From 5343526316a449e6929a55b9065851ba42dcc40a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Moritz=20J=C3=B6rg?= <moritz.jorg@oceanbox.io>
Date: Mon, 6 Jul 2026 09:27:19 +0200
Subject: [PATCH] prometheus: Sync secret on boot

---
 .../prometheus/values/prometheus.yaml.gotmpl  | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/values/prometheus/values/prometheus.yaml.gotmpl b/values/prometheus/values/prometheus.yaml.gotmpl
index 83e89838..522af2fc 100644
--- a/values/prometheus/values/prometheus.yaml.gotmpl
+++ b/values/prometheus/values/prometheus.yaml.gotmpl
@@ -108,6 +108,28 @@ grafana:
   defaultDashboardsEnabled: {{ .Values.prometheus.grafana.defaultDashboardsEnabled }}
   deploymentStrategy:
     type: Recreate
+  {{- if .Values.prometheus.grafana.persistence }}
+  # This init container re-syncs the DB admin password
+  # to the secret before Grafana starts, so the reload can never 401 again.
+  extraInitContainers:
+  - name: sync-admin-password
+    image: docker.io/grafana/grafana:13.0.1-security-01
+    command:
+    - /bin/sh
+    - -c
+    - grafana cli --homepath=/usr/share/grafana admin reset-admin-password "{{ `$GF_ADMIN_PW` }}" || true
+    env:
+    - name: GF_PATHS_DATA
+      value: /var/lib/grafana
+    - name: GF_ADMIN_PW
+      valueFrom:
+        secretKeyRef:
+          name: prometheus-grafana
+          key: admin-password
+    volumeMounts:
+    - name: storage
+      mountPath: /var/lib/grafana
+  {{- end }}
   {{- if or .Values.prometheus.grafana.plugins .Values.clickhouse.enabled }}
   plugins:
   {{- range .Values.prometheus.grafana.plugins }}