# NO LONGER APPLIED. observability-secrets now comes from Vault through
# External Secrets — see k8s/secrets/. This file is kept only to document
# which keys the stack expects and where they live.
#
# Vault path: secrets/observability/grafana
#   GF_SECURITY_ADMIN_USER
#   GF_SECURITY_ADMIN_PASSWORD
#   GRAFANA_SERVICE_ACCOUNT_TOKEN   token of the 'mcp-grafana' service
#     account, Viewer role. Grafana returns it once, at creation:
#       POST /api/serviceaccounts             {"name":"mcp-grafana","role":"Viewer"}
#       POST /api/serviceaccounts/<id>/tokens {"name":"mcp-grafana-token"}
#
# The ExternalSecret pulls the whole path, so adding a key in Vault reaches
# the cluster without editing anything here.