feat(chart)!: ship dashboard as GrafanaDashboard CRD, not ConfigMap

The dashboard ConfigMap pattern only works when the Grafana sidecar is
watching for labeled ConfigMaps. Setups running grafana-operator
consume dashboards through the GrafanaDashboard CRD
(grafana.integreatly.org/v1beta1), and the sidecar ConfigMap is just
dead weight there. Switch the chart to render a GrafanaDashboard
directly.

Values surface:
- grafanaDashboard.instanceSelector.matchLabels — required, picks the
  target Grafana CR (default {dashboards: grafana}).
- grafanaDashboard.allowCrossNamespaceImport — default true.
- grafanaDashboard.folder, grafanaDashboard.resyncPeriod — optional.
- grafanaDashboard.label removed (was sidecar-only).

Bumps chart 1.8.2 -> 1.9.0 (breaking values change).

Author: ynsta

CHANGELOG.md

@@ -14,6 +14,16 @@ Two version streams move independently:
 
 ## [Unreleased]
 
+### Chart
+
+- **`chart/1.9.0`** — Replace the bundled Grafana dashboard `ConfigMap`
+  with a `GrafanaDashboard` CRD (`grafana.integreatly.org/v1beta1`)
+  reconciled by grafana-operator. New `grafanaDashboard.instanceSelector`,
+  `allowCrossNamespaceImport`, `folder`, `resyncPeriod` knobs; removed
+  the sidecar-only `grafanaDashboard.label`. **Breaking** for installs
+  that relied on the dashboard sidecar — switch to grafana-operator or
+  pin the chart to `1.8.x`.
+
 ## [1.8.1] — 2026-05-20
 
 Patch release. Fixes B2 (and other non-AWS S3-compatible backends)

README.md

@@ -46,7 +46,7 @@ The project is a hardened fork of the original [edgelesssys/constellation](https
 - **S3-compatible** — works with any backend that speaks S3 v4 (AWS, Scaleway, MinIO, Wasabi, Ceph, …).
 - **Secure defaults** — multipart uploads blocked, HTTPS upstream, request body capped, optional concurrency throttle.
 - **Production observability** — Prometheus metrics on `/metrics`, four shipped alerts, OTLP/HTTP traces with `slog` log/trace correlation, ready-to-import Grafana dashboard.
-- **Packaged Helm chart** — OCI-published, with opt-in `ServiceMonitor` / `PrometheusRule` / dashboard `ConfigMap`.
+- **Packaged Helm chart** — OCI-published, with opt-in `ServiceMonitor` / `PrometheusRule` / `GrafanaDashboard` CRD.
 
 ---
 
@@ -283,7 +283,7 @@ Top-level value keys:
 | `autoscaling` | disabled | HPA on CPU/memory. |
 | `serviceMonitor` | disabled | Prometheus Operator scrape config. |
 | `prometheusRule` | disabled | Alert bundle. |
-| `grafanaDashboard` | disabled | Dashboard `ConfigMap` (grafana-operator / sidecar). |
+| `grafanaDashboard` | disabled | `GrafanaDashboard` CRD (`grafana.integreatly.org/v1beta1`, grafana-operator). |
 
 A complete observability rollout looks like:
 
@@ -301,6 +301,10 @@ prometheusRule:
     highLatencySeconds: 2
 grafanaDashboard:
   enabled: true
+  folder: s3proxy
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
 config:
   host: s3.fr-par.scw.cloud
   otlpTracesEndpoint: https://otel-collector.observability.svc.cluster.local:4318/v1/traces

charts/s3proxy/Chart.yaml

@@ -18,5 +18,5 @@ maintainers:
 annotations:
   org.opencontainers.image.source: "https://github.com/intrinsec/s3proxy/"
 type: application
-version: 1.8.2
+version: 1.9.0
 appVersion: "1.8.1"

charts/s3proxy/templates/grafana-dashboard.yaml

@@ -1,22 +1,31 @@
 {{- if .Values.grafanaDashboard.enabled }}
-apiVersion: v1
-kind: ConfigMap
+apiVersion: grafana.integreatly.org/v1beta1
+kind: GrafanaDashboard
 metadata:
   name: {{ include "s3proxy.fullname" . }}-dashboard
   {{- with .Values.grafanaDashboard.namespace }}
   namespace: {{ . }}
   {{- end }}
   labels:
     {{- include "s3proxy.labels" . | nindent 4 }}
-    {{ .Values.grafanaDashboard.label | default "grafana_dashboard" }}: "1"
     {{- with .Values.grafanaDashboard.labels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
   {{- with .Values.grafanaDashboard.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
-data:
-  s3proxy.json: |-
+spec:
+  allowCrossNamespaceImport: {{ .Values.grafanaDashboard.allowCrossNamespaceImport }}
+  {{- with .Values.grafanaDashboard.folder }}
+  folder: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.grafanaDashboard.resyncPeriod }}
+  resyncPeriod: {{ . }}
+  {{- end }}
+  instanceSelector:
+    matchLabels:
+      {{- toYaml .Values.grafanaDashboard.instanceSelector.matchLabels | nindent 6 }}
+  json: |-
 {{ .Files.Get "dashboards/s3proxy.json" | indent 4 }}
 {{- end }}

charts/s3proxy/values.schema.json

@@ -194,15 +194,29 @@
     "grafanaDashboard": {
       "type": "object",
       "additionalProperties": true,
-      "description": "Opt-in ConfigMap shipping the bundled Grafana dashboard.",
+      "description": "Opt-in GrafanaDashboard CRD (grafana.integreatly.org/v1beta1) shipping the bundled dashboard. Requires grafana-operator.",
       "properties": {
         "enabled": { "type": "boolean" },
         "namespace": { "type": "string" },
-        "label": { "type": "string", "minLength": 1 },
+        "allowCrossNamespaceImport": { "type": "boolean" },
+        "folder": { "type": "string" },
+        "resyncPeriod": { "type": "string", "pattern": "^([0-9]+(ns|us|µs|ms|s|m|h))+$" },
+        "instanceSelector": {
+          "type": "object",
+          "additionalProperties": true,
+          "properties": {
+            "matchLabels": {
+              "type": "object",
+              "minProperties": 1,
+              "additionalProperties": { "type": "string" }
+            }
+          },
+          "required": ["matchLabels"]
+        },
         "labels": { "type": "object" },
         "annotations": { "type": "object" }
       },
-      "required": ["enabled"]
+      "required": ["enabled", "instanceSelector"]
     },
     "extraVolumes": { "type": "array" },
     "extraVolumeMounts": { "type": "array" },

charts/s3proxy/values.yaml

@@ -168,17 +168,23 @@ prometheusRule:
     serviceDown: 2m
     highCrashRate: 5m
 
-# Grafana dashboard ConfigMap. When enabled the chart ships a ConfigMap
-# carrying the s3proxy dashboard JSON, labeled so the grafana-operator /
-# dashboard sidecar picks it up automatically.
-# Requires either grafana-operator OR the official Grafana chart with the
-# dashboard sidecar enabled (`sidecar.dashboards.enabled=true`).
+# Grafana dashboard CRD. When enabled the chart ships a `GrafanaDashboard`
+# (`grafana.integreatly.org/v1beta1`) carrying the s3proxy dashboard JSON.
+# Requires grafana-operator to be installed in the cluster.
 grafanaDashboard:
   enabled: false
-  # namespace: monitoring                # where the ConfigMap should be created
-  label: grafana_dashboard               # label key the Grafana sidecar watches
-  labels: {}                             # extra labels on the ConfigMap
-  annotations: {}                        # extra annotations on the ConfigMap
+  # namespace: monitoring                # where the GrafanaDashboard is created
+  allowCrossNamespaceImport: true        # let a Grafana in another namespace pick it up
+  # folder: "s3proxy"                    # target folder in Grafana (empty = General)
+  # resyncPeriod: 5m                     # operator reconciliation cadence
+  # instanceSelector.matchLabels picks the target Grafana CR. Default value
+  # matches the `dashboards: grafana` selector used by the upstream
+  # grafana-operator examples. Tune to whatever label your Grafana CR carries.
+  instanceSelector:
+    matchLabels:
+      dashboards: grafana
+  labels: {}                             # extra labels on the GrafanaDashboard
+  annotations: {}                        # extra annotations on the GrafanaDashboard
 
 # Additional volumes on the output Deployment definition.
 extraVolumes: []