oeng/smol-k8s-lab

Watch

Fork 0

create an htpasswd per grafana stack component, and per tenant, including our default current cluster; prepare to deprecate bitwarden as an ESO provider #123

Merged

jessebot merged 6 commits from add-per-tenant-htpasswd-generation into main

2026-10-17 10:20:44 +00:00

jessebot commented

2026-10-17 07:26:44 +00:00

Owner

Changes

create an htpasswd per grafana stack component per tenant, which always includes the current cluster name as a tenant
always put the grafana stack component htpasswd secrets in both the monitoring and alloy (OpenBao or k8s) namespaces
stops referring to loki, tempo, and mimir as "sub apps" of the LGTM stack and starts referring to them as "components"
support custom_namespace parameter for OpenBao.kv_put method
upgrade zensical 0.0.71 (closes #113)
Closes #121
Relates to oeng/argocd-apps#133
cleans up all references to bitwarden to be strictly a local password manager, except for the migration path to get off of Bitwarden as your ESO provider and start using OpenBao

Warning

This will be the last release in which we support Bitwarden as a Kubernetes Secrets manager. Going forward, you can still use Bitwarden as your local password manager, but as Bitwarden may be changing their licensing, we can't keep providing the Kubernetes service. OpenBao has very FOSS friendly licensing and as it's a fork of Vault, was build with Kubernetes in mind, and therefore supports many great quality of life features. Over time, we will slowly begin removing support for using Bitwarden as your ESO provider.

# Changes - create an htpasswd per grafana stack component *per tenant*, which always includes the current cluster name as a tenant - always put the grafana stack component htpasswd secrets in both the monitoring and alloy (OpenBao or k8s) namespaces - stops referring to loki, tempo, and mimir as "sub apps" of the LGTM stack and starts referring to them as "components" - support `custom_namespace` parameter for `OpenBao.kv_put` method - upgrade zensical `0.0.71` (closes #113) - Closes #121 - Relates to https://git.open.engineering/oeng/argocd-apps/pulls/133 - cleans up all references to bitwarden to be strictly a local password manager, except for the migration path to get off of Bitwarden as your ESO provider and start using OpenBao > [!Warning] > This will be the *last* release in which we support Bitwarden as a Kubernetes Secrets manager. Going forward, you can still use Bitwarden as your *local* password manager, but as Bitwarden may be changing their licensing, we can't keep providing the Kubernetes service. OpenBao has very FOSS friendly licensing and as it's a fork of Vault, was build with Kubernetes in mind, and therefore supports many great quality of life features. Over time, we will slowly begin *removing* support for using Bitwarden as your ESO provider.

jessebot added the

minor

label

2026-10-17 07:26:44 +00:00

jessebot self-assigned this

2026-10-17 07:26:44 +00:00

jessebot added 1 commit

2026-10-17 07:26:45 +00:00

create an htpasswd per grafana stack component, and per tenant, including our default current cluster

Test smol-k8s-lab / test_k3s (pull_request) Failing after 1m32s

Details

a2097eebc7

Signed-off-by: JesseBot <jessebot@linux.com>

jessebot added this to the WAF project

2026-10-17 07:28:11 +00:00

jessebot referenced this pull request

2026-10-17 07:30:43 +00:00

Feature Request: Generate credentials for alloy remote writes to mimir #121

jessebot added 1 commit

2026-10-17 07:39:13 +00:00

update grafana stack docs to also note you need the very first sync wave of alloy

Test smol-k8s-lab / test_k3s (pull_request) Successful in 6m19s

Details

ea70aca4ed

jessebot referenced this pull request from oeng/argocd-apps

2026-10-17 07:48:05 +00:00

start adding gateway and basic auth secrets for mimir and loki #133

jessebot added 1 commit

2026-10-17 08:45:43 +00:00

make sure that we also populate the k8s or openbao alloy namespaces with the remoteWrite credentials

Test smol-k8s-lab / test_k3s (pull_request) Failing after 3m4s

Details

74d101acc1

Signed-off-by: JesseBot <jessebot@linux.com>

jessebot added 1 commit

2026-10-17 08:55:45 +00:00

upgrade zensical and make sure we update the BOTH openbao namespaces with the tenant secrets

Test smol-k8s-lab / test_k3s (pull_request) Failing after 3m58s

Details

93b1cf9f9e

jessebot referenced this pull request

2026-10-17 08:56:26 +00:00

Update dependency zensical to ^0.0.71 #113

jessebot added 1 commit

2026-10-17 09:07:19 +00:00

make custom_namespace optional for the OpenBao.kv_put method

Test smol-k8s-lab / test_k3s (pull_request) Successful in 6m47s

Details

da1d7f6d18

jessebot added 1 commit

2026-10-17 10:12:33 +00:00

get ready to deprecate bitwarden as an ESO provider down the line

Test smol-k8s-lab / test_k3s (pull_request) Successful in 6m48s

Details

22038ba8db

jessebot changed title from ~~create an htpasswd per grafana stack component, and per tenant, including our default current cluster~~ to create an htpasswd per grafana stack component, and per tenant, including our default current cluster; prepare to deprecate bitwarden as an ESO provider

2026-10-17 10:14:55 +00:00

jessebot modified the project from WAF to Final touches for Official Launch

2026-10-17 10:15:06 +00:00

jessebot merged commit 7ac0a5effd into main

2026-10-17 10:20:44 +00:00

jessebot deleted branch add-per-tenant-htpasswd-generation

2026-10-17 10:20:45 +00:00

jessebot referenced this pull request from a commit

2026-10-17 10:20:46 +00:00

create an htpasswd per grafana stack component, and per tenant, including our default current cluster; prepare to deprecate bitwarden as an ESO provider (#123)

jessebot referenced this pull request from a commit

2026-10-17 15:24:10 +00:00