Skip to content

feat(helm): add secretRef support for grafana-mcp #1211

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
TOMOFUMI-KONDO wants to merge 1 commit into
base: main
Choose a base branch
from
+11 −4
Open

feat(helm): add secretRef support for grafana-mcp #1211

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion helm/kagent/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -349,7 +349,9 @@ tools:
grafana-mcp:
grafana:
url: "grafana.kagent:3000/api"
apiKey: "-"
serviceAccountToken: ""
# apiKey: "" # Deprecated - use serviceAccountToken instead.
# secretRef: "" # Name of Secret to reference (contains GRAFANA_SERVICE_ACCOUNT_TOKEN or GRAFANA_API_KEY)
Comment on lines +353 to +354
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These fields should be uncommented with empty default values for consistency with serviceAccountToken on line 352 and to maintain backward compatibility for apiKey.

Suggested change
# apiKey: "" # Deprecated - use serviceAccountToken instead.
# secretRef: "" # Name of Secret to reference (contains GRAFANA_SERVICE_ACCOUNT_TOKEN or GRAFANA_API_KEY)
apiKey: "" # Deprecated - use serviceAccountToken instead.
secretRef: "" # Name of Secret to reference (contains GRAFANA_SERVICE_ACCOUNT_TOKEN or GRAFANA_API_KEY)

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

@TOMOFUMI-KONDO TOMOFUMI-KONDO Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I follow the pattern of modelconfig-secret, e.x. Values.providers.openAI.apiKey.

resources:
requests:
cpu: 100m
Expand Down
4 changes: 3 additions & 1 deletion helm/tools/grafana-mcp/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,10 @@ spec:
envFrom:
- configMapRef:
name: {{ include "grafana-mcp.fullname" . }}
{{- if or .Values.grafana.secretRef .Values.grafana.serviceAccountToken .Values.grafana.apiKey }}
Copy link
Contributor

@EItanya EItanya Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't this always true? If one of these isn't true than the config is invalid anyway?

- secretRef:
name: {{ include "grafana-mcp.fullname" . }}
name: {{ .Values.grafana.secretRef | default (include "grafana-mcp.fullname" .) | quote }}
{{- end }}
ports:
- name: http
containerPort: {{ .Values.service.port }}
Expand Down
4 changes: 3 additions & 1 deletion helm/tools/grafana-mcp/templates/secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
{{- if or .Values.grafana.serviceAccountToken .Values.grafana.apiKey }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "grafana-mcp.fullname" . }}
name: {{ .Values.grafana.secretRef | default (include "grafana-mcp.fullname" .) | quote }}
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When secretRef is provided, this template creates a Secret with that name, which could overwrite an existing Secret the user intended to reference. The Secret should only be created with the chart-generated name. If secretRef is specified, this Secret resource should not be created at all.

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

@TOMOFUMI-KONDO TOMOFUMI-KONDO Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

secretRef is used in deployment to refer this secret. If secretRef is specified with serviceAccountToken or apiKey, which is unintended misuse, deployment will refer unexisting Secret. To prevent such a trouble, I also setsecretRef to Secret resource.

Copy link
Contributor

@EItanya EItanya Jan 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I approved, but I actually do agree with this comment. I agree that the secret should be optionally created, but we need to make sure that the name of this is consistent, this line should be reverted

namespace: {{ .Release.Namespace }}
labels:
{{- include "grafana-mcp.labels" . | nindent 4 }}
Expand All @@ -13,3 +14,4 @@ data:
{{- if and .Values.grafana.apiKey (not .Values.grafana.serviceAccountToken) }}
GRAFANA_API_KEY: {{ .Values.grafana.apiKey | b64enc }}
{{- end }}
{{- end }}
3 changes: 2 additions & 1 deletion helm/tools/grafana-mcp/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,8 @@ replicas: 1
grafana:
url: "grafana.kagent:3000/api"
serviceAccountToken: ""
apiKey: "" # Deprecated - use serviceAccountToken instead.
# apiKey: "" # Deprecated - use serviceAccountToken instead.
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The apiKey field should remain uncommented with an empty default value for backward compatibility, similar to serviceAccountToken on line 5. Users relying on this field in their existing configurations may experience breaking changes if it's only available as a comment.

Suggested change
# apiKey: "" # Deprecated - use serviceAccountToken instead.
apiKey: "" # Deprecated - use serviceAccountToken instead.

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

@TOMOFUMI-KONDO TOMOFUMI-KONDO Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I follow the pattern of modelconfig-secret, e.x. Values.providers.openAI.apiKey.

# secretRef: "" # Name of Secret to reference (contains GRAFANA_SERVICE_ACCOUNT_TOKEN or GRAFANA_API_KEY)
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The secretRef field should be uncommented with an empty default value to make it discoverable as a supported configuration option, consistent with how serviceAccountToken is defined on line 5.

Suggested change
# secretRef: "" # Name of Secret to reference (contains GRAFANA_SERVICE_ACCOUNT_TOKEN or GRAFANA_API_KEY)
secretRef: "" # Name of Secret to reference (contains GRAFANA_SERVICE_ACCOUNT_TOKEN or GRAFANA_API_KEY)

Copilot uses AI. Check for mistakes.
Copy link
Contributor Author

@TOMOFUMI-KONDO TOMOFUMI-KONDO Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I follow the pattern of modelconfig-secret, e.x. Values.providers.openAI.apiKey.


image:
registry: mcp
Expand Down
Loading