[ci skip] Remove Authentik forward auth from Grafana, add admin password management

Fixes HA mobile app 403 when embedding Grafana dashboards - the webview
blocks third-party cookies needed by Authentik forward auth. Grafana
already has anonymous Viewer access enabled, so forward auth is not
needed. Also adds grafana_admin_password variable and explicit resource
limits to prevent ResourceQuota issues during rolling updates.

modules/kubernetes/monitoring/grafana.tf

@@ -60,9 +60,10 @@ resource "helm_release" "grafana" {
   create_namespace = true
   name             = "grafana"
   atomic           = true
+  timeout          = 600
 
   repository = "https://grafana.github.io/helm-charts"
   chart      = "grafana"
 
-  values = [templatefile("${path.module}/grafana_chart_values.yaml", { db_password = var.grafana_db_password })]
+  values = [templatefile("${path.module}/grafana_chart_values.yaml", { db_password = var.grafana_db_password, grafana_admin_password = var.grafana_admin_password })]
 }

modules/kubernetes/monitoring/grafana_chart_values.yaml

@@ -1,6 +1,14 @@
 deploymentStrategy:
   type: RollingUpdate
 replicas: 3
+adminPassword: "${grafana_admin_password}"
+resources:
+  requests:
+    cpu: 50m
+    memory: 128Mi
+  limits:
+    cpu: 500m
+    memory: 512Mi
 persistence:
   enabled: false # using external mysql
   existingClaim: "grafana-pvc"
@@ -8,7 +16,7 @@ ingress:
   enabled: "true"
   ingressClassName: "traefik"
   annotations:
-    traefik.ingress.kubernetes.io/router.middlewares: "traefik-rate-limit@kubernetescrd,traefik-csp-headers@kubernetescrd,traefik-crowdsec@kubernetescrd,traefik-authentik-forward-auth@kubernetescrd"
+    traefik.ingress.kubernetes.io/router.middlewares: "traefik-rate-limit@kubernetescrd,traefik-csp-headers@kubernetescrd,traefik-crowdsec@kubernetescrd"
     traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
   tls:
     - secretName: "tls-secret"

modules/kubernetes/monitoring/main.tf

@@ -14,6 +14,7 @@ variable "tiny_tuya_service_secret" { type = string }
 variable "haos_api_token" { type = string }
 variable "pve_password" { type = string }
 variable "grafana_db_password" { type = string }
+variable "grafana_admin_password" { type = string }
 variable "tier" { type = string }
 
 resource "kubernetes_namespace" "monitoring" {