Grafana's read-only InfluxDB token is made automatically

The read-only token for Grafana needed a manual influx command and a
Secret. InfluxDB generates every token but the admin one and ignores a
chosen value (tested on 2.7.12), so it cannot be preset in a Secret.

Instead an init container in the Grafana pod creates it at every start
with the admin token, deletes the one from the previous start, and
writes only the read-only token to a memory-backed volume; the
provisioned datasource reads it with $__file{/run/influx/token}. The
Grafana process never sees the admin token. The grafana-influx Secret
is gone from the template and the README.

Tested in podman: InfluxDB 2.7.12, the script run twice as the Grafana
user (the old token is replaced, not piled up), and Grafana 13.2.3
reporting the datasource healthy with the file-based token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/README.md

@@ -22,8 +22,8 @@ is applied automatically. Apply them yourself.
    covered by Traefik's default certificate.
 2. **Create the Secrets.** `cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml` (gitignored), replace
    every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token,
-   approval password for pairing), `grafana-admin` and
-   `grafana-influx` (see below). Keep the template itself on placeholders only.
+   approval password for pairing, the forge token for app updates) and `grafana-admin`.
+   Keep the template itself on placeholders only.
 3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
    secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.
 
@@ -40,25 +40,11 @@ ConfigMaps (datasource and dashboards) are never created and Grafana does not st
 
 ## Grafana's InfluxDB token
 
-Grafana reads InfluxDB with a token that can only read the `mg4` bucket, from the
-`grafana-influx` Secret. InfluxDB has to create that token, so it is a step of its own:
-
-1. With InfluxDB running, create the token. The `influx` CLI in the pod is already signed in
-   as admin:
-
-   ```sh
-   kubectl -n mg4 exec influxdb-0 -- sh -c \
-     'influx auth create --org mg4 --description grafana-read-only --json \
-        --read-bucket "$(influx bucket find --name mg4 --hide-headers | cut -f1)"'
-   ```
-
-2. Copy the `"token"` value from the output into `grafana-influx` → `token` in
-   `k8s/secrets/secrets.yaml`, apply that file, and restart Grafana:
-   `kubectl -n mg4 rollout restart deployment/grafana`.
-
-Until the Secret exists, Grafana does not start (the container waits for the missing Secret).
-On a fresh install, apply everything once without Grafana working, create the token, then
-apply the Secret.
+Grafana reads InfluxDB with a token that can only read the `mg4` bucket. Nothing to do: an init
+container in the Grafana pod creates it at every start with the admin token, deletes the one
+from the previous start, and hands Grafana only the read-only token (in a memory-backed volume).
+The Grafana process itself never sees the admin token. InfluxDB generates every token but the
+admin one itself, which is why this cannot be a value in the Secret.
 
 ## App updates
 
@@ -73,7 +59,7 @@ and `FORGE_REPO` are set in `server.yaml`.
 - InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later
   does not change the token inside InfluxDB.
 - The server uses the InfluxDB admin token; a token scoped to read/write on the `mg4` bucket can
-  replace it later. Grafana has its own read-only token (below).
+  replace it later. Grafana has its own read-only token (above).
 - The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
   ConfigMap name changes with its content, which rolls Grafana.
 - The server image is pinned by digest in `server.yaml`. To upgrade, push a new tag and put its

k8s/grafana.yaml

@@ -1,6 +1,12 @@
 # Grafana for the dashboards. The InfluxDB datasource and the three MG4 dashboards are
 # provisioned from k8s/grafana/ (ConfigMaps generated by kustomization.yaml); the dashboards
 # are read-only in the UI — change the JSON in git instead.
+#
+# Grafana reads InfluxDB with a token that can only read the mg4 bucket. InfluxDB generates
+# every token but the admin one (a chosen value is ignored), so the init container makes it at
+# each start: it alone gets the admin token, creates a fresh read-only token, deletes the one
+# from the previous start, and leaves only the read-only token in a memory-backed volume for
+# Grafana. Nothing to do by hand, and the Grafana process never sees the admin token.
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
@@ -44,6 +50,46 @@ spec:
         fsGroup: 472
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        - name: influx-read-token
+          image: docker.io/library/influxdb:2.7.12-alpine
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              desc="grafana read-only (made by the Grafana pod at start)"
+              export INFLUX_CONFIGS_PATH=/tmp/influx-configs
+              bucket=$(influx bucket find --name mg4 --hide-headers | cut -f1)
+              old=$(influx auth list --hide-headers | awk -F'\t' -v d="$desc" '$2 == d { print $1 }')
+              token=$(influx auth create --description "$desc" --read-bucket "$bucket" --hide-headers | cut -f3)
+              [ -n "$token" ] || { echo "no token created" >&2; exit 1; }
+              printf '%s' "$token" > /run/influx/token
+              for id in $old; do influx auth delete --id "$id" > /dev/null; done
+              echo "read-only token for Grafana ready"
+          env:
+            - name: INFLUX_HOST
+              value: http://influxdb.mg4.svc:8086
+            - name: INFLUX_ORG
+              value: mg4
+            - name: INFLUX_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: influxdb-auth
+                  key: admin-token
+          volumeMounts:
+            - name: influx-token
+              mountPath: /run/influx
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
       containers:
         - name: grafana
           image: docker.io/grafana/grafana:13.2.3
@@ -68,16 +114,9 @@ spec:
               value: "false"
             - name: GF_ANALYTICS_CHECK_FOR_UPDATES
               value: "false"
-            # Read by datasources.yaml.
+            # Read by datasources.yaml; the token is the file the init container wrote.
             - name: INFLUX_URL
               value: http://influxdb.mg4.svc:8086
-            # Read-only on the mg4 bucket; the dashboards never write (README, "Grafana's
-            # InfluxDB token").
-            - name: INFLUX_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: grafana-influx
-                  key: token
           volumeMounts:
             - name: data
               mountPath: /var/lib/grafana
@@ -87,6 +126,9 @@ spec:
               mountPath: /etc/grafana/provisioning/dashboards
             - name: dashboards
               mountPath: /var/lib/grafana/dashboards/mg4
+            - name: influx-token
+              mountPath: /run/influx
+              readOnly: true
           # The first start creates and migrates Grafana's database: measured 44 s at 0.5 CPU
           # and 3 minutes at 0.1 CPU. The startup probe allows up to 10 minutes for that, and
           # liveness/readiness only begin once it succeeded, so a slow first start is never
@@ -136,6 +178,11 @@ spec:
         - name: dashboards
           configMap:
             name: grafana-dashboards
+        # The read-only InfluxDB token, in memory only; made anew at every start.
+        - name: influx-token
+          emptyDir:
+            medium: Memory
+            sizeLimit: 1Mi
 ---
 apiVersion: v1
 kind: Service

k8s/grafana/datasources.yaml

@@ -1,5 +1,6 @@
-# Provisioned InfluxDB datasource. URL and token come from the Grafana container's
-# environment (INFLUX_URL, INFLUX_TOKEN), so no credential is stored in this file.
+# Provisioned InfluxDB datasource. The URL comes from the environment (INFLUX_URL); the token is
+# a read-only one the Grafana pod's init container writes to /run/influx/token at each start
+# (grafana.yaml). No credential is stored in this file.
 apiVersion: 1
 datasources:
   - name: InfluxDB (mg4)
@@ -14,4 +15,4 @@ datasources:
       organization: mg4
       defaultBucket: mg4
     secureJsonData:
-      token: $INFLUX_TOKEN
+      token: $__file{/run/influx/token}

k8s/secrets/secrets.example.yaml

@@ -41,14 +41,3 @@ stringData:
   # Grafana's admin login (user "admin"). Only read on first start: change it in Grafana
   # afterwards, or reset it with grafana cli.
   admin-password: CHANGE-ME
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: grafana-influx
-  namespace: mg4
-type: Opaque
-stringData:
-  # A read-only InfluxDB token for the mg4 bucket, not the admin token. InfluxDB makes it;
-  # the command is in k8s/README.md ("Grafana's InfluxDB token").
-  token: CHANGE-ME-read-only-token-from-influx-auth-create