apiVersion: v1
kind: Secret
metadata:
  name: grafana-google-oidc
  namespace: monitoring
  labels:
    app: grafana
    app.kubernetes.io/managed-by: knoe-installer
# Google OAuth 2.0 client credentials for Grafana's native Google sign-in
# (Grafana auth.google plugin, NOT oauth2-proxy). Mounted into kps-grafana
# via the chart's `envFromSecret: grafana-google-oidc` value. Grafana reads
# `GF_AUTH_GOOGLE_CLIENT_ID` / `GF_AUTH_GOOGLE_CLIENT_SECRET` env vars and
# uses them as `auth.google.client_id` / `client_secret`.
#
# Create the OAuth client at: https://console.cloud.google.com/apis/credentials
# - Application type: Web application
# - Name: knoe.dev Grafana
# - Authorized JavaScript origins: https://svc.knoe.dev
# - Authorized redirect URIs: https://svc.knoe.dev/grafana/login/google
# - OAuth consent screen: Internal (knoey.com Workspace)
# - Scopes: openid, email, profile (default for grafana auth.google)
#
# Why a separate client (not reusing knoe.dev Studio's): independent rotation
# surface — if Grafana access is compromised, rotating one client doesn't
# disrupt Studio sign-in (and vice versa). Same convention as gitlab-google-oidc
# and oauth2-proxy-google-oidc.
type: Opaque
stringData:
  GF_AUTH_GOOGLE_CLIENT_ID: "${GRAFANA_GOOGLE_CLIENT_ID}"
  GF_AUTH_GOOGLE_CLIENT_SECRET: "${GRAFANA_GOOGLE_CLIENT_SECRET}"