feat(helm): add service account token support for grafana-mcp #1187
Conversation
Add grafana.serviceAccountToken option to enable authentication using Grafana service account tokens as an alternative to API keys. Both GRAFANA_API_KEY and GRAFANA_SERVICE_ACCOUNT_TOKEN environment variables are now conditionally rendered based on value setting. Signed-off-by: TOMOFUMI-KONDO <ugax2kontomo0314@gmail.com>
TOMOFUMI-KONDO
requested review from
EItanya,
ilackarms and
yuval-k
as code owners
There was a problem hiding this comment.
Pull request overview
This PR adds support for Grafana service account token authentication to the grafana-mcp Helm chart, aligning with Grafana's recommendation to migrate away from deprecated API keys. The implementation allows users to specify a service account token while maintaining backward compatibility with the existing API key method.
Key Changes
- Added
serviceAccountTokenconfiguration option to values.yaml - Updated secret template to conditionally include service account token or API key based on configuration
- Deprecated the
apiKeyfield with an inline comment
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| helm/tools/grafana-mcp/values.yaml | Adds serviceAccountToken field and marks apiKey as deprecated |
| helm/tools/grafana-mcp/templates/secret.yaml | Updates secret generation to support both authentication methods with conditional logic |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| {{- if and .Values.grafana.apiKey (not .Values.grafana.serviceAccountToken) }} | ||
| GRAFANA_API_KEY: {{ .Values.grafana.apiKey | b64enc }} | ||
| {{- end }} |
There was a problem hiding this comment.
The conditional logic allows both authentication methods to be silently ignored if both are empty strings. This could lead to a deployment with no authentication configured. Consider adding validation to ensure at least one authentication method is provided, or document this behavior clearly.
There was a problem hiding this comment.
Adding validation is not scoped in this PR.
| url: "grafana.kagent:3000/api" | ||
| apiKey: "-" | ||
| serviceAccountToken: "" | ||
| apiKey: "" # Deprecated - use serviceAccountToken instead. |
There was a problem hiding this comment.
The default value changed from '-' to an empty string. If '-' was a sentinel value used elsewhere in the templates or by consumers, this could be a breaking change. Consider documenting this change in the PR description or maintaining the '-' default for backward compatibility.
| apiKey: "" # Deprecated - use serviceAccountToken instead. | |
| apiKey: "-" # Deprecated - use serviceAccountToken instead. |
There was a problem hiding this comment.
I added the backward compatibility description in PR.
2 participants
Overview
Add support for Grafana service account token authentication in the grafana-mcp Helm chart.
API keys are deprecated in Grafana and will be removed in a future release. Service account tokens are the recommended authentication method.
Changes
serviceAccountTokenoption to values.yamlapiKeyas deprecated in values.yamlAbout Backward Compatibility
This change modifies the behavior of
GRAFANA_API_KEYenvironment variable rendering:grafana.apiKeyis not setGRAFANA_API_KEY: "-"grafana.apiKeyis setGRAFANA_API_KEY: <value>GRAFANA_API_KEY: <value>I think this is functionally equivalent because the placeholder value
"-"is not a valid API key and would not work for authentication.