apiVersion: v1
kind: Secret
metadata:
  name: grafana-google-oidc
  namespace: monitoring
  labels:
    app: grafana
    app.kubernetes.io/managed-by: knoe-installer
# Google OAuth 2.0 client credentials for Grafana's native Google sign-in
# (Grafana auth.google plugin) on the prole.org k3s homelab cluster.
# Mounted into kps-grafana via `envFromSecret: grafana-google-oidc` in
# monitoring/kps-values-k3s.yaml. Grafana reads GF_AUTH_GOOGLE_CLIENT_ID /
# GF_AUTH_GOOGLE_CLIENT_SECRET and uses them as auth.google.client_id / client_secret.
#
# Create the OAuth client at: https://console.cloud.google.com/apis/credentials
# (in the prole.org GCP project — separate from the knoey.com project)
# - Application type: Web application
# - Name: prole.org Grafana
# - Authorized JavaScript origins: https://svc.prole.org
# - Authorized redirect URIs: https://svc.prole.org/grafana/login/google
# - OAuth consent screen: Internal (prole.org Workspace only)
# - Scopes: openid, email, profile
#
# Why a separate client from prole.org Studio: independent rotation surface.
# Companion to oauth2-proxy-google-oidc-secret-prole.example.yaml.
type: Opaque
stringData:
  GF_AUTH_GOOGLE_CLIENT_ID: "${GRAFANA_GOOGLE_CLIENT_ID}"
  GF_AUTH_GOOGLE_CLIENT_SECRET: "${GRAFANA_GOOGLE_CLIENT_SECRET}"