<p>I am installing <code>kube-prometheus-stack</code> with Helm and I am adding some custome scraping configuration to Prometheus which requires authentication. I need to pass <code>basic_auth</code> with <code>username</code> and <code>password</code> in the <code>values.yaml</code> file.</p>
<p>The thing is that I need to commit the <code>values.yaml</code> file to a repo so I am wondering how can I have the username and password set on values file, maybe from a secret in Kubernetes or some other way?</p>
<pre class="lang-yaml prettyprint-override"><code>prometheus:
  prometheusSpec:
    additionalScrapeConfigs:
      - job_name: myjob
        scrape_interval: 20s
        metrics_path: /metrics
        static_configs:
          - targets:
            - myservice.default.svc.cluster.local:80
        basic_auth:
          username: prometheus
          password: prom123456
</code></pre>

<p><a href="https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config" rel="nofollow noreferrer">Scrape config</a> support specifying <code>password_file</code> parameter, so you can mount your own secret in volumes and volumemMounts:</p>
<p>Disclaimer, haven't tested it myself, not using a kube-prometheus-stack, but i guess something like this should work:</p>
<pre class="lang-yaml prettyprint-override"><code>prometheus:
  prometheusSpec:
    additionalScrapeConfigs:
      - job_name: myjob
        scrape_interval: 20s
        metrics_path: /metrics
        static_configs:
          - targets:
            - myservice.default.svc.cluster.local:80
        basic_auth:
          password_file: /etc/scrape_passwordfile

    # Additional volumes on the output StatefulSet definition.
    volumes:
    - name: scrape_passwordfile
      secret:
        secretName: scrape_passwordfile
        optional: false

    # Additional VolumeMounts on the output StatefulSet definition.
    volumeMounts:
    - name: scrape_passwordfile
      mountPath: &quot;/etc/scrape_passwordfile&quot;
</code></pre>
<p>Another option is to ditch <code>additionalScrapeConfigs</code> and use <code>additionalScrapeConfigsSecret</code>to store whole config inside secret</p>
<pre class="lang-yaml prettyprint-override"><code>    ## If additional scrape configurations are already deployed in a single secret file you can use this section.
    ## Expected values are the secret name and key
    ## Cannot be used with additionalScrapeConfigs
    additionalScrapeConfigsSecret: {}
      # enabled: false
      # name:
      # key:
</code></pre>
