40 lines
1.1 KiB
YAML
40 lines
1.1 KiB
YAML
apiVersion: kyverno.io/v1
|
|
kind: ClusterPolicy
|
|
metadata:
|
|
name: grafana-credential-rotation
|
|
spec:
|
|
mutateExistingOnPolicyUpdate: false
|
|
rules:
|
|
- name: patch-grafana-cr-revision
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Secret
|
|
names:
|
|
- grafana-db
|
|
- grafana-oidc-zitadel
|
|
namespaces:
|
|
- grafana
|
|
operations:
|
|
- UPDATE
|
|
preconditions:
|
|
all:
|
|
- key: "{{ request.object.data }}"
|
|
operator: NotEquals
|
|
value: "{{ request.oldObject.data }}"
|
|
mutate:
|
|
targets:
|
|
- apiVersion: grafana.integreatly.org/v1beta1
|
|
kind: Grafana
|
|
name: grafana
|
|
namespace: grafana
|
|
patchStrategicMerge:
|
|
spec:
|
|
deployment:
|
|
spec:
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
# Admission UPDATE objects still carry the pre-commit resourceVersion.
|
|
credentials.quorate.internal/revision: "{{ request.uid }}"
|