Are the secretRef/configRef used in Grafana Data source CR watched for changes ?

[udaydabbeta]

Hi Everyone,

When using the Grafana Operator to create a datasource via the Grafana DataSource CR, if I reference a secret or configMap (for example, secretRef or configMapRef) to provide certificates like ca.cert or TLS credentials for a Loki datasource, will those secrets/configmaps be watched by the operator?

Specifically, if the referenced secret or configMap is updated (e.g., during certificate rotation), will the datasource configuration in Grafana be automatically updated to reflect these changes without manual intervention?

As in below CR:

apiVersion: grafana.integreatly.org/v1beta1
kind: GrafanaDatasource
metadata:
  name: loki
spec:
  instanceSelector:
    matchLabels:
      dashboards: "external-grafana-1"
  valuesFrom:
  - targetPath: "secureJsonData.tlsCACert"
    valueFrom:
      secretKeyRef:
        name: "tls-secret"
        key: "ca.crt"
  - targetPath: "secureJsonData.tlsClientCert"
    valueFrom:
      secretKeyRef:
        name: "tls-secret"
        key: "tls.crt"
  - targetPath: "secureJsonData.tlsClientKey"
    valueFrom:
      secretKeyRef:
        name: "tls-secert"
        key: "tls.key"
  datasource:
    name: loki-datasource-1
    type: loki
    access: proxy
    url: https://loki-read.nm-cal-logging.svc.cluster.local:3100
    isDefault: false
    editable: true
    jsonData:
      'tlsSkipVerify': false
      'tlsAuth': true
      'tlsAuthWithCACert': true
      'serverName': "loki-read.nm-cal-logging.svc.cluster.local"
      'httpHeaderName1': "X-Scope-OrgID"
    secureJsonData:
      'httpHeaderValue1': ""
      'tlsCACert': "${secureJsonData.tlsCACert}"
      'tlsClientCert': "${secureJsonData.tlsClientCert}"
      'tlsClientKey': "${secureJsonData.tlsClientKey}"

[Baarsgaard]

As of right, the operator does not react to changes to a referenced ConfigMap for GrafanaDatasources.
It relies solely on the CR itself and resyncPeriod.
We do have something similar for GrafanaDashboard when using a ConfigMap as the json source, but that only works under specific conditions as detailed in #1964

If it's a feature you're looking for, creating a "Feature request" would be a good start.
And if you're up for it, a PR implementing would likely be accepted as we already have similar functionality for GrafanaDashboard

[udaydabbeta]

@Baarsgaard Thanks for the response!

As mentioned in #1964

By labeling configmaps app.kubernetes.io/managed-by: grafana-operator it should work without people needing to modify any controller flags but they would need to label the configmaps like that.

Just to clarify — if we reference a Secret in a GrafanaDatasource CR, and we apply the app.kubernetes.io/managed-by: grafana-operator , will the operator watch for changes to that Secret and update the datasource with the updated secret values out-of-the-bo?

Or does the operator currently ignore updates to referenced Secrets regardless of labels, similar to the behavior with ConfigMaps?

Would appreciate clarification — trying to determine if labeling the Secret enables watch-based reconciliation.

[Baarsgaard]

The operator does not react to changes to a referenced ConfigMaps or Secrets for GrafanaDatasources
It is not implemented.