noreply-grafana@example.com"
fromName: ""
skipVerify: "false"
existingSecret: ""
startTLS_policy: "NoStartTLS"
existingSecretUserKey: user
existingSecretPasswordKey: password
alerting:
enabled: false
unified_alerting:
enabled: true
rule_version_record_limit: "5"
ha_peers: "grafana-headless:9094"
# ha_listen_address: "${POD_IP}:9094" # not needed, defaults to 0.0.0.0:9094
# ha_advertise_address: "${POD_IP}:9094" # not needed, defaults to your listen address
# ha_peers: "{{ .Release.Name }}-headless:9094"

headlessService: true

ldap:
enabled: true
external-secrets
# existingSecret: ""
config: |-
[[servers]]
host = "ldaps.example.com"
bind_dn = "CN=grafana-ldap,OU,OU=service_accounts,DC=example,DC=com"
bind_password = "${SVC_GRAFANA_LDAP_PASSWORD}"
port = 636
use_ssl = true
start_tls = false
ssl_skip_verify = false
# Use if direct connect: bind_dn = "example\\%s"
search_filter = "(sAMAccountName=%s)"
search_base_dns = ["dc=example,dc=com"]
root_ca_cert = "/etc/grafana/certs/ca.crt"

[servers.attributes]
name = "givenName"
surname = "sn"
username = "sAMAccountName"
member_of = "memberOf"
email = "mail"

[[servers.group_mappings]]
group_dn = "CN=grafana_editor_role,OU=roles,DC=Example,DC=com"
org_role = "Editor"

[[servers.group_mappings]]
group_dn = "CN=grafana_admin_role,OU=roles,DC=Example,DC=com"
org_role = "Admin"

[[servers.group_mappings]]
group_dn = "*"
org_role = "Viewer"

## Grafana's SMTP configuration
## NOTE: To enable, grafana.ini must be configured with smtp.enabled
## ref: http://docs.grafana.org/installation/configuration/#smtp
smtp:
# `existingSecret` is a reference to an existing secret containing the smtp configuration
# for Grafana.
existingSecret: ""
userKey: "user"
passwordKey: "password"

envFromSecrets:
- name: grafana-env
optional: false

envFromConfigMaps:
- name: grafana-env
optional: false
extraConfigmapMounts:
- name: certs
mountPath: /etc/grafana/certs/ca.crt
subPath: ca.crt
configMap: certs
readOnly: true
- name: etc-ssl-certs
mountPath: /etc/ssl/certs/ca-certificates.crt
subPath: ca-certificates.crt
configMap: etc-ssl-certs
readOnly: true
```

### Postgres

pg1.yaml
```
instances: 2
imageName: ghcr.io/cloudnative-pg/postgresql:17.5-bookworm
primaryUpdateStrategy: unsupervised # automated rolling update (default)
primaryUpdateMethod: switchover # promote a fully-upgraded replica

postgresql:
parameters:
shared_buffers: 512MB

storage:
size: 10Gi

# bootstrap:
# recovery:
# source: test

# backup:
# retentionPolicy: "30d"
# barmanObjectStore:
# destinationPath: "https://mycnpgsa.blob.core.windows.net/cnpg-backups/grafana/"
# azureCredentials:
# storageAccount:
# name: cnpg-storage-blob-creds
# key: AZURE_STORAGE_ACCOUNT
# storageKey:
# name: cnpg-storage-blob-creds
# key: AZURE_STORAGE_KEY
```

@@ Line 195: / Line 195: @@
 pg1.yaml
 ```
    instances: 2
    imageName: ghcr.io/cloudnative-pg/postgresql:17.5-bookworm
@@ Line 329: / Line 334: @@
 install_cnpg(){
-   # Deprecated way: kubectl_apply "-f https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.21.1/cnpg-1.21.1.yaml"
+   # Deprecated way: kubectl_apply "-f https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.26.1/cnpg-1.26.1.yaml"
    # https://github.com/cloudnative-pg/charts
    if ! helm repo list | grep -q "^cnpg"; then

← Older revision		Revision as of 23:15, 31 July 2025
Line 319:		Line 319:
	helm_upgrade "--install --version 9.2.9 grafana grafana/grafana -f values.yaml"		helm_upgrade "--install --version 9.2.9 grafana grafana/grafana -f values.yaml"

		+	```
		+
		+	## main.sh for CNPG
		+
		+	```
		+	#!/bin/bash
		+	set -eu
		+	. ../includes/main.sh
		+
		+	install_cnpg(){
		+	# Deprecated way: kubectl_apply "-f https://github.com/cloudnative-pg/cloudnative-pg/releases/download/v1.21.1/cnpg-1.21.1.yaml"
		+	# https://github.com/cloudnative-pg/charts
		+	if ! helm repo list \| grep -q "^cnpg"; then
		+	helm repo add cnpg https://cloudnative-pg.github.io/charts
		+	helm upgrade --install cnpg \
		+	--version 0.23.0 \
		+	--namespace cnpg-system \
		+	--create-namespace \
		+	cnpg/cloudnative-pg
		+	fi
		+	}
		+
		+	update_cnpg(){
		+	helm_upgrade '--install cnpg \
		+	--namespace cnpg-system \
		+	--version 0.23.0 \
		+	cnpg/cloudnative-pg'
		+	}
		+
		+	if [ "$ENV_NAME" == "prod" ]; then
		+	echo doing prod in 5; sleep 5
		+	kubectl_apply "--server-side -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.26/releases/cnpg-1.26.1.yaml"
		+	elif [ "$ENV_NAME" == "dev" ]; then
		+	echo doing dev in 5; sleep 5
		+	kubectl_apply "--server-side -f https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.26/releases/cnpg-1.26.1.yaml"
		+	else
		+	echo "Environment is neither production nor development."
		+	fi
	```		```

@@ Line 224: / Line 224: @@
 ```
 ### secrets.yaml.tpl
 ```
 ---
@@ Line 253: / Line 251: @@
 ### configmaps.yaml
 ```
 ---
@@ Line 289: / Line 288: @@
 ### main.sh
 ```
 #!/bin/bash

@@ Line 1: / Line 1: @@
 # Simple Example of Grafana with Postgres Backend
 ## Configs
@@ Line 212: / Line 214: @@
    #   retentionPolicy: "30d"
    #   barmanObjectStore:
-   #     destinationPath: "https://mycnpgsa.blob.core.windows.net/cnpg-backups/grafana/"
+   #     destinationPath: "https://myblobstorageaccount.blob.core.windows.net/grafana/cnpg-backups/"
    #     azureCredentials:
    #       storageAccount:
@@ Line 220: / Line 222: @@
    #         name: cnpg-storage-blob-creds
    #         key: AZURE_STORAGE_KEY
 ```