nilsandClaude Opus 5.5
9226616261
The read-only token for Grafana needed a manual influx command and a
Secret. InfluxDB generates every token but the admin one and ignores a
chosen value (tested on 2.7.12), so it cannot be preset in a Secret.
Instead an init container in the Grafana pod creates it at every start
with the admin token, deletes the one from the previous start, and
writes only the read-only token to a memory-backed volume; the
provisioned datasource reads it with $__file{/run/influx/token}. The
Grafana process never sees the admin token. The grafana-influx Secret
is gone from the template and the README.
Tested in podman: InfluxDB 2.7.12, the script run twice as the Grafana
user (the old token is replaced, not piled up), and Grafana 13.2.3
reporting the datasource healthy with the file-based token.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki
19 lines
561 B
YAML
19 lines
561 B
YAML
# Provisioned InfluxDB datasource. The URL comes from the environment (INFLUX_URL); the token is
|
|
# a read-only one the Grafana pod's init container writes to /run/influx/token at each start
|
|
# (grafana.yaml). No credential is stored in this file.
|
|
apiVersion: 1
|
|
datasources:
|
|
- name: InfluxDB (mg4)
|
|
uid: mg4-influxdb
|
|
type: influxdb
|
|
access: proxy
|
|
url: $INFLUX_URL
|
|
isDefault: true
|
|
editable: false
|
|
jsonData:
|
|
version: Flux
|
|
organization: mg4
|
|
defaultBucket: mg4
|
|
secureJsonData:
|
|
token: $__file{/run/influx/token}
|