From 2de34900f43f7a9045ac1ad3b39c221d91983760 Mon Sep 17 00:00:00 2001
From: Laur IVAN <laur.ivan@ec.europa.eu>
Date: Fri, 27 Feb 2026 02:19:31 +0100
Subject: [PATCH] fix(grafana): Add missing secrets.

---
 .../grafana/app/externalsecret.yaml           | 22 -------------------
 .../grafana/app/secrets.sops.yaml             |  6 +++--
 2 files changed, 4 insertions(+), 24 deletions(-)
 delete mode 100644 kubernetes/apps/observability/grafana/app/externalsecret.yaml

diff --git a/kubernetes/apps/observability/grafana/app/externalsecret.yaml b/kubernetes/apps/observability/grafana/app/externalsecret.yaml
deleted file mode 100644
index 2b87e26..0000000
--- a/kubernetes/apps/observability/grafana/app/externalsecret.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
----
-# yaml-language-server: $schema=https://schemas.tholinka.dev/external-secrets.io/externalsecret_v1.json
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: grafana
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: bitwarden
-  target:
-    name: grafana-secret
-    template:
-      data:
-        # Authentik
-        GF_AUTH_GENERIC_OAUTH_CLIENT_ID: '{{ .GRAFANA_CLIENT_ID }}'
-        GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: '{{ .GRAFANA_CLIENT_SECRET }}'
-        # admin user
-        GF_SECURITY_ADMIN_PASSWORD: '{{ .GRAFANA_ADMIN_PASSWORD }}'
-  dataFrom:
-    - extract:
-        key: grafana
diff --git a/kubernetes/apps/observability/grafana/app/secrets.sops.yaml b/kubernetes/apps/observability/grafana/app/secrets.sops.yaml
index 12ae5a2..fe4c1c3 100644
--- a/kubernetes/apps/observability/grafana/app/secrets.sops.yaml
+++ b/kubernetes/apps/observability/grafana/app/secrets.sops.yaml
@@ -5,6 +5,8 @@ metadata:
 stringData:
     #ENC[AES256_GCM,data:IvhoPyXVw75X8pU=,iv:1CWSPac9y9lBeLmxmHnrHeWFkAutYQXrQjtQEI8uEow=,tag:iOvsj3n1i757mnNDkL9sGA==,type:comment]
     GF_SECURITY_ADMIN_PASSWORD: ENC[AES256_GCM,data:AznP+gnoEuJsyodnOT87BljKB/AbRnAluLZbdRcOqTN3jclA798=,iv:v3FD0nV6rUn1Vfn4lYYOMysre++6fnABj7SS/OyQxo8=,tag:/aSw3Hss8jW7+sFuhBpsIA==,type:str]
+    GF_AUTH_GENERIC_OAUTH_CLIENT_ID: ENC[AES256_GCM,data:MQ3boqCQCc2U0RM=,iv:SlWxpl9qIedoT19h6NJgW1d6fx10oOKYqL6kSOlpEvQ=,tag:cG263Z6TVDrUEab8/4eC9Q==,type:str]
+    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:fLBNRkxOaD1hIcU=,iv:VY1XXFeGsVU5VXf+Qco1MFkNNOgsmXcztvak28bld4Q=,tag:xDC6h7gUMeef0s7h0+Y9bw==,type:str]
 sops:
     age:
         - recipient: age1yzrqhl9dk8ljswpmzsqme3enad5kxxhsptdvecy3lwlq0ms80gaqxrctst
@@ -16,8 +18,8 @@ sops:
             dUtWdGJ0cjhjREI5YnVzVDk5VGJJS0kKpa+N5XC8a5/V/eUgqZoosxrio9CJMTYS
             TzhILOHxY59zNtl4Jw7QtIy27jWki4+318WnQ2XGHO5yPUitc1yPuA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-27T01:02:54Z"
-    mac: ENC[AES256_GCM,data:id8qSh1YZYiVshn2OuTw4hioJSUgACZSkKd0DkUC9soslvxFNoalr49IDSNP1HPBfwnenKxJCamuS9Tx/h9W7dsm2pgGoFu0WnDcZMVubbD9ztM51iCU7JOhyVzIxQ+zVHEqztmUHx9DQuwtHDjQzPxhE9r5x+2VRAtl3DsUJAU=,iv:RMpTxIb3+jJLPx7H8X96e2aop96bvfClTfaQdopYclk=,tag:tSyoFklRpcS8Xc4kNFaCVA==,type:str]
+    lastmodified: "2026-02-27T01:19:11Z"
+    mac: ENC[AES256_GCM,data:GnylKsWOeGErWoijlKHPVO1MZDfY4CphgtqDX7xOH0mZp25v5QcDy78BQGVeB6TXRDiMVWNbVJZRkfdgoEGsJK7x1vnllV86EDwjB/HOt3yXBnA8dXvDdO1ZEnmQVkxjy0odhb5UO2QDctd+E8dYTdbSmh1M/DA2xEqAd326D0s=,iv:JCspZC+Yjv+9Ae8lRb1kN0Dj5uwaegLNjGzWgjWJI28=,tag:KAYQTl+ECMmQxl3UNtk19g==,type:str]
     encrypted_regex: ^(data|stringData)$
     mac_only_encrypted: true
     version: 3.11.0