Pull from crunchy secret.

kubernetes/apps/observability/grafana/app/externalsecret.yaml

@@ -20,8 +20,8 @@ spec:
         GF_SERVER_ROOT_URL: https://grafana.hsn.dev
         GF_DATABASE_NAME: ${DB_NAME}
         GF_DATABASE_HOST: "grafana-primary.observability.svc:5432"
-        GF_DATABASE_USER: "{{ .grafana_postgres_user }}"
-        GF_DATABASE_PASSWORD: "{{ .grafana_postgres_password }}"
+        # GF_DATABASE_USER: "{{ .grafana_postgres_user }}"
+        # GF_DATABASE_PASSWORD: "{{ .grafana_postgres_password }}"
         GF_DATABASE_SSL_MODE: "require"
         GF_DATABASE_TYPE: postgres
         GF_ANALYTICS_CHECK_FOR_UPDATES: "false"

kubernetes/apps/observability/grafana/app/helmrelease.yaml

@@ -31,6 +31,17 @@ spec:
   values:
     replicas: 2
     envFromSecret: grafana-secret
+    env:
+      - name: GF_DATABASE_USER
+        valueFrom:
+          secretKeyRef:
+            name: grafana-pguser-grafana
+            key: user
+      - name: GF_DATABASE_PASSWORD
+        valueFrom:
+          secretKeyRef:
+            name: grafana-pguser-grafana
+            key: password
     dashboardProviders:
       dashboardproviders.yaml:
         apiVersion: 1