feat: add the --grafana-api-token-filepath flag to the datasource-syncer

google-labs-jules[bot] · pintohutch · commit 85e3bc5d0138 · 2025-07-16T17:44:12.000-04:00
This allows you to specify the Grafana API token through a file,
which is more secure than passing it as a command-line argument.
diff --git a/cmd/datasource-syncer/main.go b/cmd/datasource-syncer/main.go
@@ -43,6 +43,8 @@ var (
 
 	grafanaAPIToken = flag.String("grafana-api-token", "",
 		"grafana-api-token used to access Grafana. Can be created using: https://grafana.com/docs/grafana/latest/administration/service-accounts/#create-a-service-account-in-grafana")
+	grafanaAPITokenFilepath = flag.String("grafana-api-token-filepath", "",
+		"filepath to a file containing the grafana-api-token used to access Grafana.")
 
 	grafanaEndpoint = flag.String("grafana-api-endpoint", "", "grafana-api-endpoint is the endpoint of the Grafana instance that contains the data sources to update.")
 
@@ -76,11 +78,27 @@ func main() {
 		os.Exit(1)
 	}
 
+	if *grafanaAPIToken != "" && *grafanaAPITokenFilepath != "" {
+		//nolint:errcheck
+		level.Error(logger).Log("msg", "at most one of --grafana-api-token and --grafana-api-token-filepath must be set")
+		os.Exit(1)
+	}
+
+	if *grafanaAPITokenFilepath != "" {
+		b, err := os.ReadFile(*grafanaAPITokenFilepath)
+		if err != nil {
+			//nolint:errcheck
+			level.Error(logger).Log("msg", "could not read grafana-api-token-filepath", "err", err)
+			os.Exit(1)
+		}
+		*grafanaAPIToken = string(b)
+	}
+
 	if *grafanaAPIToken == "" {
 		envToken := os.Getenv("GRAFANA_SERVICE_ACCOUNT_TOKEN")
 		if envToken == "" {
 			//nolint:errcheck
-			level.Error(logger).Log("msg", "--grafana-api-token or the environment variable GRAFANA_SERVICE_ACCOUNT_TOKEN must be set")
+			level.Error(logger).Log("msg", "at most one of --grafana-api-token, --grafana-api-token-filepath, or the environment variable GRAFANA_SERVICE_ACCOUNT_TOKEN must be set")
 			os.Exit(1)
 		}
 		grafanaAPIToken = &envToken
