From 82aef12586e894a7ddda7211c373e23fb3f1f0dc Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 29 Aug 2026 21:27:51 +1000 Subject: [PATCH] grafana: stop pinning the internal CA for Authentik OAuth identity.unkin.net now serves the LetsEncrypt *.unkin.net wildcard, so tls_client_ca pointing at the internal unkin.net root is the only trust anchor Grafana offers generic_oauth and the handshake fails. Drop the setting and the now-unused vault-ca-cert mount; the image's public roots cover it. --- apps/base/grafana/grafana.yaml | 17 ----------------- 1 file changed, 17 deletions(-) diff --git a/apps/base/grafana/grafana.yaml b/apps/base/grafana/grafana.yaml index 82b6a1f..1665d71 100644 --- a/apps/base/grafana/grafana.yaml +++ b/apps/base/grafana/grafana.yaml @@ -26,13 +26,6 @@ spec: secretKeyRef: name: oauth-credentials key: client_secret - # identity.unkin.net is served by the internal unkin.net CA, which - # the stock Grafana image doesn't trust. Mount the reflected - # vault-ca-cert and point generic_oauth's tls_client_ca at it. - volumeMounts: - - name: vault-ca-cert - mountPath: /etc/grafana/vault-ca - readOnly: true resources: requests: cpu: 100m @@ -40,13 +33,6 @@ spec: limits: cpu: "1" memory: 1Gi - volumes: - - name: vault-ca-cert - secret: - secretName: vault-ca-cert - items: - - key: ca.crt - path: ca.crt config: server: root_url: "https://grafana.k8s.syd1.au.unkin.net" @@ -71,9 +57,6 @@ spec: auth_url: "https://identity.unkin.net/application/o/authorize/" token_url: "https://identity.unkin.net/application/o/token/" api_url: "https://identity.unkin.net/application/o/userinfo/" - # Trust the internal unkin.net CA that signs identity.unkin.net's cert - # (mounted from the reflected vault-ca-cert Secret). - tls_client_ca: "/etc/grafana/vault-ca/ca.crt" # Authentik permission groups -> Grafana roles. akP-grafana-admin is granted # to akR-global-admin members (and direct members) via terraform-authentik. role_attribute_path: "contains(ak_groups[*], 'akP-grafana-admin') && 'Admin' || 'Viewer'" -- 2.47.3