From 282d4185acb83af2f250296eb7ffcc14046095cc Mon Sep 17 00:00:00 2001 From: Aleksandr Albekov Date: Mon, 12 Oct 2026 21:07:03 +0200 Subject: [PATCH] Rename Grafana's local admin so SSO sign-in works The local admin was called "admin", the same as the owner's Ory username. Grafana refuses to create an SSO user whose login or email is already taken, and Generic OAuth does not look users up by login, so sign-in ended in "User sync failed" (user.sync: unable to create user: user not found). The local admin is now "local-admin". The pod annotation bulbashenko.com/secret-revision restarts Grafana; it has no PVC, so the database is recreated with the new admin. Refs #74 Co-Authored-By: Claude Opus 5.5 --- infrastructure/configs/monitoring/secret.sops.yaml | 6 +++--- infrastructure/configs/monitoring/stack.yaml | 5 +++++ 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/infrastructure/configs/monitoring/secret.sops.yaml b/infrastructure/configs/monitoring/secret.sops.yaml index 13a7c53..fe64d6b 100644 --- a/infrastructure/configs/monitoring/secret.sops.yaml +++ b/infrastructure/configs/monitoring/secret.sops.yaml @@ -5,7 +5,7 @@ metadata: namespace: monitoring type: Opaque stringData: - admin-user: ENC[AES256_GCM,data:fMJ90lg=,iv:vOqLwxnxaBr5grmjgVfIkHOA76r5ECCmn+dxwxJ8v3Q=,tag:csiDqkONejbpyn+c54WC8g==,type:str] + admin-user: ENC[AES256_GCM,data:DIZEGbpSfxHB8Qs=,iv:JmBr2VvPEgudEK5xXMCZVbo5QKdnHFAStI1mtxxv/mQ=,tag:Vt3IwD1BgJuQq7jPkB+CIQ==,type:str] admin-password: ENC[AES256_GCM,data:029sxX8MPFsDCrkHHCYd2e7vZv6beBmXRTDxhtKKa0M=,iv:SJd8Vz1hrMqzxcZ9/kH9q5xNOtUDqmTLltIaHtYpAYw=,tag:gH7g7ra9E2A7XQNTROmSrw==,type:str] oidc-client-secret: ENC[AES256_GCM,data:vVz8nQRKEdSeVKUvPZjbH3Bgi0TSetfDtoe8LZVNZ2+MN1yIVA2cGjDaLphrODJNozmJOg0Xpux6vUDC5PvKnQ==,iv:ezkCA3ePrCGPhNh9CNCXoageI8X3QIFV5+QXFWvhwOg=,tag:0uP7gekPgeYsvvbiyF6sSA==,type:str] sops: @@ -29,6 +29,6 @@ sops: -----END AGE ENCRYPTED FILE----- recipient: age1c9jlhvq47psz20sl2wu7d2jwstjjylfx769tuumree8hdf5klf2sjluulk encrypted_regex: ^(data|stringData)$ - lastmodified: "2026-10-12T18:41:13Z" - mac: ENC[AES256_GCM,data:s3vubPYyrpMSE3/PgS2K378i8/HEABBfmDQyw87yTeLDC1GFcXmNB2RiOXKgWk2+t11P0KctgmOA8L9V3j+HnkZ1wj9IUy3gFBs51Tdhszq6dNR7AGzidCTm1KHFqCzGj+UFzqfbUTSaa/GREWqsHYuinebp0QP1blZ/GcawaMY=,iv:eI/JTVaQV6OdyFSETuKLbs02vgQBLCOeuD9jwHCnhv8=,tag:CdQ2diMLipsEYTT+opltxA==,type:str] + lastmodified: "2026-10-12T19:06:48Z" + mac: ENC[AES256_GCM,data:DRwrlXi3hw8/j+ZL8CM1svQn+qlvS35k1dPz/7b+Fd395RB+idYGUjrAeScLt+Z4NMKKo2aC2UzsMSdramX/MR49Xd2H+F0IcI28JSYi43Ua9/b55YXQQMunm8F1vFV7x1zhjor/m4sTxVCNt3m7PLQ9YDIgWuxxV1WfxevsaIw=,iv:znRQ+qTSd6Qy11T7caQZOr+4eJMq/32HIgiTWPm0sW4=,tag:rGCfzQD0Hlktk6sBN9lHdw==,type:str] version: 3.13.3 diff --git a/infrastructure/configs/monitoring/stack.yaml b/infrastructure/configs/monitoring/stack.yaml index f613c8e..a2b9cb7 100644 --- a/infrastructure/configs/monitoring/stack.yaml +++ b/infrastructure/configs/monitoring/stack.yaml @@ -132,10 +132,15 @@ spec: limits: { memory: 384Mi } # Local admin: used by the dashboard/datasource sidecars (basic auth against the reload API) and as break-glass # sign-in at /login?disableAutoLogin if Ory is down; the login form is hidden otherwise. + # Its login must not match any Ory username: Grafana refuses to create an SSO user whose login or email is + # taken ("User sync failed"), and it does not link accounts by login. admin: existingSecret: grafana userKey: admin-user passwordKey: admin-password + # Bump when the Secret grafana changes: the pod restarts and, with no PVC, recreates its database. + podAnnotations: + bulbashenko.com/secret-revision: "2" envValueFrom: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: secretKeyRef: { name: grafana, key: oidc-client-secret }