ce7cb702218693d08ea6d83464d2457c9250027c

vendor/workloads/grafana/credential-rotation/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - policy.yaml
+  - rbac.yaml

vendor/workloads/grafana/credential-rotation/policy.yaml

@@ -0,0 +1,40 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: grafana-credential-rotation
+spec:
+  mutateExistingOnPolicyUpdate: false
+  rules:
+    - name: patch-grafana-cr-revision
+      match:
+        any:
+          - resources:
+              kinds:
+                - Secret
+              names:
+                - grafana-db
+                - grafana-oidc-zitadel
+              namespaces:
+                - grafana
+              operations:
+                - UPDATE
+      preconditions:
+        all:
+          - key: "{{ request.object.data }}"
+            operator: NotEquals
+            value: "{{ request.oldObject.data }}"
+      mutate:
+        targets:
+          - apiVersion: grafana.integreatly.org/v1beta1
+            kind: Grafana
+            name: grafana
+            namespace: grafana
+        patchStrategicMerge:
+          spec:
+            deployment:
+              spec:
+                template:
+                  metadata:
+                    annotations:
+                      # Admission UPDATE objects still carry the pre-commit resourceVersion.
+                      credentials.quorate.internal/revision: "{{ request.uid }}"

vendor/workloads/grafana/credential-rotation/rbac.yaml

@@ -0,0 +1,36 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kyverno:grafana-mutator
+rules:
+  - apiGroups:
+      - grafana.integreatly.org
+    resources:
+      - grafanas
+    verbs:
+      - get
+      - list
+      - watch
+      - update
+      - patch
+  - apiGroups:
+      - ""
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kyverno:grafana-mutator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kyverno:grafana-mutator
+subjects:
+  - kind: ServiceAccount
+    name: kyverno-background-controller
+    namespace: kyverno