From f776bdccafc3f96e95974f342734167d04c96f6f Mon Sep 17 00:00:00 2001
From: Michael Thomson <michael@michaelthomson.dev>
Date: Fri, 19 Dec 2025 15:38:15 -0500
Subject: [PATCH] kube prometheus stack grafana credentials

---
 apps/kube-prometheus-stack/admin-secret.yaml | 23 ++++++++++++++++++++
 apps/kube-prometheus-stack/release.yaml      |  4 ++++
 2 files changed, 27 insertions(+)
 create mode 100644 apps/kube-prometheus-stack/admin-secret.yaml

diff --git a/apps/kube-prometheus-stack/admin-secret.yaml b/apps/kube-prometheus-stack/admin-secret.yaml
new file mode 100644
index 0000000..de137ef
--- /dev/null
+++ b/apps/kube-prometheus-stack/admin-secret.yaml
@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    admin-password: ENC[AES256_GCM,data:FXusij+QSZCfG5Cp1VFTsDXmzYc=,iv:KuscQB1tHeTY4d7EPEozOO9FqlhBwZL2hNix7gGpu6s=,tag:wX7us8uCsHlfudM6sx/vAw==,type:str]
+    admin-user: ENC[AES256_GCM,data:aOqM1iNeX30=,iv:iwxNPSNsrxEr7zTmKRWmLK3BNu5UIj055l1p3I24xKo=,tag:eUfhUyD8vHh8YKFZpAX2ww==,type:str]
+kind: Secret
+metadata:
+    name: admin-secret
+    namespace: kube-prometheus-stack
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyU2FJWjVseDY5ZGlJd2xs
+            OHBPQUpiS1ZocTZVeWVOVFdEaGt3dkN4OFFJCmd4M1lYbGYzelNhaDl0Tm5IUGww
+            OVc3M2Z5U3JGYVpuV21UQnJlZzM3Nk0KLS0tIDlma0J4amZKYWo4enpMdTI1YUZJ
+            aXBLVnBtMFpLc3B3djdzZDBiWXhwdmMKSlkc7MFkV6lDJ0J+k2GdIlpbNa438bre
+            2QOOgd3QeomniAmM0pemCR9PIVA3Uf+3DhMs1foZ6uYugJMMsd6esQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-19T20:36:08Z"
+    mac: ENC[AES256_GCM,data:KocjA27Zp0Y/DVemOVvjOATT7QIQjydpJIYQpjr1UnB8l748E+VGkvra2vLyV11BQz3uLija/2v0WNmQs5f+ZLvoTuQro6l9HxSk4zkkgfMzkqzlWIVFsj2Z0SrNtLl+bQMkDeOuMeeB+hAtOtwoc04X9n78PIW+2SGsq2Z94Co=,iv:KfRKGFC0geEburKxnXJJJqZUmVXhET2WnEON+gxlQp8=,tag:cTnOwHZNcP3Z5aCvF+IS3Q==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
diff --git a/apps/kube-prometheus-stack/release.yaml b/apps/kube-prometheus-stack/release.yaml
index 017ffab..961dd3a 100644
--- a/apps/kube-prometheus-stack/release.yaml
+++ b/apps/kube-prometheus-stack/release.yaml
@@ -15,6 +15,10 @@ spec:
   releaseName: kube-prometheus-stack
   values:
     grafana:
+      admin:
+        existingSecret: admin-secret
+        userKey: admin-user
+        passwordKey: admin-password
       ingress:
         enabled: true
         annotations: