fix(grafana): point the OIDC registrar at ns ory, not the deleted ory-alice #3

Merged

sean merged 2 commits from fix/grafana-oidc-ory-ns into trunk 2026-08-05 12:36:49 +00:00

Conversation 0 Commits 2 Files changed 1 +30 -3

sean commented 2026-08-05 12:33:05 +00:00

Owner

Copy link

Grafana OIDC login fails with "Login failed / Failed to get token from provider". The 07-24 ory-alice->ory SSO cutover deleted ns ory-alice but missed this registrar Job. HYDRA_PUBLIC_INTERNAL is what it writes into the grafana-oidc Secret as TOKEN_URL/API_URL, so Grafana server-side code exchange dials hydra-public.ory-alice.svc (NXDOMAIN) while the browser leg via public auth.sean.farm keeps working. Live log: failed to exchange code to token ... no such host. NOTE: the Job is immutable, so after this deploys the completed Job must be delete+recreated for the Secret to be rewritten, then grafana restarted.

Grafana OIDC login fails with "Login failed / Failed to get token from provider". The 07-24 ory-alice->ory SSO cutover deleted ns ory-alice but missed this registrar Job. HYDRA_PUBLIC_INTERNAL is what it writes into the grafana-oidc Secret as TOKEN_URL/API_URL, so Grafana server-side code exchange dials hydra-public.ory-alice.svc (NXDOMAIN) while the browser leg via public auth.sean.farm keeps working. Live log: failed to exchange code to token ... no such host. NOTE: the Job is immutable, so after this deploys the completed Job must be delete+recreated for the Secret to be rewritten, then grafana restarted.

sean added 1 commit 2026-08-05 12:33:05 +00:00

fix(grafana): point the OIDC registrar at ns ory, not the deleted ory-alice ... 7cf6f6483b

The 07-24 ory-alice->ory SSO cutover deleted ns ory-alice but missed this
registrar Job. HYDRA_PUBLIC_INTERNAL is what it writes into the grafana-oidc
Secret as TOKEN_URL/API_URL, so Grafana's server-side code exchange dialed
hydra-public.ory-alice.svc (NXDOMAIN) while the browser leg via the public
auth.sean.farm host kept working — surfacing as 'Login failed / Failed to get
token from provider'.

sean added 1 commit 2026-08-05 12:35:16 +00:00

fix(grafana): make the OIDC registrar a self-completing sync hook ... 786fd39b6c

A Job spec is immutable, so editing the registrar in place never applied and
the grafana-oidc Secret silently kept its stale endpoints — the mechanism that
let the ory-alice URLs survive the SSO cutover. Run it as an ArgoCD Sync hook
(deleted before each hook creation, excluded from drift comparison so it can't
flap under selfHeal), and have it restart Grafana after rewriting the Secret,
since envFrom is read only at process start. An endpoint or credential change
now converges with no manual rollout, on a running cluster and on rebuild.

sean force-pushed fix/grafana-oidc-ory-ns from 786fd39b6c to 30408ea098 2026-08-05 12:36:13 +00:00 Compare

sean merged commit 30408ea098 into trunk 2026-08-05 12:36:49 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/olly!3

No description provided.