apps sc: add templating and default restricted csp for grafana

Author: anders-elastisys

config/sc-config.yaml

@@ -162,6 +162,17 @@ grafana:
     additionalConfigValues: ""
     dataproxy:
       timeout: 600
+    contentSecurityPolicy:
+      default-src: "'self'"
+      script-src: "'self' 'unsafe-inline' 'strict-dynamic' $${q}NONCE https:"
+      object-src: "'none'"
+      style-src: "'self' 'unsafe-inline' blob:"
+      img-src: "* data:"
+      base-uri: "'self'"
+      connect-src: "'self' grafana.com ws://$${q}ROOT_PATH wss://$${q}ROOT_PATH"
+      media-src: "'none'"
+      form-action: "'self'"
+      require-trusted-types-for: "'script'"
   user:
     enabled: true
     # subdomain moved to common-config

config/schemas/config.yaml

@@ -4474,6 +4474,19 @@ properties:
           additionalDatasources:
             title: Grafana Additional Datasources
             type: object
+          contentSecurityPolicy:
+            $ref: '#/$defs/contentSecurityPolicy'
+            default:
+              default-src: "'self'"
+              script-src: "'self' 'unsafe-inline' 'strict-dynamic' $${q}NONCE https:"
+              object-src: "'none'"
+              style-src: "'self' 'unsafe-inline' blob:"
+              img-src: "* data:"
+              base-uri: "'self'"
+              connect-src: "'self' grafana.com ws://$${q}ROOT_PATH wss://$${q}ROOT_PATH"
+              media-src: "'none'"
+              form-action: "'self'"
+              require-trusted-types-for: "'script'"
           dataproxy:
             title: Grafana dataproxy values
             description: Configure Grafana dataproxy values

helmfile.d/values/grafana/grafana-ops.yaml.gotmpl

@@ -132,6 +132,16 @@ grafana.ini:
     viewers_can_edit: {{ .Values.grafana.ops.viewersCanEdit }}
   dataproxy:
     timeout: {{ .Values.grafana.ops.dataproxy.timeout }}
+  {{- with .Values.grafana.ops.contentSecurityPolicy }}
+  security:
+    content_security_policy: true
+    {{- $grafanaCSP := list }}
+    {{- range $cspKey, $cspValue := . }}
+    {{- $grafanaCSP = append $grafanaCSP (printf "%s %s" $cspKey $cspValue)  }}
+    {{- end }}
+    content_security_policy_template: |-
+      """{{ $grafanaCSP | join ";" }}"""
+  {{- end }}
   {{- if .Values.grafana.ops.additionalConfigValues }}
   {{ .Values.grafana.ops.additionalConfigValues | nindent 2 }}
   {{- end }}

helmfile.d/values/grafana/grafana-user.yaml.gotmpl

@@ -130,6 +130,16 @@ grafana.ini:
     default_home_dashboard_path: /tmp/dashboards/welcome-dashboard.json
   dataproxy:
     timeout: {{ .Values.grafana.user.dataproxy.timeout }}
+  {{- with .Values.grafana.user.contentSecurityPolicy }}
+  security:
+    content_security_policy: true
+    {{- $grafanaCSP := list }}
+    {{- range $cspKey, $cspValue := . }}
+    {{- $grafanaCSP = append $grafanaCSP (printf "%s %s" $cspKey $cspValue)  }}
+    {{- end }}
+    content_security_policy_template: |-
+      """{{ $grafanaCSP | join ";" }}"""
+  {{- end }}
   {{- if .Values.grafana.user.additionalConfigValues }}
   {{ .Values.grafana.user.additionalConfigValues | nindent 2 }}
   {{- end }}