Grafana's read-only InfluxDB token is made automatically

The read-only token for Grafana needed a manual influx command and a
Secret. InfluxDB generates every token but the admin one and ignores a
chosen value (tested on 2.7.12), so it cannot be preset in a Secret.

Instead an init container in the Grafana pod creates it at every start
with the admin token, deletes the one from the previous start, and
writes only the read-only token to a memory-backed volume; the
provisioned datasource reads it with $__file{/run/influx/token}. The
Grafana process never sees the admin token. The grafana-influx Secret
is gone from the template and the README.

Tested in podman: InfluxDB 2.7.12, the script run twice as the Grafana
user (the old token is replaced, not piled up), and Grafana 13.2.3
reporting the datasource healthy with the file-based token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/README.md

@@ -22,8 +22,8 @@ is applied automatically. Apply them yourself.
    covered by Traefik's default certificate.
 2. **Create the Secrets.** `cp k8s/secrets/secrets.example.yaml k8s/secrets/secrets.yaml` (gitignored), replace
    every `CHANGE-ME` there (`openssl rand -hex 32`): `influxdb-auth`, `mg4-server` (ingest token,
-   approval password for pairing), `grafana-admin` and
-   `grafana-influx` (see below). Keep the template itself on placeholders only.
+   approval password for pairing, the forge token for app updates) and `grafana-admin`.
+   Keep the template itself on placeholders only.
 3. **Registry access.** The `mg4-server` package on git.stinnesbeck.com is public, so no pull
    secret is needed. If you make it private, add an `imagePullSecrets` entry to `server.yaml`.
 
@@ -40,25 +40,11 @@ ConfigMaps (datasource and dashboards) are never created and Grafana does not st
 
 ## Grafana's InfluxDB token
 
-Grafana reads InfluxDB with a token that can only read the `mg4` bucket, from the
-`grafana-influx` Secret. InfluxDB has to create that token, so it is a step of its own:
-
-1. With InfluxDB running, create the token. The `influx` CLI in the pod is already signed in
-   as admin:
-
-   ```sh
-   kubectl -n mg4 exec influxdb-0 -- sh -c \
-     'influx auth create --org mg4 --description grafana-read-only --json \
-        --read-bucket "$(influx bucket find --name mg4 --hide-headers | cut -f1)"'
-   ```
-
-2. Copy the `"token"` value from the output into `grafana-influx` → `token` in
-   `k8s/secrets/secrets.yaml`, apply that file, and restart Grafana:
-   `kubectl -n mg4 rollout restart deployment/grafana`.
-
-Until the Secret exists, Grafana does not start (the container waits for the missing Secret).
-On a fresh install, apply everything once without Grafana working, create the token, then
-apply the Secret.
+Grafana reads InfluxDB with a token that can only read the `mg4` bucket. Nothing to do: an init
+container in the Grafana pod creates it at every start with the admin token, deletes the one
+from the previous start, and hands Grafana only the read-only token (in a memory-backed volume).
+The Grafana process itself never sees the admin token. InfluxDB generates every token but the
+admin one itself, which is why this cannot be a value in the Secret.
 
 ## App updates
 
@@ -73,7 +59,7 @@ and `FORGE_REPO` are set in `server.yaml`.
 - InfluxDB's setup mode runs only on an empty volume. Changing `admin-token` in the Secret later
   does not change the token inside InfluxDB.
 - The server uses the InfluxDB admin token; a token scoped to read/write on the `mg4` bucket can
-  replace it later. Grafana has its own read-only token (below).
+  replace it later. Grafana has its own read-only token (above).
 - The dashboards are read-only in Grafana's UI. Change the JSON in `grafana/dashboards/`; the
   ConfigMap name changes with its content, which rolls Grafana.
 - The server image is pinned by digest in `server.yaml`. To upgrade, push a new tag and put its