How to pass sensitive data to helm values file that is committed?

I am installing kube-prometheus-stack with Helm and I am adding some custome scraping configuration to Prometheus which requires authentication. I need to pass basic_auth with username and password in the values.yaml file.

The thing is that I need to commit the values.yaml file to a repo so I am wondering how can I have the username and password set on values file, maybe from a secret in Kubernetes or some other way?

prometheus:
  prometheusSpec:
    additionalScrapeConfigs:
      - job_name: myjob
        scrape_interval: 20s
        metrics_path: /metrics
        static_configs:
          - targets:
            - myservice.default.svc.cluster.local:80
        basic_auth:
          username: prometheus
          password: prom123456

Solution

Scrape config support specifying password_file parameter, so you can mount your own secret in volumes and volumemMounts:

Disclaimer, haven't tested it myself, not using a kube-prometheus-stack, but i guess something like this should work:

prometheus:
  prometheusSpec:
    additionalScrapeConfigs:
      - job_name: myjob
        scrape_interval: 20s
        metrics_path: /metrics
        static_configs:
          - targets:
            - myservice.default.svc.cluster.local:80
        basic_auth:
          password_file: /etc/scrape_passwordfile

    # Additional volumes on the output StatefulSet definition.
    volumes:
    - name: scrape_passwordfile
      secret:
        secretName: scrape_passwordfile
        optional: false

    # Additional VolumeMounts on the output StatefulSet definition.
    volumeMounts:
    - name: scrape_passwordfile
      mountPath: "/etc/scrape_passwordfile"

Another option is to ditch additionalScrapeConfigs and use additionalScrapeConfigsSecretto store whole config inside secret

    ## If additional scrape configurations are already deployed in a single secret file you can use this section.
    ## Expected values are the secret name and key
    ## Cannot be used with additionalScrapeConfigs
    additionalScrapeConfigsSecret: {}
      # enabled: false
      # name:
      # key: