UNCLASSIFIED - NO CUI

Skip to content

grafana values produce invalid yaml when grafana.sso.enabled=true and monitoring.enabled=false

When these values are passed:

monitoring:
  enabled: false
grafana:
  enabled: true
  sso:
    enabled: true
    grafana:
      client_id: dev_00eb8904-5b88-4c68-ad67-cec0d2e07aa6_grafana

This invalid yaml is rendered:

extraSecretMounts:
  - name: auth-generic-oauth-secret
    mountPath: /etc/secrets/auth_generic_oauth
    secretName: grafana-sso
    defaultMode: 0440
    readOnly: true
  scheme: https
  tlsConfig:
    caFile: /etc/prom-certs/root-cert.pem
    certFile: /etc/prom-certs/cert-chain.pem
    keyFile: /etc/prom-certs/key.pem
    insecureSkipVerify: true  # Prometheus does not support Istio security naming, thus skip verifying target pod certificate

This can probably be fixed by changing this:

{{- if .Values.monitoring.enabled }}
serviceMonitor:
  enabled: true
{{- end }}
{{- if $istioInjection }}
  scheme: https
  tlsConfig:
    caFile: /etc/prom-certs/root-cert.pem
    certFile: /etc/prom-certs/cert-chain.pem
    keyFile: /etc/prom-certs/key.pem
    insecureSkipVerify: true  # Prometheus does not support Istio security naming, thus skip verifying target pod certificate
{{- end }}

to this:

{{- if .Values.monitoring.enabled }}
serviceMonitor:
  enabled: true
{{- if $istioInjection }}
  scheme: https
  tlsConfig:
    caFile: /etc/prom-certs/root-cert.pem
    certFile: /etc/prom-certs/cert-chain.pem
    keyFile: /etc/prom-certs/key.pem
    insecureSkipVerify: true  # Prometheus does not support Istio security naming, thus skip verifying target pod certificate
{{- end }}
{{- end }}
Edited by Jonathan Braswell