How to pass sensitive data to helm values file that is committed?

I am installing kube-prometheus-stack with Helm and I am adding some custome scraping configuration to Prometheus which requires authentication. I need to pass basic_auth with username and password in the values.yaml file.

The thing is that I need to commit the values.yaml file to a repo so I am wondering how can I have the username and password set on values file, maybe from a secret in Kubernetes or some other way?

prometheus:
  prometheusSpec:
    additionalScrapeConfigs:
      - job_name: myjob
        scrape_interval: 20s
        metrics_path: /metrics
        static_configs:
          - targets:
            - myservice.default.svc.cluster.local:80
        basic_auth:
          username: prometheus
          password: prom123456

1 answer

  • answered 2022-04-27 13:24 Andrew

    Scrape config support specifying password_file parameter, so you can mount your own secret in volumes and volumemMounts:

    Disclaimer, haven't tested it myself, not using a kube-prometheus-stack, but i guess something like this should work:

    prometheus:
      prometheusSpec:
        additionalScrapeConfigs:
          - job_name: myjob
            scrape_interval: 20s
            metrics_path: /metrics
            static_configs:
              - targets:
                - myservice.default.svc.cluster.local:80
            basic_auth:
              password_file: /etc/scrape_passwordfile
    
        # Additional volumes on the output StatefulSet definition.
        volumes:
        - name: scrape_passwordfile
          secret:
            secretName: scrape_passwordfile
            optional: false
    
        # Additional VolumeMounts on the output StatefulSet definition.
        volumeMounts:
        - name: scrape_passwordfile
          mountPath: "/etc/scrape_passwordfile"
    

    Another option is to ditch additionalScrapeConfigs and use additionalScrapeConfigsSecretto store whole config inside secret

        ## If additional scrape configurations are already deployed in a single secret file you can use this section.
        ## Expected values are the secret name and key
        ## Cannot be used with additionalScrapeConfigs
        additionalScrapeConfigsSecret: {}
          # enabled: false
          # name:
          # key:
    

How many English words
do you know?
Test your English vocabulary size, and measure
how many words do you know
Online Test
Powered by Examplum