Skip to content

[kube-prometheus-stack] Fix insecure default password in grafana #5679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 16 commits into from
Oct 27, 2025
Merged

[kube-prometheus-stack] Fix insecure default password in grafana #5679

merged 16 commits into from
Oct 27, 2025
+20 −2

Conversation

@robalb
Copy link
Contributor

@robalb robalb commented May 24, 2025

What this PR does / why we need it

As of now, the kubeprometheus-stack chart defines a default admin password for Grafana: "prom-operator".
By doing so, it's overriding the more secure default default behavior of the upstream Grafana chart, which simply generates a random password when none is set. 1

It's common practice for both bad actors and security scanners to attempt known default passwords on accidentally exposed instances. For example, see this nuclei template, which demonstrates that this default password is well known in security circles.

This PR removes the default password, aligning the default behaviour with upstream Grafana.

Which issue this PR fixes

Special notes for your reviewer

Checklist

  • DCO signed
  • Chart Version bumped
  • Title of the PR starts with chart name (e.g. [prometheus-couchdb-exporter])

@jkroepke
Copy link
Member

Thanks! Could you please bump the major version instead and add a note in the UPGRADE.md?

@robalb
Copy link
Contributor Author

robalb commented May 25, 2025

Thanks! Could you please bump the major version instead and add a note in the UPGRADE.md?

Right, thanks! I documented the changes and included a link to the Grafana documentation on how to retrieve the password

@rouke-broersma
Copy link
Contributor

rouke-broersma commented May 26, 2025 •
edited
Loading

I think a note should be added in the install instructions warning users of gitops tooling that if they don't set a default password manually their gitops tooling is likely to overwrite the secret on next sync, at which point the secret in the cluster will no longer work and they will have to follow a recovery procedure.

@jkroepke
Copy link
Member

I think a note should be added in the install instructions warning users of gitops tooling that if they don't set a default password manually their gitops tooling is likely to overwrite the secret on next sync, at which point the secret in the cluster will no longer work and they will have to follow a recovery procedure.

Latest Versions of ArgoCD should support the helm lookup function.

@rouke-broersma
Copy link
Contributor

@jkroepke I can only find this enhancement proposal which hasn't been approved: argoproj/argo-cd#21745

Can you link me the relevant page that explains helm lookup working in argocd? That would make my day.

@jkroepke
Copy link
Member

Okay, FluxCD support that and I thought ArgoCD does it as well. My issue.

I agree with an warning on UPGRAING.

Would be it possible to mimic this as well?

https://github.com/grafana/helm-charts/blob/72a7caf12f61cd5e7d82acbe586fb1e9c0bce2f6/charts/grafana/templates/NOTES.txt#L1-L3

@stale
Copy link

stale bot commented Jul 18, 2025

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Any further update will cause the issue/pull request to no longer be considered stale. Thank you for your contributions.

@stale stale bot removed the lifecycle/stale label Oct 12, 2025
@jkroepke
Update NOTES.txt with Grafana password retrieval
9830f5e 
Added instructions to retrieve Grafana admin password.

Signed-off-by: Jan-Otto Kröpke <[email protected]>
jkroepke
jkroepke reviewed Oct 12, 2025
View reviewed changes
jkroepke
jkroepke reviewed Oct 12, 2025
View reviewed changes
jkroepke
jkroepke reviewed Oct 13, 2025
View reviewed changes
This was referenced Oct 17, 2025
Closed
Merged
jkroepke
jkroepke reviewed Oct 24, 2025
View reviewed changes
@jkroepke jkroepke self-assigned this Oct 24, 2025
@jkroepke
Copy link
Member

@QuentinBisson @GMartinez-Sisti Could you please review it? Tested locally.

QuentinBisson
QuentinBisson previously approved these changes Oct 24, 2025
View reviewed changes
Copy link
Member

@QuentinBisson QuentinBisson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apart from the small typo it looks good to me

@QuentinBisson
Copy link
Member

@jkroepke Can you fix the typo and we can get this merged?

@robalb
Fix typo in UPGRADE.md
4cb6b22 
Signed-off-by: alberto ventafridda <[email protected]>
@robalb
Copy link
Contributor Author

robalb commented Oct 24, 2025

Hi everyone, nice to see that this is moving ahead.
We should probably add these notes, as suggested by #5679 (comment)

a note should be added in the install instructions warning users of gitops tooling that if they don't set a default password manually their gitops tooling is likely to overwrite the secret on next sync, at which point the secret in the cluster will no longer work and they will have to follow a recovery procedure.

jkroepke
jkroepke previously approved these changes Oct 24, 2025
View reviewed changes
Copy link
Member

@jkroepke jkroepke left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@jkroepke
Copy link
Member

@robalb As I know, the

Hi everyone, nice to see that this is moving ahead. We should probably add these notes, as suggested by #5679 (comment)

a note should be added in the install instructions warning users of gitops tooling that if they don't set a default password manually their gitops tooling is likely to overwrite the secret on next sync, at which point the secret in the cluster will no longer work and they will have to follow a recovery procedure.

Note sure about this, both ArgoCD and Flux are able to handle this.

@QuentinBisson
Copy link
Member

@jkroepke Are we fine merging this? We can always update the README if we see failing case but as you said it should be fine :)

@jkroepke jkroepke merged commit c215211 into prometheus-community:main Oct 27, 2025
6 checks passed
alexlebens pushed a commit to alexlebens/infrastructure that referenced this pull request Oct 28, 2025
@alexlebens
Update kube-prometheus-stack Docker tag to v79 (#1878)
2c57bff 
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [kube-prometheus-stack](https://github.com/prometheus-operator/kube-prometheus) ([source](https://github.com/prometheus-community/helm-charts)) | major | `78.5.0` -> `79.0.0` |

---

### Release Notes

<details>
<summary>prometheus-community/helm-charts (kube-prometheus-stack)</summary>

### [`v79.0.0`](https://github.com/prometheus-community/helm-charts/releases/tag/kube-prometheus-stack-79.0.0)

[Compare Source](prometheus-community/helm-charts@kube-prometheus-stack-78.5.0...kube-prometheus-stack-79.0.0)

kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator.

#### What's Changed

- \[kube-prometheus-stack]  Fix insecure default password in grafana by [@&#8203;robalb](https://github.com/robalb) in [#&#8203;5679](prometheus-community/helm-charts#5679)

#### New Contributors

- [@&#8203;robalb](https://github.com/robalb) made their first contribution in [#&#8203;5679](prometheus-community/helm-charts#5679)

**Full Changelog**: <prometheus-community/helm-charts@prometheus-conntrack-stats-exporter-0.5.28...kube-prometheus-stack-79.0.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xNTUuNSIsInVwZGF0ZWRJblZlciI6IjQxLjE1NS41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJpbWFnZSJdfQ==-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1878
Co-authored-by: Renovate Bot <[email protected]>
Co-committed-by: Renovate Bot <[email protected]>
KoenDierckx pushed a commit to KoenDierckx/prometheus-community-helm-charts that referenced this pull request Oct 28, 2025
@robalb @jkroepke
@QuentinBisson @KoenDierckx
[kube-prometheus-stack] Fix insecure default password in grafana (pro…
90c868a 
…metheus-community#5679)

Co-authored-by: Jan-Otto Kröpke <[email protected]>
Co-authored-by: Quentin Bisson <[email protected]>
Signed-off-by: DIERCKXK <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jkroepke jkroepke jkroepke approved these changes

@QuentinBisson QuentinBisson QuentinBisson approved these changes

@GMartinez-Sisti GMartinez-Sisti Awaiting requested review from GMartinez-Sisti GMartinez-Sisti is a code owner

@Xtigyro Xtigyro Awaiting requested review from Xtigyro Xtigyro is a code owner

@andrewgkew andrewgkew Awaiting requested review from andrewgkew andrewgkew is a code owner

@gianrubio gianrubio Awaiting requested review from gianrubio gianrubio is a code owner

@gkarthiks gkarthiks Awaiting requested review from gkarthiks gkarthiks is a code owner

@scottrigby scottrigby Awaiting requested review from scottrigby scottrigby is a code owner

Assignees

@jkroepke jkroepke

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[kube-prometheus-stack] Set default grafana password to 'admin'?

5 participants

@robalb @jkroepke @rouke-broersma @QuentinBisson @GMartinez-Sisti