Defining the grafana token via environment variables not working

[byoungstrom]

Hello,

I am trying to integrate gdg to do regular backups of our dashboards. Running into issues with being able to provide the grafana api token as an environment variable. I am able to override other config values, which leads me to think there is something different about how tokens are handled. Ultimately I want to have this run as a kubernetes job with the token coming from a secret.

My importer.yml looks like this

context_name: prod

storage_engine:
  my_s3:
    cloud_type: custom
    bucket_name: "vm-backups"
    init_bucket: "false" 
    endpoint: "http://my-s3-endpoint:9020"
    ssl_enabled: "false"

contexts:
  prod:
    storage: "my_s3"
    output_path: grafana-prod
    enterprise_support: false
    url: http://grafana-service:3000/
    # token: set from env var 
[...]

I would expect this to work. Instead, I get a 401 Unauthorized from grafana. The grafana log reports that no password was presented for basic auth.

export GDG_CONTEXTS__PROD__TOKEN=abc123
./gdg backup -c config/importer.yml dashboards list

If I add my token to the config file, I am able to get a list of dashboards. As a verification that the variable syntax is correct, I can set GDG_CONTEXTS__PROD__URL via an environment variable and see gdg use the modified value.

Is there another way to set the grafana api token in the environment?

[safaci2000]

Don’t unset the value of the token. It needs to have a value even if it’s an empty string in order for the ENV override to function. Otherwise there is no “entry” for it to override. I’m not sure if this is a viper issue or GDG but it isn’t very obvious. I’ll make a note to call it out in the next release.

You can also confirm the behavior via:

GDG_CONTEXTS__TESTING__TOKEN="1234" ./bin/gdg t contexts show

---testing:
token: "1234"
connections: null
dashboard_settings:
    nested_folders: false
    ignore_filters: true
    ignore_bad_folders: false
watched: []
watched_folders_override: []
organization_name: DumbDumb
output_path: test/data
password: admin
storage: ""
url: http://localhost:3000
user_name: admin

./bin/gdg t contexts show

---testing:
token: ""
connections: null
dashboard_settings:
    nested_folders: false
    ignore_filters: true
    ignore_bad_folders: false
watched: []
watched_folders_override: []
organization_name: DumbDumb
output_path: test/data
password: admin
storage: ""
url: http://localhost:3000
user_name: admin

[byoungstrom]

Ah, got it. Thank you! Agreed, this is not an obvious behavior.