[datasource-syncer] Enable reading token from a file

[markustoivonen]

Hi!

I am currently trying to set up a system using the prometheus datasource-syncer where the CronJob has an initContainer that creates the G-SA and the token if they do not exist. The token is stored as plaintext to a volume that is shared by the main container and the initContainer.

The distroless image makes it so that the token cannot be read/passed in any meaningful way via code as far as I can tell (without exposing it to the codebase that is).

I think the easiest solution would be to allow passing a filepath from where the token could be read. Would it be possible to support?

[pintohutch]

Hi @markustoivonen - does this flag

prometheus-engine/cmd/datasource-syncer/main.go

Line 39 in 7d1b2b1

credentialsFile = flag.String("query.credentials-file", "",

not work for you?

[markustoivonen]

@pintohutch Sorry I was unclear in my message. I was referring to the Grafana service account, not Google service account.

So instead of using the --grafana-api-token flag, there would exist a --grafana-api-token-filepath flag

[markustoivonen]

Thanks for the quick action! When might one expect a new image of the datasource-syncer to be published that includes this change? 😊

[pintohutch]

We're on a release freeze right now, but should resume releases in the next couple of weeks. You're free to build the image and try it out yourself in the meantime

[jullianow]

Any estimate on when it will be released?

This release freeze has an expiration date.

[pintohutch]

Hey @jullianow - apologies for the delayed response. I believe @bwplotka and @bernot-dev are hard at work to push this out in our 0.17 release.

[rlaakkol]

FYI: this can be worked around by piping the command line argument values from env and setting the env from a secret like so:

      containers:
      - name: datasource-syncer-init
        image: gcr.io/gke-release/prometheus-engine/datasource-syncer:v0.15.4-gke.0
        args:
        - "--datasource-uids=$(DATASOURCE_UIDS)"
        - "--grafana-api-endpoint=$(GRAFANA_API_ENDPOINT)"
        - "--grafana-api-token=$(GRAFANA_API_TOKEN)"
        - "--project-id=$(PROJECT_ID)"
        envFrom:
        - configMapRef:
            name: ds-syncer
        - secretRef:
            name: ds-syncer

[arsdehnel]

Is there an update on the timing expectation for the v0.17.0 release? Due to other constraints in the helm charts and templating options we can't do the workaround.

[pintohutch]

Hey @arsdehnel, we have a release staged for this week cc @hsmatulis

[jullianow]

Will it be released this week?

[pintohutch]

Hi @jullianow - it's out! You should be able to pull:

docker pull gke.gcr.io/prometheus-engine/datasource-syncer:v0.17.0-gke.8

[jullianow]

@pintohutch thanks you