apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: grafana-credential-rotation
spec:
  mutateExistingOnPolicyUpdate: false
  rules:
    - name: patch-grafana-cr-revision
      match:
        any:
          - resources:
              kinds:
                - Secret
              names:
                - grafana-db
                - grafana-oidc-zitadel
              namespaces:
                - grafana
              operations:
                - UPDATE
      preconditions:
        all:
          - key: "{{ request.object.data }}"
            operator: NotEquals
            value: "{{ request.oldObject.data }}"
      mutate:
        targets:
          - apiVersion: grafana.integreatly.org/v1beta1
            kind: Grafana
            name: grafana
            namespace: grafana
        patchStrategicMerge:
          spec:
            deployment:
              spec:
                template:
                  metadata:
                    annotations:
                      # Admission UPDATE objects still carry the pre-commit resourceVersion.
                      credentials.quorate.internal/revision: "{{ request.uid }}"