Skip to content

v1.4.2 — Grafana admin password mismatch fix

Choose a tag to compare

View all tags
@bogdandragosvasile bogdandragosvasile released this 20 Apr 10:54
· 9 commits to main since this release
v1.4.2
5a97993

Fix

The Grafana admin password stored in the monitoring-grafana Kubernetes Secret was the literal string `CHANGE_ME_from_env` instead of the value from `.env` — so any attempt to log into Grafana with the documented password failed.

Three gitops-repo manifests held a literal `CHANGE_ME_from_env` where a `${VAR}` placeholder belonged, and `GRAFANA_ADMIN_PASSWORD` was missing from the envsubst whitelist in `07-push-gitops-repo.sh`. Fixed:

  • `gitops-repo/manifests/monitoring/values.yaml` → `${GRAFANA_ADMIN_PASSWORD}`
  • `gitops-repo/apps/monitoring.yaml` → `${GRAFANA_ADMIN_PASSWORD}`
  • `gitops-repo/.gitea/workflows/validate.yaml` → `${GITEA_ADMIN_USER}:${GITEA_ADMIN_PASSWORD}`
  • `scripts/07-push-gitops-repo.sh` ENVSUBST_VARS → adds `${GRAFANA_ADMIN_PASSWORD}`
  • `scripts/10-configure-oidc.sh` ENVSUBST_VARS → adds `${GRAFANA_ADMIN_PASSWORD}`

Upgrading existing clusters

ArgoCD's repo-server caches helm manifest renders for ~3 minutes. After the upgrade push, flush the cache:

```bash
kubectl -n argocd rollout restart deploy argocd-repo-server
```

Then let ArgoCD re-sync the monitoring Application and restart Grafana to pick up the new password:

```bash
kubectl annotate application monitoring -n argocd argocd.argoproj.io/refresh=hard --overwrite
kubectl -n monitoring rollout restart deploy monitoring-grafana
```

Full changelog

See CHANGELOG.md.

Assets 2
Loading