<p>I provisioned alertmanager using Helm (and ArgoCD).
I need to insert smtp_auth_password value but not as a plain text.</p>

<pre><code>smtp_auth_username: 'apikey'
smtp_auth_password: $API_KEY
</code></pre>
<p>How can I achieve it? I heard about &quot;external secret&quot; but this should be the easiest way?</p>

<h3>Solution</h3>
<p>if you use <code>prometheus-community/prometheus</code> which includes this alertmanager <a href="https://github.com/prometheus-community/helm-charts/tree/main/charts/alertmanager" rel="nofollow noreferrer">chart</a> as a dependency, then you can do the following:</p>
<p><strong>create secret</strong> in the same namespace where your alertmanager pod is running:</p>
<pre class="lang-bash prettyprint-override"><code>k create secret generic alertmanager-secrets \
  --from-literal=&quot;opsgenie-api-key=YOUR-OPSGENIE-API-KEY&quot; \
  --from-literal=&quot;slack-api-url=https://hooks.slack.com/services/X03R2856W/A14T19TKEGM/....&quot;
</code></pre>
<p><strong>mount that secret</strong> via use of extraSecretMounts</p>
<pre class="lang-yaml prettyprint-override"><code>alertmanager:
  enabled: true
  service:
    annotations:
      prometheus.io/scrape: &quot;true&quot;  
  # contains secret values for opsgenie and slack receivers
  extraSecretMounts:
    - name: secret-files
      mountPath: /etc/secrets
      subPath: &quot;&quot;
      secretName: alertmanager-secrets
      readOnly: true
</code></pre>
<p><strong>use them in your receivers</strong>:</p>
<pre class="lang-yaml prettyprint-override"><code>receivers:
  - name: slack-channel
    slack_configs:
      - channel: '#client-ccf-ccl-alarms'
        api_url_file: /etc/secrets/slack-api-url &lt;-------------------THIS
        title: '{{ template &quot;default.title&quot; . }}'
        text: '{{ template &quot;default.description&quot; . }}'
        pretext: '{{ template &quot;slack.pretext&quot; . }}'
        color: '{{ template &quot;slack.color&quot; . }}'
        footer: '{{ template &quot;slack.footer&quot; . }}'
        send_resolved: true
        actions:
          - type: button
            text: &quot;Query :mag:&quot;
            url: '{{ template &quot;alert_query_url&quot; . }}'
          - type: button
            text: &quot;Silence :no_bell:&quot;
            url: '{{ template &quot;alert_silencer_url&quot; . }}'
          - type: button
            text: &quot;Karma UI :mag:&quot;
            url: '{{ template &quot;alert_karma_url&quot; . }}'
          - type: button
            text: &quot;Runbook :green_book:&quot;
            url: '{{ template &quot;alert_runbook_url&quot; . }}'
          - type: button
            text: &quot;Grafana :chart_with_upwards_trend:&quot;
            url: '{{ template &quot;alert_grafana_url&quot; . }}'
          - type: button
            text: &quot;KB :mag:&quot;
            url: '{{ template &quot;alert_kb_url&quot; . }}'

  - name: opsgenie
    opsgenie_configs:
      - send_resolved: true
        api_key_file: /etc/secrets/opsgenie-api-key &lt;-------------------THIS
        message: '{{ template &quot;default.title&quot; . }}'
        description: '{{ template &quot;default.description&quot; . }}'
        source: '{{ template &quot;opsgenie.default.source&quot; . }}'
        priority: '{{ template &quot;opsgenie.default.priority&quot; . }}'
        tags: '{{ template &quot;opsgenie.default.tags&quot; . }}'
</code></pre>
<p>If you want to use email functionality of <a href="https://prometheus.io/docs/alerting/latest/configuration/#email_config" rel="nofollow noreferrer">email_config</a>
then simply use the same approach with:</p>
<pre><code>[ auth_password_file: &lt;string&gt; | default = global.smtp_auth_password_file ]
</code></pre>
