apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-datasources
data:
  datasources.yaml: |
    apiVersion: 1
    datasources:
      - name: tidb-cluster
        uid: PB0C37C6A9EC17FDC
        type: prometheus
        access: proxy
        url: http://prometheus.monitoring.svc:9090
        isDefault: true
        editable: false
      - name: k8s-cluster
        uid: CP9STARTERK8S
        type: prometheus
        access: proxy
        url: http://prometheus.monitoring.svc:9090
        isDefault: false
        editable: false
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: grafana-dashboard-provider
data:
  dashboards.yaml: |
    apiVersion: 1
    providers:
      - name: cp9-starter-tidb
        orgId: 1
        folder: Starter TiDB
        type: file
        disableDeletion: true
        allowUiUpdates: false
        updateIntervalSeconds: 30
        options:
          path: /var/lib/grafana/dashboards
          foldersFromFilesStructure: false
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: grafana
  labels:
    app.kubernetes.io/name: grafana
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: grafana
  template:
    metadata:
      annotations:
        cp9.tidbcloud.com/dashboard-revision: 89115a1ae6e7cb6d9f522330bd174fab329d8fa8
        cp9.tidbcloud.com/dashboard-bundle-sha256: 642df7473407bebd757c61c6176546abdf0f34e471727d3e3471880df56cc795
      labels:
        app.kubernetes.io/name: grafana
    spec:
      nodeSelector:
        cp9.tidbcloud.com/starter-role: regional-control-plane
      initContainers:
        - name: unpack-dashboards
          image: docker.io/library/busybox:1.37.0@sha256:9532d8c39891ca2ecde4d30d7710e01fb739c87a8b9299685c63704296b16028
          imagePullPolicy: IfNotPresent
          command:
            - sh
            - -ec
            - tar -xzf /bundle/tidb-dashboards.tar.gz -C /var/lib/grafana/dashboards --strip-components=1
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 472
          volumeMounts:
            - name: dashboard-bundle
              mountPath: /bundle
              readOnly: true
            - name: dashboards
              mountPath: /var/lib/grafana/dashboards
      containers:
        - name: grafana
          image: docker.io/grafana/grafana:12.1.0@sha256:6ac590e7cabc2fbe8d7b8fc1ce9c9f0582177b334e0df9c927ebd9670469440f
          imagePullPolicy: IfNotPresent
          env:
            - name: GF_AUTH_ANONYMOUS_ENABLED
              value: "true"
            - name: GF_AUTH_ANONYMOUS_ORG_ROLE
              value: Viewer
            - name: GF_AUTH_DISABLE_LOGIN_FORM
              value: "true"
            - name: GF_SECURITY_DISABLE_INITIAL_ADMIN_CREATION
              value: "true"
            - name: GF_USERS_ALLOW_SIGN_UP
              value: "false"
          ports:
            - name: http
              containerPort: 3000
          readinessProbe:
            httpGet:
              path: /api/health
              port: http
          livenessProbe:
            httpGet:
              path: /api/health
              port: http
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              cpu: "1"
              memory: 1Gi
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: ["ALL"]
            readOnlyRootFilesystem: true
            runAsNonRoot: true
            runAsUser: 472
          volumeMounts:
            - name: datasources
              mountPath: /etc/grafana/provisioning/datasources
              readOnly: true
            - name: dashboard-provider
              mountPath: /etc/grafana/provisioning/dashboards
              readOnly: true
            - name: dashboards
              mountPath: /var/lib/grafana/dashboards
              readOnly: true
            - name: data
              mountPath: /var/lib/grafana
            - name: tmp
              mountPath: /tmp
      securityContext:
        fsGroup: 472
        runAsNonRoot: true
        runAsUser: 472
        seccompProfile:
          type: RuntimeDefault
      volumes:
        - name: datasources
          configMap:
            name: grafana-datasources
        - name: dashboard-provider
          configMap:
            name: grafana-dashboard-provider
        - name: dashboard-bundle
          configMap:
            name: grafana-dashboard-bundle
        - name: dashboards
          emptyDir: {}
        - name: data
          emptyDir: {}
        - name: tmp
          emptyDir: {}
---
apiVersion: v1
kind: Service
metadata:
  name: grafana
  labels:
    app.kubernetes.io/name: grafana
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: grafana
  ports:
    - name: http
      port: 3000
      targetPort: http