# =============================================================================
# TEMPLATE — NOT APPLIED, NOT ENCRYPTED (.yaml.example is ignored by kustomize
# and never auto-encrypted by SOPS). Reference scaffold only.
#
# (a) Copy to:      platform/monitoring/grafana-admin-credentials.sops.yaml
# (b) kustomization: add this line under `resources:` in
#                    platform/monitoring/kustomization.yaml
#                       - grafana-admin-credentials.sops.yaml
# (c) Encrypt:       sops -e -i platform/monitoring/grafana-admin-credentials.sops.yaml
# (d) Consumed by:   kube-prometheus-stack -> grafana.admin.existingSecret
#                    (userKey: admin-user, passwordKey: admin-password). [Phase 4]
# =============================================================================
apiVersion: v1
kind: Secret
metadata:
  name: grafana-admin-credentials
  namespace: monitoring
type: Opaque
stringData:
  admin-user: admin
  admin-password: REPLACE-ME