Grafana CR Config OCP Secret/ConfigMap Reference (SMTP)

[mhasz-wahbe]

I am trying to externalize the Grafana CR configuration with my SMTP values so that I dont have to leave hardcoded values in my Grafana CR yaml.

If we could use valueFrom: that would be great, or envFrom:
However as it currently operates it only accepts string. I have tried every envFrom: valueFrom: setting i know, tryign to add it before spec.config, and then give it target path for the reference. Same approach is viable in Grafana datasource yamls. Example below.

Preferred Solution:

spec:
  config:
    log:
      level: warn
      mode: console
    smtp:
      enabled: 'true'
      from_address: 
      from_name: Grafana Alerts
      host: 'smtp.domain.com:587'
      user: 
      password: 
        valueFrom:
          secretKeyRef:
            key: grafana-smtp-secret
            key: GF_SMTP_PASSWORD

Grafana DataSource Example:

  valuesFrom:
    - targetPath: "secureJsonData.httpHeaderValue1"
      valueFrom:
        secretKeyRef:
          name: "secret-name"
          key: "token"
  allowCrossNamespaceImport: true
  datasource:
    access: proxy
    editable: true
    isDefault: true
    jsonData:
      httpHeaderName1: Authorization
      timeInterval: 5s
      tlsSkipVerify: true
    name: Prometheus1
    uid: prometheus-grafanadatasource1
    secureJsonData:
      httpHeaderValue1: Bearer ${token}
    type: prometheus
    url: 
  instanceSelector:
    matchLabels:
      dashboards: gragana-dashboards

[Baarsgaard]

You can extend/alter the final deployment that is created when defining a Grafana CR:

---
apiVersion: v1
kind: Secret
metadata:
  name: secret-name
stringData:
  GF_SMTP_PASSWORD: pass1234
---
apiVersion: grafana.integreatly.org/v1beta1
kind: Grafana
metadata:
  name: grafana
spec:
  config:
    log:
      level: warn
  deployment:
    spec:
      template:
        spec:
          containers:
            - name: grafana
              env:
              - name: GF_SMTP_PASSWORD
                valueFrom:
                  secretKeyRef:
                    name: "secret-name"
                    key: GF_SMTP_PASSWORD
              envFrom:
              - secretRef:
                  name: secret-name
                  optional: false

As this is already possible and Grafana allows full configuration of .ini values via env vars, we're unlikely to add valuesFrom functionality here.

[mhasz-wahbe]

Thank you very much for the reply.

I had come across this in one of my searches and tried it. Or thought I did. however I realize now that I had left the "- name: grafana" line out, so wasn't seeing it update the data this way either.

However just retried it with the line included and see it populating the data in my Dashboard UI.

Again thank you very much. this helped alot with not having plaintext passwords in deployment yaml.