From 65b2df122220491b47e76b305c2726a81eea711d Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Wed, 24 Jun 2026 12:25:36 +0000 Subject: [PATCH] fix(monitoring): force_conflicts on grafana_db_creds ExternalSecret MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The external-secrets controller owns .spec.refreshInterval via SSA, so a plain terraform apply of the monitoring stack conflicts. Latent until 2026-06-24 (the homelab-vault loki-rules change was the first monitoring apply in a while and surfaced it). force_conflicts lets TF win — same pattern as woodpecker/traefik/ k8s-version-upgrade stacks. --- stacks/monitoring/modules/monitoring/grafana.tf | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/stacks/monitoring/modules/monitoring/grafana.tf b/stacks/monitoring/modules/monitoring/grafana.tf index 4acafd52..d7af906f 100644 --- a/stacks/monitoring/modules/monitoring/grafana.tf +++ b/stacks/monitoring/modules/monitoring/grafana.tf @@ -71,6 +71,15 @@ resource "kubernetes_persistent_volume" "alertmanager_pv" { # DB credentials from Vault database engine (rotated automatically) # Provides GF_DATABASE_PASSWORD that auto-updates when password rotates resource "kubernetes_manifest" "grafana_db_creds" { + # The external-secrets controller takes server-side-apply ownership of + # .spec.refreshInterval, so a plain TF apply conflicts ("conflict with + # external-secrets ... .spec.refreshInterval"). force_conflicts lets TF win + # (values match, so it's stable) — same pattern as the woodpecker/traefik/ + # k8s-version-upgrade stacks. Surfaced 2026-06-24: the first monitoring apply + # in a while exposed this latent conflict (prior pushes were docs-only). + field_manager { + force_conflicts = true + } manifest = { apiVersion = "external-secrets.io/v1" kind = "ExternalSecret"