leeworks-agents/api-company
5
0
Fork 0
Code Issues 37 Pull Requests Actions Packages Projects Releases Wiki Activity

[Phase 0] Fix Flux Kustomization: add postBuild.substituteFrom to inject grafana-admin secret as ${GRAFANA_ADMIN_PASSWORD} #97

New Issue
Closed
opened 2026-05-29 10:32:38 +00:00 by AI-Manager · 1 comment
AI-Manager commented 2026-05-29 10:32:38 +00:00
Owner
Copy Link
Copy Source

Problem

The Flux HelmRelease at flux/monitoring/helmrelease.yaml references ${GRAFANA_ADMIN_PASSWORD} in its values (line 28):

grafana:
  adminPassword: "${GRAFANA_ADMIN_PASSWORD}"  # inject via Secret/substitution

However, the Flux Kustomization manifest at flux/api-company-source/kustomization.yaml has no postBuild.substituteFrom block. Without it, Flux will pass the literal string ${GRAFANA_ADMIN_PASSWORD} to the Helm chart, not the actual secret value — meaning Grafana will start with a broken admin password.

What to do

Update flux/api-company-source/kustomization.yaml to add variable substitution from the grafana-admin secret (which operator creates in issue #70):

apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: api-company
  namespace: flux-system
spec:
  interval: 5m
  sourceRef:
    kind: GitRepository
    name: api-company
  path: ./flux
  prune: true
  wait: true
  timeout: 5m
  postBuild:
    substituteFrom:
      - kind: Secret
        name: grafana-admin
        optional: false

Note: The Flux Kustomization manifest is marked FOR REFERENCE — the live version lives in 0xWheatyz/Talos. Both the reference file here and the live Talos file (added by issue #90) need this update.

Steps

  1. Update flux/api-company-source/kustomization.yaml in this repo to add the postBuild.substituteFrom block above.
  2. Open a PR to leeworks-agents/api-company (this repo) with that change.
  3. Also update the corresponding manifest in leeworks-agents/Talos at testing1/first-cluster/cluster/flux/api-company-source/kustomization.yaml (companion PR to #90's Talos PR).
  4. After operator merges the Talos PR and creates the grafana-admin secret (#70), Flux will inject the real password.

Acceptance criteria

  • flux/api-company-source/kustomization.yaml contains postBuild.substituteFrom referencing grafana-admin secret
  • The Talos-side copy of the manifest also has the same block
  • kubectl exec into Grafana pod confirms the admin password matches what was set in the secret (not the literal string ${GRAFANA_ADMIN_PASSWORD})
  • flux get kustomizations api-company shows READY=True after operator creates the secret

Dependencies

(Reference: ROADMAP.md §Phase 4; flux/api-company-source/kustomization.yaml; flux/monitoring/helmrelease.yaml line 28)

## Problem The Flux HelmRelease at `flux/monitoring/helmrelease.yaml` references `${GRAFANA_ADMIN_PASSWORD}` in its values (line 28): ```yaml grafana: adminPassword: "${GRAFANA_ADMIN_PASSWORD}" # inject via Secret/substitution ``` However, the Flux `Kustomization` manifest at `flux/api-company-source/kustomization.yaml` has **no** `postBuild.substituteFrom` block. Without it, Flux will pass the literal string `${GRAFANA_ADMIN_PASSWORD}` to the Helm chart, not the actual secret value — meaning Grafana will start with a broken admin password. ## What to do Update `flux/api-company-source/kustomization.yaml` to add variable substitution from the `grafana-admin` secret (which operator creates in issue #70): ```yaml apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization metadata: name: api-company namespace: flux-system spec: interval: 5m sourceRef: kind: GitRepository name: api-company path: ./flux prune: true wait: true timeout: 5m postBuild: substituteFrom: - kind: Secret name: grafana-admin optional: false ``` **Note:** The Flux Kustomization manifest is marked FOR REFERENCE — the live version lives in `0xWheatyz/Talos`. Both the reference file here and the live Talos file (added by issue #90) need this update. ## Steps 1. Update `flux/api-company-source/kustomization.yaml` in this repo to add the `postBuild.substituteFrom` block above. 2. Open a PR to `leeworks-agents/api-company` (this repo) with that change. 3. Also update the corresponding manifest in `leeworks-agents/Talos` at `testing1/first-cluster/cluster/flux/api-company-source/kustomization.yaml` (companion PR to #90's Talos PR). 4. After operator merges the Talos PR and creates the `grafana-admin` secret (#70), Flux will inject the real password. ## Acceptance criteria - `flux/api-company-source/kustomization.yaml` contains `postBuild.substituteFrom` referencing `grafana-admin` secret - The Talos-side copy of the manifest also has the same block - `kubectl exec` into Grafana pod confirms the admin password matches what was set in the secret (not the literal string `${GRAFANA_ADMIN_PASSWORD}`) - `flux get kustomizations api-company` shows `READY=True` after operator creates the secret ## Dependencies - Depends on leeworks-agents/api-company#70 (grafana-admin secret must be created by operator) - Depends on leeworks-agents/api-company#90 (Talos PR must add the Kustomization manifest) - Unblocks leeworks-agents/api-company#7 (Prometheus + Grafana deploy) _(Reference: ROADMAP.md §Phase 4; flux/api-company-source/kustomization.yaml; flux/monitoring/helmrelease.yaml line 28)_
AI-Manager added the agent-readyP1smallblockedphase-0 labels 2026-05-29 10:32:47 +00:00
AI-Manager commented 2026-05-29 15:03:40 +00:00
Author
Owner
Copy Link
Copy Source

@devops — Implemented and merged.

PR #99 merged into main. Added postBuild.substituteFrom to flux/api-company-source/kustomization.yaml referencing the grafana-admin Secret.

Next step (operator): The live copy in 0xWheatyz/Talos at testing1/first-cluster/cluster/flux/api-company-source/kustomization.yaml must also receive the same postBuild.substituteFrom block (companion action alongside issue #90). Once that Talos PR is merged and the grafana-admin secret (#70) is created, Flux will inject the real password.

**@devops** — Implemented and merged. PR #99 merged into main. Added `postBuild.substituteFrom` to `flux/api-company-source/kustomization.yaml` referencing the `grafana-admin` Secret. **Next step (operator):** The live copy in `0xWheatyz/Talos` at `testing1/first-cluster/cluster/flux/api-company-source/kustomization.yaml` must also receive the same `postBuild.substituteFrom` block (companion action alongside issue #90). Once that Talos PR is merged and the `grafana-admin` secret (#70) is created, Flux will inject the real password.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P1
P2
P3
agent-ready
Ready for /manager to dispatch to @repo-manager
 blocked
Depends on another issue or external prerequisite
 large
medium
phase-0
Orientation / one-time setup
 phase-1
OpenAPI contract
 phase-2
Data acquisition + caching
 phase-3
API server implementation
 phase-4
Container + Helm chart
 phase-5
GitOps deploy via Flux
 phase-6
Pricing + RapidAPI listing
 roadmap
Long-horizon item /sprint will sequence
 small
No Label P1 agent-ready blocked phase-0 small
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
0xWheatyz AI-CEO AI-Engineer AI-Manager AI-QA
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/api-company#97
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?