# Referring to K8s Secret from Grafana's YAML?

**URL:** <https://community.grafana.com/t/referring-to-k8s-secret-from-grafanas-yaml/145579>\
**Category:** Grafana\
**Tags:** alerting\
**Created:** [March 5, 2025, 10:23am UTC](https://community.grafana.com/t/referring-to-k8s-secret-from-grafanas-yaml/145579 "2025-03-05T10:23:06Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![vanilladonut](https://avatars.discourse-cdn.com/v4/letter/v/eb8c5e/32.png) [@vanilladonut](https://community.grafana.com/u/vanilladonut)\
**Post date:** [March 5, 2025, 10:23am UTC](https://community.grafana.com/t/referring-to-k8s-secret-from-grafanas-yaml/145579/1 "2025-03-05T10:23:06Z")

</div>

How can a K8s Secret be referenced from Grafana’s (v10.4.0, 03f502a94d) YAML, when provisioning alerting?

I already have a working config (f.e. for `datasources`, `dashboardProviders`, etc.) which I’d like to now expand with the `alerting` section, but without storing secrets in plaintext:

```auto
alerting:
  contactpoints.yaml:
      secret:
        apiVersion: 1
        contactPoints:
          - orgId: 1
            name: foo
            receivers:
              - uid: bar
                type: slack
                secure_settings:
# Should `token` (below) be moved here? 
# (How) can a K8s Secret be referenced?
                  token: my-k8s-grafana-secret?
                settings:
                  recipient: devs
                  token: xxx
                  username: bot
                  # etc. 

```

[The docs](https://grafana.com/docs/grafana/latest/administration/provisioning/#supported-settings) merely say

> Secure settings are stored encrypted in the database and you add them to `secure_settings` in the YAML file instead of `settings`.

but it’s not clear, to me at least, how to avoid exposing the secret (`token` above).