Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(grafana): roll Grafana to load the OIDC client-secret (R-IDP-01)

Browse Source 
Grafana's pod predated the grafana-oidc-credentials secret, so generic_oauth started with
an empty client_secret (disabled) → /login/generic_oauth didn't redirect to Keycloak.
Add a podAnnotation to force one roll; bump on future OIDC secret changes.
This commit is contained in:
jakman85 committed 2026-08-24 22:57:00 -05:00
1 parent e78025e54a
commit bc0982c213
1 file changed
+5
Download Patch File Download Diff File Expand all files Collapse all files
platform/monitoring/kube-prometheus-stack.yaml
+5
View File
@@ -126,6 +126,11 @@ spec:
# --- Grafana: dashboards (R-OBS-03), surfaced in the C2 UI (docs/12) behind Keycloak SSO --- # --- Grafana: dashboards (R-OBS-03), surfaced in the C2 UI (docs/12) behind Keycloak SSO ---
grafana: grafana:
enabled: true enabled: true
# Force a pod roll when the OIDC wiring changes so Grafana loads the grafana-oidc-credentials
# client-secret (env valueFrom is resolved at pod start; the secret was added after first boot, so
# generic_oauth started disabled). Bump this value to re-roll Grafana on future OIDC secret changes.
podAnnotations:
homelab.keithjackson.dev/oidc-rollout: "1"
# Admin bootstrap + (later) OIDC client are SOPS secrets referenced BY NAME (WS-SEC/ADR-0014). # Admin bootstrap + (later) OIDC client are SOPS secrets referenced BY NAME (WS-SEC/ADR-0014).
admin: admin:
existingSecret: grafana-admin-credentials existingSecret: grafana-admin-credentials