feat(monitoring): add Azure Monitor datasource for shared Postgres

k8s/argocd/infra-apps/monitoring.yaml

@@ -14,12 +14,12 @@ spec:
     name: in-cluster
     namespace: monitoring
 
-  source:
-    repoURL: https://github.com/Scouterna/j26-infra.git
-    targetRevision: main
-    path: k8s/infra-manifest/monitoring
-
   sources:
+    - repoURL: https://github.com/Scouterna/j26-infra.git
+      targetRevision: main
+      path: k8s/infra-manifest/monitoring
+      directory:
+        include: "{secret-provider-class.yaml}"
     - repoURL: ghcr.io/prometheus-community/charts
       chart: kube-prometheus-stack
       targetRevision: "80.2.2"

k8s/infra-manifest/monitoring/helm-values.yaml

@@ -34,6 +34,30 @@ grafana:
       url: http://loki:3100
       jsonData:
         maxLines: 1000
+    - name: Azure Monitor
+      type: grafana-azure-monitor-datasource
+      access: proxy
+      editable: false
+      jsonData:
+        azureAuthType: clientsecret
+        cloudName: azuremonitor
+        tenantId: "317a47ba-fd32-41b8-8ebe-310a1adc9863"
+        clientId: "f7ce7fad-4d2e-465a-8fed-6a09605dbcb3"
+        subscriptionId: "97410996-3a4a-464b-8ba2-41b5dcda2d75"
+      secureJsonData:
+        clientSecret: "$__env{AZURE_CLIENT_SECRET}"
+
+  envFromSecret: grafana-azure-monitor-secrets
+
+  extraSecretMounts:
+    - name: grafana-azure-monitor-kv-csi
+      mountPath: /mnt/secrets-store
+      readOnly: true
+      csi:
+        driver: secrets-store.csi.k8s.io
+        readOnly: true
+        volumeAttributes:
+          secretProviderClass: grafana-azure-monitor-kv-csi
 
 prometheus:
   prometheusSpec:

k8s/infra-manifest/monitoring/secret-provider-class.yaml

@@ -0,0 +1,24 @@
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: grafana-azure-monitor-kv-csi
+  namespace: monitoring
+spec:
+  provider: azure
+  secretObjects:
+  - secretName: grafana-azure-monitor-secrets
+    type: Opaque
+    data:
+    - key: AZURE_CLIENT_SECRET
+      objectName: grafana-azure-monitor-azure-client-secret
+  parameters:
+    usePodIdentity: "false"
+    useVMManagedIdentity: "true"
+    userAssignedIdentityID: 214abfc2-fa80-44b9-89c5-f78444a16816
+    keyvaultName: kv-j26apps-shared-sdc
+    tenantId: 317a47ba-fd32-41b8-8ebe-310a1adc9863
+    objects: |
+      array:
+        - |
+          objectName: grafana-azure-monitor-azure-client-secret
+          objectType: secret