From bc0982c213c9b069725ea326b375c364a8d111d8 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Mon, 24 Aug 2026 22:57:00 -0500 Subject: [PATCH] fix(grafana): roll Grafana to load the OIDC client-secret (R-IDP-01) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Grafana's pod predated the grafana-oidc-credentials secret, so generic_oauth started with an empty client_secret (disabled) → /login/generic_oauth didn't redirect to Keycloak. Add a podAnnotation to force one roll; bump on future OIDC secret changes. --- platform/monitoring/kube-prometheus-stack.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/platform/monitoring/kube-prometheus-stack.yaml b/platform/monitoring/kube-prometheus-stack.yaml index 9ae402c..ec660b5 100644 --- a/platform/monitoring/kube-prometheus-stack.yaml +++ b/platform/monitoring/kube-prometheus-stack.yaml @@ -126,6 +126,11 @@ spec: # --- Grafana: dashboards (R-OBS-03), surfaced in the C2 UI (docs/12) behind Keycloak SSO --- grafana: enabled: true + # Force a pod roll when the OIDC wiring changes so Grafana loads the grafana-oidc-credentials + # client-secret (env valueFrom is resolved at pod start; the secret was added after first boot, so + # generic_oauth started disabled). Bump this value to re-roll Grafana on future OIDC secret changes. + podAnnotations: + homelab.keithjackson.dev/oidc-rollout: "1" # Admin bootstrap + (later) OIDC client are SOPS secrets referenced BY NAME (WS-SEC/ADR-0014). admin: existingSecret: grafana-admin-credentials