From 89fa87f7c16d4065e7068795e2faf3a45ead7277 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Mon, 20 Jul 2026 23:07:51 -0700
Subject: [PATCH] =?UTF-8?q?fix(sops-cmp):=20grafana-admin=20secret=20needs?=
 =?UTF-8?q?=20admin-user=20key=20too=20=E2=80=94=20chart=20existingSecret?=
 =?UTF-8?q?=20requires=20both=20user=20and=20password?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 k8s/security/ci-cd/sops-cmp-plugin.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/k8s/security/ci-cd/sops-cmp-plugin.yaml b/k8s/security/ci-cd/sops-cmp-plugin.yaml
index bb40815..f3f2a20 100644
--- a/k8s/security/ci-cd/sops-cmp-plugin.yaml
+++ b/k8s/security/ci-cd/sops-cmp-plugin.yaml
@@ -60,7 +60,9 @@ data:
 
     # ── grafana (logging) ──────────────────────────────────────────────
     DEC="$(sops -d "$REPO_ROOT/k8s/platform/logging/grafana-secrets.enc.yaml")"
-    emit_secret logging grafana-admin \
-      admin-password=.adminPassword
+    # grafana chart's admin.existingSecret needs BOTH admin-user and admin-password.
+    printf 'apiVersion: v1\nkind: Secret\nmetadata:\n  name: grafana-admin\n  namespace: logging\ntype: Opaque\ndata:\n  admin-user: %s\n  admin-password: %s\n---\n' \
+      "$(printf 'admin' | base64 -w0)" \
+      "$(echo "$DEC" | yq -r '.adminPassword' | base64 -w0)"
     emit_secret logging grafana-oidc \
       GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=.env.GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET