ce7cb702218693d08ea6d83464d2457c9250027c

vendor/workloads/grafana/credential-rotation/policy.yaml

@@ -0,0 +1,40 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: grafana-credential-rotation
+spec:
+  mutateExistingOnPolicyUpdate: false
+  rules:
+    - name: patch-grafana-cr-revision
+      match:
+        any:
+          - resources:
+              kinds:
+                - Secret
+              names:
+                - grafana-db
+                - grafana-oidc-zitadel
+              namespaces:
+                - grafana
+              operations:
+                - UPDATE
+      preconditions:
+        all:
+          - key: "{{ request.object.data }}"
+            operator: NotEquals
+            value: "{{ request.oldObject.data }}"
+      mutate:
+        targets:
+          - apiVersion: grafana.integreatly.org/v1beta1
+            kind: Grafana
+            name: grafana
+            namespace: grafana
+        patchStrategicMerge:
+          spec:
+            deployment:
+              spec:
+                template:
+                  metadata:
+                    annotations:
+                      # Admission UPDATE objects still carry the pre-commit resourceVersion.
+                      credentials.quorate.internal/revision: "{{ request.uid }}"