Alexey Artamonov 65f0caae2b fix(monitoring): keep a central tenant's write login out of its Grafana ...

A tenant's Grafana pod may reach the shared traces store's vmauth, and
the Secret a tenant names in oidc.customConfig.secretRef was mounted
into it whole. The apps API does not prune keys the Monitoring schema
leaves out, so a tenant could also set grafana.image: an image of its
choosing, with the collector's Secret mounted, writes past the rate
limit the collector enforces.

Grafana's image is the platform's, like the collector's, and for a
central tenant only the auth.ini key Grafana reads is mounted from the
named Secret. Other tenants have no collector login to keep out and
keep the whole Secret, which an auth.ini reading a sibling key with
$__file{} relies on.

Signed-off-by: Alexey Artamonov <aleksei.artamonov@aenix.io>

2026-10-06 09:39:04 +03:00

..

hooks

fix(monitoring): match cleanup PVCs by release label alone, drop managed-by

2026-07-08 22:27:42 +03:00

_helpers.tpl

feat(monitoring): add a shared-central tracing topology

2026-09-30 22:23:47 +03:00

check-release-name.yaml

Adding the ability to deploy system monitoring

2026-02-04 03:34:12 +01:00

dashboard-resourcemap.yaml

feat(monitoring): add a shared-central tracing topology

2026-09-30 22:23:47 +03:00

helmrelease.yaml

fix(monitoring): keep a central tenant's write login out of its Grafana

2026-10-06 09:39:04 +03:00

workloadmonitors.yaml

feat(monitoring): add a shared-central tracing topology

2026-09-30 22:23:47 +03:00