<p>I was trying to login to Grafana deployed using <a href="https://prometheus-community.github.io/helm-charts" rel="nofollow noreferrer">https://prometheus-community.github.io/helm-charts</a> using the credentials <code>admin:admin</code> but it was failing.</p>
<p>I found out the correct credentials to login to Grafana from the secret <code>grafana</code> which is <code>admin:prom-operator</code>
To see from where this value is getting injected to the secret I went to the template files and values.yaml files available at <a href="https://github.com/grafana/helm-charts/tree/main/charts/grafana" rel="nofollow noreferrer">https://github.com/grafana/helm-charts/tree/main/charts/grafana</a></p>
<p>The <code>secret</code> files is written as:</p>
<pre><code>{{- if or (and (not .Values.admin.existingSecret) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD__FILE) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD) (not .Values.env.GF_SECURITY_DISABLE_INITIAL_ADMIN_CREATION)) (and .Values.ldap.enabled (not .Values.ldap.existingSecret)) }}
apiVersion: v1
kind: Secret
metadata:
  name: {{ include &quot;grafana.fullname&quot; . }}
  namespace: {{ include &quot;grafana.namespace&quot; . }}
  labels:
    {{- include &quot;grafana.labels&quot; . | nindent 4 }}
  {{- with .Values.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
type: Opaque
data:
  {{- if and (not .Values.env.GF_SECURITY_DISABLE_INITIAL_ADMIN_CREATION) (not .Values.admin.existingSecret) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD__FILE) (not .Values.env.GF_SECURITY_ADMIN_PASSWORD) }}
  admin-user: {{ .Values.adminUser | b64enc | quote }}
  {{- if .Values.adminPassword }}
  admin-password: {{ .Values.adminPassword | b64enc | quote }}
  {{- else }}
  admin-password: {{ include &quot;grafana.password&quot; . }}
  {{- end }}
  {{- end }}
  {{- if not .Values.ldap.existingSecret }}
  ldap-toml: {{ tpl .Values.ldap.config $ | b64enc | quote }}
  {{- end }}
{{- end }}
</code></pre>
<p>and part of the <code>values.yaml</code> file is written as</p>
<pre><code># Administrator credentials when not using an existing secret (see below)
adminUser: admin
# adminPassword: strongpassword

# Use an existing secret for the admin user.
admin:
  ## Name of the secret. Can be templated.
  existingSecret: &quot;&quot;
  userKey: admin-user
  passwordKey: admin-password
 
</code></pre>
<p>and the <code>_helpers.tml</code> contains</p>
<pre><code>{{/*
Looks if there's an existing secret and reuse its password. If not it generates
new password and use it.
*/}}
{{- define &quot;grafana.password&quot; -}}
{{- $secret := (lookup &quot;v1&quot; &quot;Secret&quot; (include &quot;grafana.namespace&quot; .) (include &quot;grafana.fullname&quot; .) ) }}
{{- if $secret }}
{{- index $secret &quot;data&quot; &quot;admin-password&quot; }}
{{- else }}
{{- (randAlphaNum 40) | b64enc | quote }}
{{- end }}
{{- end }}
</code></pre>
<p>which looks to me like the <code>admin-password</code> value is coming from the secret as it's not a random alphanumeric. This seems like a loop to me. Could you please explain to me how the default password value <code>prom-operator</code> is getting injected to the secret in the key <code>admin-password</code>?</p>

nidooooz
<p><strong>tl;dr</strong>: Value is set in <code>kube-prometheus-stack</code> values as <code>grafana.adminPassword</code> and passed to grafana subchart</p>
<p><code>kube-prometheus-stack</code> uses the the <code>grafana</code> chart as a depencency, so you have to take a look at both those values.yaml files.</p>
<p>In <code>kube-prometheus-stack</code>, there's a value for <code>grafana.adminPassword</code> set per default:</p>
<p><a href="https://github.com/prometheus-community/helm-charts/blob/b8b561eca1df7d70f0cc1e19e831ad58cb8c37f0/charts/kube-prometheus-stack/values.yaml#L877" rel="nofollow noreferrer">https://github.com/prometheus-community/helm-charts/blob/b8b561eca1df7d70f0cc1e19e831ad58cb8c37f0/charts/kube-prometheus-stack/values.yaml#L877</a></p>
<p>This is passed down to <code>grafana</code> where it's referenced as <code>.Values.adminPassword</code> (see <a href="https://helm.sh/docs/chart_template_guide/subcharts_and_globals/#overriding-values-from-a-parent-chart" rel="nofollow noreferrer">https://helm.sh/docs/chart_template_guide/subcharts_and_globals/#overriding-values-from-a-parent-chart</a>)</p>
<p>The <code>grafana</code> chart prefers this value over generating a random password with the helper block you listed. As it is passed from the parent chart <code>kube-prometheus-stack</code> and not empty, this value is used.</p>
<pre class="lang-yaml prettyprint-override"><code>  {{- if .Values.adminPassword }}
  admin-password: {{ .Values.adminPassword | b64enc | quote }}
  {{- else }}
  admin-password: {{ include &quot;grafana.password&quot; . }}
  {{- end }}
</code></pre>
<p><a href="https://github.com/grafana/helm-charts/blob/de3a51251f5b4fdd93715ba47d0065b282761a79/charts/grafana/templates/secret.yaml#L17-L21" rel="nofollow noreferrer">https://github.com/grafana/helm-charts/blob/de3a51251f5b4fdd93715ba47d0065b282761a79/charts/grafana/templates/secret.yaml#L17-L21</a></p>
