diff --git a/ansible/roles/kubernetes_prometheus/defaults/main.yaml b/ansible/roles/kubernetes_prometheus/defaults/main.yaml
new file mode 100644
index 0000000..890f8d1
--- /dev/null
+++ b/ansible/roles/kubernetes_prometheus/defaults/main.yaml
@@ -0,0 +1,51 @@
+prometheus_chart_version: 86.3.2
+
+prometheus_values:
+  grafana:
+    enabled: true
+    adminPassword: password
+    envFromSecrets:
+      - name: grafana-oidc-secret
+    ingress:
+      enabled: true
+      ingressClassName: traefik
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt
+      hosts:
+        - grafana.solidish.dev
+      tls:
+        - secretName: grafana-solidish-dev-tls
+          hosts:
+            - grafana.solidish.dev
+    grafana.ini:
+      server:
+        root_url: https://grafana.solidish.dev
+      auth.generic_oauth:
+        enabled: true
+        name: Authentik
+        client_id: $__env{GRAFANA_OIDC_CLIENT_ID}
+        client_secret: $__env{GRAFANA_OIDC_CLIENT_SECRET}
+        scopes: openid profile email
+        auth_url: https://auth.solidish.dev/application/o/authorize/
+        token_url: https://auth.solidish.dev/application/o/token/
+        api_url: https://auth.solidish.dev/application/o/userinfo/
+        role_attribute_path: contains(groups, 'admin') && 'Admin' || 'Viewer'
+        allow_assign_grafana_admin: true
+  alertmanager:
+    enabled: false
+  prometheus:
+    prometheusSpec:
+      retention: 30d
+      storageSpec:
+        volumeClaimTemplate:
+          spec:
+            accessModes: ["ReadWriteOnce"]
+            resources:
+              requests:
+                storage: 10Gi
+      resources:
+        requests:
+          cpu: 100m
+          memory: 512Mi
+        limits:
+          memory: 2Gi
diff --git a/ansible/roles/kubernetes_prometheus/tasks/main.yaml b/ansible/roles/kubernetes_prometheus/tasks/main.yaml
new file mode 100644
index 0000000..48613b3
--- /dev/null
+++ b/ansible/roles/kubernetes_prometheus/tasks/main.yaml
@@ -0,0 +1,25 @@
+- name: Ensure Grafana OIDC secret exists
+  kubernetes.core.k8s:
+    state: present
+    definition:
+      apiVersion: v1
+      kind: Secret
+      metadata:
+        name: grafana-oidc-secret
+        namespace: monitoring
+      type: Opaque
+      stringData:
+        GRAFANA_OIDC_CLIENT_ID: "{{ lookup('proton_pass', item_title='Grafana OIDC', vault_name='Home Lab', field='Client ID') }}"
+        GRAFANA_OIDC_CLIENT_SECRET: "{{ lookup('proton_pass', item_title='Grafana OIDC', vault_name='Home Lab', field='Client secret') }}"
+  no_log: true
+  run_once: true
+
+- name: Ensure kube-prometheus-stack is installed
+  kubernetes.core.helm:
+    release_name: prometheus
+    release_namespace: monitoring
+    chart_ref: oci://ghcr.io/prometheus-community/charts/kube-prometheus-stack
+    chart_version: "{{ prometheus_chart_version }}"
+    create_namespace: true
+    values: "{{ prometheus_values }}"
+  run_once: true