# Template: copy to secret.yaml (gitignored) and fill in the values.
#   make secret
apiVersion: v1
kind: Secret
metadata:
  name: observability-secrets
  namespace: observability
type: Opaque
stringData:
  GF_SECURITY_ADMIN_USER: admin
  GF_SECURITY_ADMIN_PASSWORD: <CHANGE_ME>
  # Token of a Grafana service account, created once with the admin credentials:
  #   POST /api/serviceaccounts        {"name":"mcp-grafana","role":"Viewer"}
  #   POST /api/serviceaccounts/<id>/tokens  {"name":"mcp-grafana-token"}
  # Grafana returns the value once, at creation. Viewer is enough to query the
  # datasources and list dashboards; raise it only if a tool needs writes.
  GRAFANA_SERVICE_ACCOUNT_TOKEN: glsa_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx