Skip to content

monitoring: the OIDC secretRef mode sets GF_PATHS_CUSTOM_INI, which Grafana likely never reads #4679

Description

In oidc.mode: CustomConfig with customConfig.secretRef, the chart mounts the tenant's auth.ini under /etc/grafana/oidc and points Grafana at it with the env var GF_PATHS_CUSTOM_INI (packages/system/monitoring/templates/grafana/grafana.yaml, around line 257). The values docs and the schema promise the same ("mounted under /etc/grafana/oidc and loaded via GF_PATHS_CUSTOM_INI"). Grafana maps GF_<SECTION>_<KEY> environment variables onto existing config keys, and the [paths] section has no custom_ini key; the custom config file is chosen with the --config flag. If that holds, the mounted file is never loaded and the secretRef mode silently runs without the tenant's OIDC settings. Not verified on a live pod yet. Found while writing the monitoring OIDC e2e suite (#4678), whose secretRef phase can only assert the mount, not that Grafana loaded the file. Fix shape: confirm on a running Grafana (/api/admin/settings shows the effective auth.generic_oauth values), then load the file a way Grafana honours, for example by passing it through the operator's spec.config or by mapping each key to its GF_AUTH_GENERIC_OAUTH_* env var from the Secret, and make the e2e suite assert the effective setting.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/monitoringIssues or PRs related to the monitoring stack (vlogs, vmstack, grafana, workloadmonitor)kind/bugCategorizes issue or PR as related to a bugtriage/acceptedIndicates an issue is ready to be actively worked on

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions