Grafana's read-only InfluxDB token is made automatically

The read-only token for Grafana needed a manual influx command and a
Secret. InfluxDB generates every token but the admin one and ignores a
chosen value (tested on 2.7.12), so it cannot be preset in a Secret.

Instead an init container in the Grafana pod creates it at every start
with the admin token, deletes the one from the previous start, and
writes only the read-only token to a memory-backed volume; the
provisioned datasource reads it with $__file{/run/influx/token}. The
Grafana process never sees the admin token. The grafana-influx Secret
is gone from the template and the README.

Tested in podman: InfluxDB 2.7.12, the script run twice as the Grafana
user (the old token is replaced, not piled up), and Grafana 13.2.3
reporting the datasource healthy with the file-based token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

k8s/grafana.yaml

@@ -1,6 +1,12 @@
 # Grafana for the dashboards. The InfluxDB datasource and the three MG4 dashboards are
 # provisioned from k8s/grafana/ (ConfigMaps generated by kustomization.yaml); the dashboards
 # are read-only in the UI — change the JSON in git instead.
+#
+# Grafana reads InfluxDB with a token that can only read the mg4 bucket. InfluxDB generates
+# every token but the admin one (a chosen value is ignored), so the init container makes it at
+# each start: it alone gets the admin token, creates a fresh read-only token, deletes the one
+# from the previous start, and leaves only the read-only token in a memory-backed volume for
+# Grafana. Nothing to do by hand, and the Grafana process never sees the admin token.
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
@@ -44,6 +50,46 @@ spec:
         fsGroup: 472
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        - name: influx-read-token
+          image: docker.io/library/influxdb:2.7.12-alpine
+          command:
+            - sh
+            - -c
+            - |
+              set -eu
+              desc="grafana read-only (made by the Grafana pod at start)"
+              export INFLUX_CONFIGS_PATH=/tmp/influx-configs
+              bucket=$(influx bucket find --name mg4 --hide-headers | cut -f1)
+              old=$(influx auth list --hide-headers | awk -F'\t' -v d="$desc" '$2 == d { print $1 }')
+              token=$(influx auth create --description "$desc" --read-bucket "$bucket" --hide-headers | cut -f3)
+              [ -n "$token" ] || { echo "no token created" >&2; exit 1; }
+              printf '%s' "$token" > /run/influx/token
+              for id in $old; do influx auth delete --id "$id" > /dev/null; done
+              echo "read-only token for Grafana ready"
+          env:
+            - name: INFLUX_HOST
+              value: http://influxdb.mg4.svc:8086
+            - name: INFLUX_ORG
+              value: mg4
+            - name: INFLUX_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: influxdb-auth
+                  key: admin-token
+          volumeMounts:
+            - name: influx-token
+              mountPath: /run/influx
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              memory: 128Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
       containers:
         - name: grafana
           image: docker.io/grafana/grafana:13.2.3
@@ -68,16 +114,9 @@ spec:
               value: "false"
             - name: GF_ANALYTICS_CHECK_FOR_UPDATES
               value: "false"
-            # Read by datasources.yaml.
+            # Read by datasources.yaml; the token is the file the init container wrote.
             - name: INFLUX_URL
               value: http://influxdb.mg4.svc:8086
-            # Read-only on the mg4 bucket; the dashboards never write (README, "Grafana's
-            # InfluxDB token").
-            - name: INFLUX_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: grafana-influx
-                  key: token
           volumeMounts:
             - name: data
               mountPath: /var/lib/grafana
@@ -87,6 +126,9 @@ spec:
               mountPath: /etc/grafana/provisioning/dashboards
             - name: dashboards
               mountPath: /var/lib/grafana/dashboards/mg4
+            - name: influx-token
+              mountPath: /run/influx
+              readOnly: true
           # The first start creates and migrates Grafana's database: measured 44 s at 0.5 CPU
           # and 3 minutes at 0.1 CPU. The startup probe allows up to 10 minutes for that, and
           # liveness/readiness only begin once it succeeded, so a slow first start is never
@@ -136,6 +178,11 @@ spec:
         - name: dashboards
           configMap:
             name: grafana-dashboards
+        # The read-only InfluxDB token, in memory only; made anew at every start.
+        - name: influx-token
+          emptyDir:
+            medium: Memory
+            sizeLimit: 1Mi
 ---
 apiVersion: v1
 kind: Service