# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
#
# WHAT THIS IS: the OIDC client SECRET Grafana uses to authenticate to the Keycloak `homelab` realm's
# `grafana` client (kube-prometheus-stack.yaml -> grafana.envValueFrom.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET).
# The value MUST equal the `grafana-client-secret` placed in platform/keycloak/keycloak-realm-clients
# (which the realm import injects into the Keycloak client). Consumed by name only (R-IDP-04).
#
# HAND-OFF STEPS (operator):
#  (a) Use the SAME grafana-client-secret generated for keycloak-realm-clients (openssl rand -hex 32).
#  (b) Copy to:      platform/monitoring/grafana-oidc-credentials.sops.yaml
#  (c) Fill `client-secret` below; encrypt:
#         sops -e -i platform/monitoring/grafana-oidc-credentials.sops.yaml
#  (d) Add under `resources:` in platform/monitoring/kustomization.yaml:
#         - grafana-oidc-credentials.sops.yaml
#  Grafana runs with local admin login until this lands (secretKeyRef optional:true), then OIDC works.
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: grafana-oidc-credentials
  namespace: monitoring
type: Opaque
stringData:
  client-secret: REPLACE-ME