Charts: [stable/grafana] admin password secret changes on helm upgrade

[charlspjohn]

Hi all,
The helm chart for grafana changes admin password on helm upgrade. But it is only updating the secret value rather than actualy changing the admin passowrd. In my opinion for helm upgrade it should not change admin password

[scottrigby]

See https://github.com/helm/charts/issues/5167

[giacomoguiulfo]

You can always add an annotation that looks like this:
checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
to upgrade the Grafana deployment everytime the secret changes.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Any further update will cause the issue/pull request to no longer be considered stale. Thank you for your contributions.

[dtshepherd]

Probably just need to upgrade grafana to something like this: https://github.com/helm/charts/issues/5167#issuecomment-428143961

At least until https://github.com/helm/helm/issues/3053#issuecomment-422945888 is implemented. This really sucks, because grafana only loads the admin password once, so after one upgrade, you lose the admin password forever.

[rubberduck203]

FWIW, this is pretty easy to work around by retrieving the "current" password from the kube secrets and then running an exec command to execute the grafana-cli admin reset-admin-password command.

kubectl get secret prometheus-grafana -o jsonpath='{.data.admin-password}' \
| base64 --decode \
| xargs -I {} kubectl exec -it prometheus-grafana-0 -- grafana-cli admin reset-admin-password --homepath /usr/share/grafana {}

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Any further update will cause the issue/pull request to no longer be considered stale. Thank you for your contributions.

[dtshepherd]

Still would like to see this fixed...

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Any further update will cause the issue/pull request to no longer be considered stale. Thank you for your contributions.

[stale[bot]]

This issue is being automatically closed due to inactivity.

[gregwebs]

You can create your own password in K8s now to avoid issues with helm. A downside is that it won't be deleted when you delete your helm chart, but that's not much of a concern if you are always generating new passwords.

secret="grafana-password"
kubectl --namespace grafana create secret generic "$secret" \
   --from-literal=admin-user=admin --from-literal=admin-password=admin
helm install stable/grafana -f grafana.yaml --namespace grafana \
  --set admin.existingSecret="$secret"

[wuestkamp]

I had to change @rubberduck203 comment because the --homepath option had to be used not atfer reset-admin-password but before. In the end this worked for me:

kubectl -n grafana get secret grafana -o jsonpath='{.data.admin-password}' \
| base64 --decode \
| xargs -I {} kubectl -n grafana exec -it grafana-6f9bd94d5d-k225s -- grafana-cli --homepath /usr/share/grafana admin reset-admin-password {}

Where grafana-6f9bd94d5d-k225s is a pod of the grafana deployment

[poochwashere]

To make it pod name idempotent try to use labels to resolve the pod name.

kubectl get secret grafana -o jsonpath='{.data.admin-password}' \
| base64 --decode \
| xargs -I {} kubectl exec -it $(kubectl get pod -l "app=grafana" -o jsonpath='{.items[0].metadata.name}') -c grafana -- grafana-cli --homepath /usr/share/grafana admin reset-admin-password  {}