[FEATURE] Read Password/Token from /run/secrets

[IljaN]

Is your feature request related to a problem? Please describe.
Podman and Docker are able to mount a secrets file in to /run/secret i.e. /run/secrets/gf_admin_pass. Grafana is able to refer to the secret via an env var: GF_SECURITY_ADMIN_PASSWORD__FILE=/run/secrets/admin_password. As far as I can tell it is not possible to pass the same secret path to gdg which in my setup is installed inside the Grafana container.

Describe the solution you'd like
The GDG_CONTEXTS__ALL__PASSWORD env var should get the capability to refer to a password-file. Maybe by adding a "_FILE" suffix akin to Grafana: GDG_CONTEXTS__ALL__PASSWORD_FILE=/run/secrets/gf_admin_pass

Describe alternatives you've considered
Writing a script which reads the password file and writes it in to importer.yml. This makes the setup more convoluted and might require a custom Grafana Image.

[IljaN]

Found a workaround with a wrapper script:

#!/bin/bash
GDG_CONTEXTS__ALL__PASSWORD=$(< "$GF_SECURITY_ADMIN_PASSWORD__FILE") exec /usr/share/grafana/bin/gdg-bin "$@"

[safaci2000]

I haven't had much experience with this feature in yet. Though, if you can mount a file as a secret, can't you simply mount the importer.yml as a secret and reference it? I'm trying to understand the advantages this feature gives you.

All the docs I found basically use the secret to mount the sensitive config, why not simply do this?

version: "3.8"
services:
  app:
    image: ghcr.io/esnet/gdg:0.7.2
    command: ["-c", "/run/secrets/config.yml", "tools", "contexts", "show"]
    secrets:
      - config.yml

secrets:
  config.yml:
    file: ./importer.yml

I could see more of a use case where the entire secure folder is mounted via /var/run/secure. I think the intent is to put any sensitive data in /run/secrets in which case I think the pattern you have works fine. Having a file alternative for each potential cred is too messy IMO.

I think if we were to add support for this, it would be to look for a grafana_context_auth.json that would override the yaml config you'd store in the importer.yml and maybe add a setting like secret_location