Fix Grafana telemetry credential delivery

clusters/unraid-lab/apps/grafana-cloud-secrets/application.yaml

@@ -0,0 +1,22 @@
+# Bitwarden Secrets Manager supplies Grafana Cloud credentials to Alloy without
+# storing credential values in Git.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: grafana-cloud-secrets
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/syscode-labs/syscode-homelab-gitops-apps.git
+    targetRevision: HEAD
+    path: clusters/unraid-lab/apps/grafana-cloud-secrets/manifests
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true

clusters/unraid-lab/apps/grafana-cloud-secrets/manifests/bitwardensecret.yaml

@@ -0,0 +1,29 @@
+apiVersion: k8s.bitwarden.com/v1
+kind: BitwardenSecret
+metadata:
+  name: grafana-cloud
+  namespace: monitoring
+spec:
+  organizationId: "28d10c96-b6fb-4e33-b486-b1f700017837"
+  projectId: "8e33ca9c-37d5-4437-a977-b4a101001e2f"
+  secretName: grafana-cloud
+  authToken:
+    secretName: bw-auth-token
+    secretKey: token
+  map:
+    - bwSecretId: "586aca5a-53d4-486f-9215-b4a3012b4d6e" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: metrics-username
+    - bwSecretId: "0167adff-e881-4263-a8a6-b4a3012b4dac" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: metrics-password
+    - bwSecretId: "1e7d563b-3318-4702-b5a3-b4a3012b4dea" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: logs-username
+    - bwSecretId: "a690572b-f1c1-4b3b-ae2e-b4a3012b4e2e" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: logs-password
+    - bwSecretId: "7d06095d-73a5-4ead-909b-b4a3012b4e63" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: otlp-username
+    - bwSecretId: "fb9fd11c-d1b5-4359-9928-b4a3012b6c7c" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: otlp-password
+    - bwSecretId: "b39c9e04-299d-43e6-b675-b4a3012b4ecc" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: fleet-username
+    - bwSecretId: "2994fb3e-8eb0-4f30-b287-b4a3012b4f07" # gitleaks:allow -- Bitwarden secret UUID, not a credential
+      secretKeyName: fleet-password

clusters/unraid-lab/apps/grafana-cloud-secrets/manifests/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - bitwardensecret.yaml

omni/scripts/inject-bitwarden-auth-token.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Bootstrap the Bitwarden operator's machine token through Omni, never Git.
+set -euo pipefail
+
+CLUSTER="unraid-lab"
+BWS_ACCESS_TOKEN="${BWS_ACCESS_TOKEN:-$(security find-generic-password -w -a "$USER" -s BWS_ACCESS_TOKEN)}"
+
+temporary="$(mktemp -d)"
+trap 'rm -rf "$temporary"' EXIT
+
+cat >"$temporary/manifests.yaml" <<YAML
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: bw-auth-token
+  namespace: monitoring
+type: Opaque
+stringData:
+  token: "${BWS_ACCESS_TOKEN}"
+YAML
+
+python3 - "$temporary/manifests.yaml" "$temporary/configpatch.yaml" "$CLUSTER" <<'PY'
+import sys
+from pathlib import Path
+
+import yaml
+
+
+class Literal(str):
+    pass
+
+
+def represent_literal(dumper, data):
+    return dumper.represent_scalar("tag:yaml.org,2002:str", data, style="|")
+
+
+yaml.SafeDumper.add_representer(Literal, represent_literal)
+
+manifests_path = Path(sys.argv[1])
+configpatch_path = Path(sys.argv[2])
+cluster = sys.argv[3]
+manifests = manifests_path.read_text()
+list(yaml.safe_load_all(manifests))
+
+patch = {
+    "cluster": {
+        "inlineManifests": [
+            {"name": "bitwarden-auth-token", "contents": Literal(manifests)}
+        ]
+    }
+}
+configpatch = {
+    "metadata": {
+        "namespace": "default",
+        "type": "ConfigPatches.omni.sidero.dev",
+        "id": f"510-cluster-{cluster}-bitwarden-auth-token",
+        "labels": {"omni.sidero.dev/cluster": cluster},
+    },
+    "spec": {"data": Literal(yaml.safe_dump(patch, sort_keys=False))},
+}
+configpatch_path.write_text(yaml.safe_dump(configpatch, sort_keys=False))
+print("manifests: valid")
+PY
+
+if [[ "${1:-}" == "--apply" ]]; then
+  omnictl apply -f "$temporary/configpatch.yaml"
+  printf 'Bitwarden auth-token ConfigPatch applied to Omni.\n'
+else
+  printf 'Bitwarden auth-token ConfigPatch rendered and validated; re-run with --apply to push to Omni.\n'
+fi