[Bug] Unable to set custom secrets without defining grafana container image about grafana-operator HOT 6 CLOSED

@jamalaitahmed I think you get this problem simply because you're not redefining settings for grafana container, but, instead, you're adding a test container, where, obviously, an image must be provided, because configuration for extra containers is passed to k8s without changes from the operator side.

apiVersion: grafana.integreatly.org/v1beta1
kind: Grafana
metadata:
  labels:
    dashboards: grafana
  name: test
  namespace: test
spec:
  config:
    auth:
      disable_login_form: 'false'
    log:
      mode: console
  deployment:
    spec:
      template:
        spec:
          containers:
            - env:
                - name: GF_SECURITY_ADMIN_USER
                  valueFrom:
                    secretKeyRef:
                      key: GF_SECURITY_ADMIN_USER
                      name: test
                - name: GF_SECURITY_ADMIN_PASSWORD
                  valueFrom:
                    secretKeyRef:
                      key: GF_SECURITY_ADMIN_PASSWORD
                      name: test
              name: grafana # FIX IS HERE

P.S. You can see grafana container name in the example that @NissesSenap shared, so it's already documented.

from grafana-operator.

This is not a bug with GitOps, it's very possible to create a secret using sealed-secrets.
I use custom secrets for my grafana admin user, in my own setup and I have done it ever since version 5 was released.
The issue is that you can't set GF_SECURITY_ADMIN_USER etc. without also setting the container image.

How to do that is documented here: https://grafana.github.io/grafana-operator/docs/examples/grafana_deployment/readme/

I would argue, this isn't a huge issue, since I recommend that everyone always set a custom version of the grafana image. The main reason behind this is that grafana-operator will never be in sync with upstream grafana and minor and patches are constantly getting released by grafana.

But this is definitely a bug, and it should be able to set env variables without also setting the grafana container image.
It's a problem in our merge logic for overwriting settings.
If anyone wants to help out with this, we would love a PR.

from grafana-operator.

@NissesSenap I just discovered that the operator creates a secret grafana-admin-credentials even if I use a custom secret with credentials. Is this a normal behavior or bug? My current config looks like this:

apiVersion: grafana.integreatly.org/v1beta1
kind: Grafana
metadata:
  name: grafana
  labels:
    dashboards: grafana
spec:
  deployment:
    spec:
      template:
        spec:
          containers:
            - name: grafana
              env:
                - name: GF_SECURITY_ADMIN_USER
                  valueFrom:
                    secretKeyRef:
                      name: grafana-admin-creds
                      key: admin_user
                - name: GF_SECURITY_ADMIN_PASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: grafana-admin-creds
                      key: admin_pass
---
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: grafana-admin-creds
stringData:
  admin_user: "XXX"
  admin_pass: "XXX"

from grafana-operator.

It's a known issue @RusMephist , I think we have an issue with it somewhere. It won't give you any issues, it's just ugly to my knowledge.

Have you seen any issues with it other then you get an extra secret?

from grafana-operator.

@NissesSenap
Nope, just an annoying extra secret)

from grafana-operator.

As this does not cause any issues and implementing checks for possible deployment overrides is a pretty involved topic, we'll close this issue for now. If this turns out to cause any problems for anyone in the future, feel free to reopen this issue

from grafana-operator.