Configure Grafana with Keycloak
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 7
- Forks
- 2
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 3
Description
The Grafana helm charty proxy currently assumes the workload is using Traefik Forward Auth and applies a TFA annotation to its ingress: https://github.com/rstudio/ptd/blob/e776e44b3f7ffeb6233f3d4ac42f4757c353cdff/ptd/src/ptd/pulumi_resources/aws_control_room_capi_hcp.py#L744
We should update this logic to work with Keycloak so that Keycloak workloads with no TFA are able to serve the Grafana page to users.
See: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/keycloak/
Out of scope for this issue, we should have all sites defaulting to Keycloak and get rid of TFA as this was an early pass to enable easy Okta auth for Posit folks. Depending on when that happens, this Grafana helm chart proxy should either be smart enough to configure TFA or Keycloak, or just assume Keycloak (see: https://github.com/rstudio/ptd/issues/1601)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in ptd/src/ptd/pulumi_resources/aws_control_room_capi_hcp.py around line 744 and review the Grafana Helm chart proxy ingress configuration. Read Grafana's Keycloak authentication documentation, then verify that a Keycloak workload without Traefik Forward Auth can serve the Grafana page; the existing TFA behavior is explicitly out of scope unless the configuration must support both modes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- grafana, helm, kubernetes, python
- Domain
- authentication, devops, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100