prometheus: Sync secret on boot

values/prometheus/values/prometheus.yaml.gotmpl

@@ -108,6 +108,28 @@ grafana:
   defaultDashboardsEnabled: {{ .Values.prometheus.grafana.defaultDashboardsEnabled }}
   deploymentStrategy:
     type: Recreate
+  {{- if .Values.prometheus.grafana.persistence }}
+  # This init container re-syncs the DB admin password
+  # to the secret before Grafana starts, so the reload can never 401 again.
+  extraInitContainers:
+  - name: sync-admin-password
+    image: docker.io/grafana/grafana:13.0.1-security-01
+    command:
+    - /bin/sh
+    - -c
+    - grafana cli --homepath=/usr/share/grafana admin reset-admin-password "{{ `$GF_ADMIN_PW` }}" || true
+    env:
+    - name: GF_PATHS_DATA
+      value: /var/lib/grafana
+    - name: GF_ADMIN_PW
+      valueFrom:
+        secretKeyRef:
+          name: prometheus-grafana
+          key: admin-password
+    volumeMounts:
+    - name: storage
+      mountPath: /var/lib/grafana
+  {{- end }}
   {{- if or .Values.prometheus.grafana.plugins .Values.clickhouse.enabled }}
   plugins:
   {{- range .Values.prometheus.grafana.plugins }}