titan-iac/services/monitoring/grafana-user-dedupe-job.yaml

# services/monitoring/grafana-user-dedupe-job.yaml
apiVersion: batch/v1
kind: Job
metadata:
  name: grafana-user-dedupe-api-v3
  namespace: monitoring
  annotations:
    vault.hashicorp.com/agent-inject: "true"
    vault.hashicorp.com/role: "monitoring"
    vault.hashicorp.com/agent-inject-secret-grafana-env.sh: "kv/data/atlas/monitoring/grafana-admin"
    vault.hashicorp.com/agent-inject-template-grafana-env.sh: |
      {{ with secret "kv/data/atlas/monitoring/grafana-admin" }}
      export GRAFANA_USER="{{ index .Data.data "admin-user" }}"
      export GRAFANA_PASSWORD="{{ index .Data.data "admin-password" }}"
      {{ end }}
spec:
  backoffLimit: 1
  template:
    spec:
      serviceAccountName: monitoring-vault-sync
      automountServiceAccountToken: true
      restartPolicy: Never
      containers:
        - name: dedupe
          image: python:3.12-slim
          command:
            - /bin/sh
            - -c
          args:
            - |
              set -euo pipefail
              . /vault/secrets/grafana-env.sh
              grafana_url="${GRAFANA_URL}"
              if [ -z "${grafana_url}" ]; then
                echo "GRAFANA_URL is required"
                exit 1
              fi
              if [ -z "${GRAFANA_USER}" ] || [ -z "${GRAFANA_PASSWORD}" ]; then
                echo "Grafana admin credentials missing"
                exit 1
              fi
              if [ -z "${GRAFANA_DEDUPE_EMAILS}" ]; then
                echo "GRAFANA_DEDUPE_EMAILS is required"
                exit 1
              fi
              python - <<'PY'
              import base64
              import json
              import os
              import urllib.parse
              import urllib.request

              grafana_url = os.environ["GRAFANA_URL"].rstrip("/")
              user = os.environ["GRAFANA_USER"]
              password = os.environ["GRAFANA_PASSWORD"]
              emails = [e.strip() for e in os.environ["GRAFANA_DEDUPE_EMAILS"].split(",") if e.strip()]

              token = base64.b64encode(f"{user}:{password}".encode("utf-8")).decode("utf-8")
              headers = {"Authorization": f"Basic {token}"}

              def request(method: str, url: str):
                  req = urllib.request.Request(url, headers=headers, method=method)
                  with urllib.request.urlopen(req, timeout=10) as resp:
                      return resp.read()

              for email in emails:
                  lookup_url = f"{grafana_url}/api/users/lookup?loginOrEmail={urllib.parse.quote(email)}"
                  try:
                      payload = json.loads(request("GET", lookup_url))
                  except Exception:
                      print(f"no grafana user found for {email}")
                      continue
                  user_id = payload.get("id")
                  if not user_id:
                      print(f"no grafana user found for {email}")
                      continue
                  print(f"deleting grafana user {user_id} ({email})")
                  delete_url = f"{grafana_url}/api/admin/users/{user_id}"
                  request("DELETE", delete_url)
              PY
              echo "done"
          env:
            - name: GRAFANA_URL
              value: http://grafana
            - name: GRAFANA_DEDUPE_EMAILS
              value: brad.stein@gmail.com,brad@bstein.dev