WIP keycloak stack (gate probe)

platform/monitoring/grafana-oidc-credentials.sops.yaml.example

@@ -0,0 +1,26 @@
+# =============================================================================
+# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
+# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
+#
+# WHAT THIS IS: the OIDC client SECRET Grafana uses to authenticate to the Keycloak `homelab` realm's
+# `grafana` client (kube-prometheus-stack.yaml -> grafana.envValueFrom.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET).
+# The value MUST equal the `grafana-client-secret` placed in platform/keycloak/keycloak-realm-clients
+# (which the realm import injects into the Keycloak client). Consumed by name only (R-IDP-04).
+#
+# HAND-OFF STEPS (operator):
+#  (a) Use the SAME grafana-client-secret generated for keycloak-realm-clients (openssl rand -hex 32).
+#  (b) Copy to:      platform/monitoring/grafana-oidc-credentials.sops.yaml
+#  (c) Fill `client-secret` below; encrypt:
+#         sops -e -i platform/monitoring/grafana-oidc-credentials.sops.yaml
+#  (d) Add under `resources:` in platform/monitoring/kustomization.yaml:
+#         - grafana-oidc-credentials.sops.yaml
+#  Grafana runs with local admin login until this lands (secretKeyRef optional:true), then OIDC works.
+# =============================================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: grafana-oidc-credentials
+  namespace: monitoring
+type: Opaque
+stringData:
+  client-secret: REPLACE-ME