28 lines
856 B
YAML
28 lines
856 B
YAML
|
# Example: rotate an OIDC app's client secret.
|
||
|
|
#
|
||
|
|
# ZITADEL keeps one secret per app, so the old value dies at the generate call.
|
||
|
|
# The strategy is atomic: publish, roll the consumer, verify, and roll back if the
|
||
|
|
# introspection check fails.
|
||
|
|
apiVersion: iam.homelab.riotpiao.com/v1
|
||
|
|
kind: KeyRotation
|
||
|
|
metadata:
|
||
|
|
name: example-grafana-client
|
||
|
|
namespace: iam
|
||
|
|
spec:
|
||
|
|
provider: zitadel-oidc-client
|
||
|
|
strategy: atomic
|
||
|
|
intervalHours: 2160 # 90 days
|
||
|
|
suspend: true
|
||
|
|
target:
|
||
|
|
zitadelProjectID: "396757796898471937"
|
||
|
|
zitadelAppID: "REPLACE_WITH_APP_ID"
|
||
|
|
secretName: grafana-oidc
|
||
|
|
secretNamespace: logging
|
||
|
|
secretKeys:
|
||
|
|
secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
|
||
|
|
reload: restart # Grafana reads the value at start
|
||
|
|
consumers:
|
||
|
|
- {kind: Deployment, name: grafana, namespace: logging}
|
||
|
|
verify:
|
||
|
|
introspect: true
|