WIP keycloak stack (gate probe)

platform/monitoring/kube-prometheus-stack.yaml

@@ -150,8 +150,36 @@ spec:
           memory: 128Mi
         limits:
           memory: 256Mi
-      # TODO(WS-SEC/WS-C2, later): Keycloak OIDC client (auth.generic_oauth) + root_url behind the
-      #   Gateway; disable local login once SSO is proven. Secret referenced by name only.
+      # --- Keycloak native-OIDC SSO (ADR-0014, deliverable #4 SSO proof) ---
+      # Grafana is a confidential OIDC client of the Keycloak `homelab` realm. The client SECRET comes
+      # from the SOPS-encrypted grafana-oidc-credentials Secret via env (referenced by name only,
+      # R-IDP-04). optional:true so the RUNNING Grafana keeps starting before the operator fills the
+      # secret — local admin login (below) stays available as the fallback until SSO is proven.
+      envValueFrom:
+        GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET:
+          secretKeyRef:
+            name: grafana-oidc-credentials
+            key: client-secret
+            optional: true
+      grafana.ini:
+        server:
+          root_url: https://grafana.home.keithjackson.dev
+        auth.generic_oauth:
+          enabled: true
+          name: Keycloak
+          client_id: grafana
+          scopes: "openid email profile"
+          auth_url: https://keycloak.home.keithjackson.dev/realms/homelab/protocol/openid-connect/auth
+          token_url: https://keycloak.home.keithjackson.dev/realms/homelab/protocol/openid-connect/token
+          api_url: https://keycloak.home.keithjackson.dev/realms/homelab/protocol/openid-connect/userinfo
+          login_attribute_path: preferred_username
+          email_attribute_path: email
+          # Map Keycloak groups (the `groups` claim) to Grafana roles (R-IDP-06): platform-admins ->
+          # Admin, media-users -> Editor, everyone else -> Viewer.
+          role_attribute_path: "contains(groups[*], 'platform-admins') && 'Admin' || contains(groups[*], 'media-users') && 'Editor' || 'Viewer'"
+          # Keep local admin login enabled as break-glass until SSO is proven end-to-end; flip to
+          # disable_login_form:true afterwards (docs/15 break-glass, R-IDP-05).
+        # TODO(WS-SEC, post-proof): set auth.disable_login_form=true once SSO login is verified.
 
     # --- Bundled exporters / operator: keep small ---
     prometheusOperator: