# Database "grafana": generated credentials, role, database and read access for
# the monitoring namespace.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: grafana-db
  namespace: psql
spec:
  refreshPolicy: CreatedOnce
  target:
    name: grafana-db
    template:
      type: kubernetes.io/basic-auth
      metadata:
        labels:
          cnpg.io/reload: "true"
      data:
        username: grafana
        password: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: db-password
---
apiVersion: postgresql.cnpg.io/v1
kind: DatabaseRole
metadata:
  name: main-grafana
  namespace: psql
spec:
  cluster:
    name: main
  name: grafana
  login: true
  passwordSecret:
    name: grafana-db
---
apiVersion: postgresql.cnpg.io/v1
kind: Database
metadata:
  name: main-grafana
  namespace: psql
spec:
  cluster:
    name: main
  name: grafana
  owner: grafana
  databaseReclaimPolicy: retain
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: grafana-db-reader
  namespace: psql
rules:
  - apiGroups: [""]
    resources: [secrets]
    resourceNames: [grafana-db]
    verbs: [get, list, watch]
  - apiGroups: [authorization.k8s.io]
    resources: [selfsubjectrulesreviews]
    verbs: [create]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: grafana-db-reader
  namespace: psql
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: grafana-db-reader
subjects:
  - kind: ServiceAccount
    name: db-credentials-reader
    namespace: prometheus