unkin/argocd-apps
3
0
Fork 0
Code Issues 7 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

grafana: stop pinning the internal CA for Authentik OAuth #440

Merged
benvin merged 1 commits from benvin/grafana-oauth-le-trust into main 2026-08-29 21:52:30 +10:00
Conversation 0 Commits 1 Files Changed 1
-17
unkin-agent commented 2026-08-29 21:28:00 +10:00
Member
Copy Link
Copy Source

Why

identity.unkin.net moved from an internal unkin.net CA-issued cert to the LetsEncrypt *.unkin.net wildcard. auth.generic_oauth's tls_client_ca pointed Grafana at the internal root only, so the OAuth handshake to the LE-issued cert now fails. Grafana's image trust store already contains the public roots.

Changes

  • Remove tls_client_ca: /etc/grafana/vault-ca/ca.crt (and its stale comment) from auth.generic_oauth.
  • Remove the now-unused vault-ca-cert volume and volumeMount from the Grafana pod spec — nothing else in the pod referenced it (the CNPG endpointCA reference to vault-ca-cert for s3.ceph.unkin.net is a separate resource and stays).
  • Leave the auth/token/api URLs, scopes and role_attribute_path untouched.
## Why `identity.unkin.net` moved from an internal `unkin.net` CA-issued cert to the LetsEncrypt `*.unkin.net` wildcard. `auth.generic_oauth`'s `tls_client_ca` pointed Grafana at the internal root only, so the OAuth handshake to the LE-issued cert now fails. Grafana's image trust store already contains the public roots. ## Changes - Remove `tls_client_ca: /etc/grafana/vault-ca/ca.crt` (and its stale comment) from `auth.generic_oauth`. - Remove the now-unused `vault-ca-cert` volume and volumeMount from the Grafana pod spec — nothing else in the pod referenced it (the CNPG `endpointCA` reference to `vault-ca-cert` for `s3.ceph.unkin.net` is a separate resource and stays). - Leave the auth/token/api URLs, scopes and `role_attribute_path` untouched.
unkin-agent added 1 commit 2026-08-29 21:28:00 +10:00
grafana: stop pinning the internal CA for Authentik OAuth
ci/woodpecker/pr/vector-test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/kubeconform Pipeline was successful
Details
82aef12586 
identity.unkin.net now serves the LetsEncrypt *.unkin.net wildcard, so
tls_client_ca pointing at the internal unkin.net root is the only trust anchor
Grafana offers generic_oauth and the handshake fails. Drop the setting and the
now-unused vault-ca-cert mount; the image's public roots cover it.
benvin merged commit 1169d796e7 into main 2026-08-29 21:52:30 +10:00
benvin deleted branch benvin/grafana-oauth-le-trust 2026-08-29 21:52:30 +10:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/argocd-apps#440
Delete Branch "benvin/grafana-oauth-le-trust"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?