# Example: rotate an OIDC app's client secret.
#
# ZITADEL keeps one secret per app, so the old value dies at the generate call.
# The strategy is atomic: publish, roll the consumer, verify, and roll back if the
# introspection check fails.
apiVersion: iam.homelab.riotpiao.com/v1
kind: KeyRotation
metadata:
  name: example-grafana-client
  namespace: iam
spec:
  provider: zitadel-oidc-client
  strategy: atomic
  intervalHours: 2160       # 90 days
  suspend: true
  target:
    zitadelProjectID: "396757796898471937"
    zitadelAppID: "REPLACE_WITH_APP_ID"
    secretName: grafana-oidc
    secretNamespace: logging
    secretKeys:
      secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
    reload: restart         # Grafana reads the value at start
    consumers:
      - {kind: Deployment, name: grafana, namespace: logging}
  verify:
    introspect: true