# Read-only access to the Grafana database credentials in the psql namespace.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: db-credentials-reader
  annotations:
    argocd.argoproj.io/sync-wave: "-3"
---
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: psql-credentials
  annotations:
    argocd.argoproj.io/sync-wave: "-2"
spec:
  provider:
    kubernetes:
      remoteNamespace: psql
      server:
        caProvider:
          type: ConfigMap
          name: kube-root-ca.crt
          key: ca.crt
      auth:
        serviceAccount:
          name: db-credentials-reader
---
# A local break-glass account. OIDC remains the normal login path.
apiVersion: generators.external-secrets.io/v1alpha1
kind: Password
metadata:
  name: grafana-admin
  annotations:
    argocd.argoproj.io/sync-wave: "-2"
spec:
  length: 40
  digits: 10
  symbols: 0
  noUpper: false
  allowRepeat: true
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: grafana-admin
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
spec:
  refreshPolicy: CreatedOnce
  target:
    name: grafana-admin
    template:
      type: Opaque
      data:
        admin-user: admin
        admin-password: "{{ .password }}"
  dataFrom:
    - sourceRef:
        generatorRef:
          apiVersion: generators.external-secrets.io/v1alpha1
          kind: Password
          name: grafana-admin
---
# Grafana's database credentials come from CNPG. OIDC credentials are read by
# stable Vaultwarden item and custom-field names, so imports and field ordering
# do not invalidate the references.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: grafana-env
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
spec:
  refreshInterval: 1h
  target:
    name: grafana-env
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        GF_DATABASE_USER: "{{ .db_username }}"
        GF_DATABASE_PASSWORD: "{{ .db_password }}"
        GF_AUTH_GENERIC_OAUTH_CLIENT_ID: "{{ .client_id }}"
        GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: "{{ .client_secret }}"
  data:
    - secretKey: db_username
      remoteRef:
        key: grafana-db
        property: username
    - secretKey: db_password
      remoteRef:
        key: grafana-db
        property: password
    - secretKey: client_id
      sourceRef:
        storeRef:
          name: vaultwarden-fields
          kind: ClusterSecretStore
      remoteRef:
        key: k8s/prometheus/grafana-secrets
        property: IDM Client ID
    - secretKey: client_secret
      sourceRef:
        storeRef:
          name: vaultwarden-fields
          kind: ClusterSecretStore
      remoteRef:
        key: k8s/prometheus/grafana-secrets
        property: IDM Client Secret
  secretStoreRef:
    kind: SecretStore
    name: psql-credentials
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: alertmanager-telegram
  annotations:
    argocd.argoproj.io/sync-wave: "-1"
spec:
  refreshInterval: 1h
  target:
    name: alertmanager-telegram
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        bot-token: "{{ .bot_token }}"
        chat-id: "{{ .chat_id }}"
  data:
    - secretKey: bot_token
      sourceRef:
        storeRef:
          name: vaultwarden-fields
          kind: ClusterSecretStore
      remoteRef:
        key: k8s/prometheus/grafana-secrets
        property: TG Token
    - secretKey: chat_id
      sourceRef:
        storeRef:
          name: vaultwarden-fields
          kind: ClusterSecretStore
      remoteRef:
        key: k8s/prometheus/grafana-secrets
        property: TG ID