In oidc.mode: CustomConfig with customConfig.secretRef, the chart mounts the tenant's auth.ini under /etc/grafana/oidc and points Grafana at it with the env var GF_PATHS_CUSTOM_INI (packages/system/monitoring/templates/grafana/grafana.yaml, around line 257). The values docs and the schema promise the same ("mounted under /etc/grafana/oidc and loaded via GF_PATHS_CUSTOM_INI"). Grafana maps GF_<SECTION>_<KEY> environment variables onto existing config keys, and the [paths] section has no custom_ini key; the custom config file is chosen with the --config flag. If that holds, the mounted file is never loaded and the secretRef mode silently runs without the tenant's OIDC settings. Not verified on a live pod yet. Found while writing the monitoring OIDC e2e suite (#4678), whose secretRef phase can only assert the mount, not that Grafana loaded the file. Fix shape: confirm on a running Grafana (/api/admin/settings shows the effective auth.generic_oauth values), then load the file a way Grafana honours, for example by passing it through the operator's spec.config or by mapping each key to its GF_AUTH_GENERIC_OAUTH_* env var from the Secret, and make the e2e suite assert the effective setting.
In
oidc.mode: CustomConfigwithcustomConfig.secretRef, the chart mounts the tenant'sauth.iniunder/etc/grafana/oidcand points Grafana at it with the env varGF_PATHS_CUSTOM_INI(packages/system/monitoring/templates/grafana/grafana.yaml, around line 257). The values docs and the schema promise the same ("mounted under/etc/grafana/oidcand loaded viaGF_PATHS_CUSTOM_INI"). Grafana mapsGF_<SECTION>_<KEY>environment variables onto existing config keys, and the[paths]section has nocustom_inikey; the custom config file is chosen with the--configflag. If that holds, the mounted file is never loaded and the secretRef mode silently runs without the tenant's OIDC settings. Not verified on a live pod yet. Found while writing the monitoring OIDC e2e suite (#4678), whose secretRef phase can only assert the mount, not that Grafana loaded the file. Fix shape: confirm on a running Grafana (/api/admin/settingsshows the effectiveauth.generic_oauthvalues), then load the file a way Grafana honours, for example by passing it through the operator'sspec.configor by mapping each key to itsGF_AUTH_GENERIC_OAUTH_*env var from the Secret, and make the e2e suite assert the effective setting.