27 lines
1.4 KiB
Plaintext
27 lines
1.4 KiB
Plaintext
# =============================================================================
|
|
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize and never
|
|
# auto-encrypted by SOPS). Reference scaffold + OPERATOR HAND-OFF.
|
|
#
|
|
# WHAT THIS IS: the OIDC client SECRET Grafana uses to authenticate to the Keycloak `homelab` realm's
|
|
# `grafana` client (kube-prometheus-stack.yaml -> grafana.envValueFrom.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET).
|
|
# The value MUST equal the `grafana-client-secret` placed in platform/keycloak/keycloak-realm-clients
|
|
# (which the realm import injects into the Keycloak client). Consumed by name only (R-IDP-04).
|
|
#
|
|
# HAND-OFF STEPS (operator):
|
|
# (a) Use the SAME grafana-client-secret generated for keycloak-realm-clients (openssl rand -hex 32).
|
|
# (b) Copy to: platform/monitoring/grafana-oidc-credentials.sops.yaml
|
|
# (c) Fill `client-secret` below; encrypt:
|
|
# sops -e -i platform/monitoring/grafana-oidc-credentials.sops.yaml
|
|
# (d) Add under `resources:` in platform/monitoring/kustomization.yaml:
|
|
# - grafana-oidc-credentials.sops.yaml
|
|
# Grafana runs with local admin login until this lands (secretKeyRef optional:true), then OIDC works.
|
|
# =============================================================================
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: grafana-oidc-credentials
|
|
namespace: monitoring
|
|
type: Opaque
|
|
stringData:
|
|
client-secret: REPLACE-ME
|