[kube-prometheus-stack] Grafana additional data source basicAuthPassword not picked up

[malek-delphai]

Describe the bug a clear and concise description of what the bug is.

When adding Grafana additionalDataSources, the sources are added and configured as expected once checked from the UI except for the basicAuthPassword which is not picked up at all (shown as empty/not configured in the data sources tab) which of course makes the connection to the data source (e.g., Prometheus) fail. Adding the password manually naturally solves it. Is there an explanation to this?

What's your helm version?

version.BuildInfo{Version:"v3.13.1", GitCommit:"3547a4b5bf5edb5478ce352e18858d8a552a4110", GitTreeState:"clean", GoVersion:"go1.21.3"}

What's your kubectl version?

Client Version: version.Info{Major:"1", Minor:"26", GitVersion:"v1.26.1", GitCommit:"8f94681cd294aa8cfd3407b8191f6c70214973a4", GitTreeState:"clean", BuildDate:"2023-01-18T15:51:24Z", GoVersion:"go1.19.5", Compiler:"gc", Platform:"darwin/arm64"} Kustomize Version: v4.5.7 Server Version: version.Info{Major:"1", Minor:"26", GitVersion:"v1.26.6", GitCommit:"7ffcdf755d47c73903854cc5955afcdcd8c95225", GitTreeState:"clean", BuildDate:"2023-10-09T14:43:34Z", GoVersion:"go1.19.10", Compiler:"gc", Platform:"linux/amd64"}

Which chart?

kube-prometheus-stack

What's the chart version?

51.9.4

What happened?

basicAuthPassword is shown as empty/not configured in the data sources Grafana tab, but it shows up in the configuration inside the grafana datasources container

What you expected to happen?

Have the password picked up from values.yaml

How to reproduce it?

No response

Enter the changed values of values.yaml?

No response

Enter the command that you execute and failing/misfunctioning.

helm upgrade --install kube-prometheus-stack prometheus-community/kube-prometheus-stack -n monitoring --reuse-values -f monitoring/prom_values.yaml

Anything else we need to know?

No response

[zeritti]

When adding Grafana additionalDataSources, the sources are added and configured as expected once checked from the UI except for the basicAuthPassword which is not picked up at all (shown as empty/not configured in the data sources tab) which of course makes the connection to the data source (e.g., Prometheus) fail. Adding the password manually naturally solves it. Is there an explanation to this?

basicAuthPassword is expected in the secureJsonData field. Please, see datasource config file and secureJsonData.

[riosje]

Thanks @zeritti it makes sense to use secureJsonData as you mentions and it works. Any person could lead to this issue due to some wrong documentation in the values.yaml of the helm chart. they propose to use the basicAuthPassword on top of the datasource object not within secureJsonData see here the example

Instead of that example it should be implemented like this

  - name: prometheus-sample
     access: proxy
     basicAuth: true
     basicAuthUser: daco
     editable: false
     jsonData:
       tlsSkipVerify: true
     secureJsonData:
       basicAuthPassword: pass
     orgId: 1
     type: prometheus
     url: https://{{ printf "%s-prometheus.svc" .Release.Name }}:9090
     version: 1