add grafana terraform definition and comment for accessing key

main.tf

@@ -217,13 +217,7 @@ module "nomad" {
   logs_health_proxy_port = var.logs_health_proxy_port
   logs_proxy_port        = var.logs_proxy_port
 
-  grafana_api_key_secret_name          = module.init.grafana_api_key_secret_name
-  grafana_logs_endpoint_secret_name    = module.init.grafana_logs_endpoint_secret_name
-  grafana_logs_username_secret_name    = module.init.grafana_logs_username_secret_name
-  grafana_metrics_endpoint_secret_name = module.init.grafana_metrics_endpoint_secret_name
-  grafana_metrics_username_secret_name = module.init.grafana_metrics_username_secret_name
-  grafana_traces_endpoint_secret_name  = module.init.grafana_traces_endpoint_secret_name
-  grafana_traces_username_secret_name  = module.init.grafana_traces_username_secret_name
+  grafana_api_key_secret_name = module.init.grafana_api_key_secret_name
 
   # Logs
   loki_bucket_name  = module.buckets.loki_bucket_name
@@ -245,3 +239,4 @@ module "nomad" {
   # Redis
   redis_port = var.redis_port
 }
+

packages/init/main.tf

@@ -114,8 +114,9 @@ resource "google_secret_manager_secret_version" "nomad_acl_token" {
   secret_data = random_uuid.nomad_acl_token.result
 }
 
-resource "google_secret_manager_secret" "grafana_api_key" {
-  secret_id = "${var.prefix}grafana-api-key"
+# grafana username
+resource "google_secret_manager_secret" "grafana_username" {
+  secret_id = "${var.prefix}grafana-username"
 
   replication {
     auto {}
@@ -124,50 +125,9 @@ resource "google_secret_manager_secret" "grafana_api_key" {
   depends_on = [time_sleep.secrets_api_wait_60_seconds]
 }
 
-resource "google_secret_manager_secret_version" "grafana_api_key" {
-  secret      = google_secret_manager_secret.grafana_api_key.name
-  secret_data = " "
-
-  lifecycle {
-    ignore_changes = [secret_data]
-  }
-
-  depends_on = [time_sleep.secrets_api_wait_60_seconds]
-}
-
-resource "google_secret_manager_secret" "grafana_traces_endpoint" {
-  secret_id = "${var.prefix}grafana-traces-endpoint"
-
-  replication {
-    auto {}
-  }
-
-  depends_on = [time_sleep.secrets_api_wait_60_seconds]
-}
-
-resource "google_secret_manager_secret_version" "grafana_traces_endpoint" {
-  secret      = google_secret_manager_secret.grafana_traces_endpoint.name
-  secret_data = " "
-
-  lifecycle {
-    ignore_changes = [secret_data]
-  }
-
-  depends_on = [time_sleep.secrets_api_wait_60_seconds]
-}
-
-resource "google_secret_manager_secret" "grafana_logs_endpoint" {
-  secret_id = "${var.prefix}grafana-logs-endpoint"
-
-  replication {
-    auto {}
-  }
 
-  depends_on = [time_sleep.secrets_api_wait_60_seconds]
-}
-
-resource "google_secret_manager_secret_version" "grafana_logs_endpoint" {
-  secret      = google_secret_manager_secret.grafana_logs_endpoint.name
+resource "google_secret_manager_secret_version" "grafana_username" {
+  secret      = google_secret_manager_secret.grafana_username.name
   secret_data = " "
 
   lifecycle {
@@ -177,50 +137,9 @@ resource "google_secret_manager_secret_version" "grafana_logs_endpoint" {
   depends_on = [time_sleep.secrets_api_wait_60_seconds]
 }
 
-resource "google_secret_manager_secret" "grafana_metrics_endpoint" {
-  secret_id = "${var.prefix}grafana-metrics-endpoint"
-
-  replication {
-    auto {}
-  }
-
-  depends_on = [time_sleep.secrets_api_wait_60_seconds]
-}
-
-resource "google_secret_manager_secret_version" "grafana_metrics_endpoint" {
-  secret      = google_secret_manager_secret.grafana_metrics_endpoint.name
-  secret_data = " "
-
-  lifecycle {
-    ignore_changes = [secret_data]
-  }
-
-  depends_on = [time_sleep.secrets_api_wait_60_seconds]
-}
-
-resource "google_secret_manager_secret" "grafana_traces_username" {
-  secret_id = "${var.prefix}grafana-traces-username"
-
-  replication {
-    auto {}
-  }
-
-  depends_on = [time_sleep.secrets_api_wait_60_seconds]
-}
-
-resource "google_secret_manager_secret_version" "grafana_traces_username" {
-  secret      = google_secret_manager_secret.grafana_traces_username.name
-  secret_data = " "
-
-  lifecycle {
-    ignore_changes = [secret_data]
-  }
-
-  depends_on = [time_sleep.secrets_api_wait_60_seconds]
-}
-
-resource "google_secret_manager_secret" "grafana_logs_username" {
-  secret_id = "${var.prefix}grafana-logs-username"
+# grafana api key
+resource "google_secret_manager_secret" "grafana_api_key" {
+  secret_id = "${var.prefix}grafana-api-key"
 
   replication {
     auto {}
@@ -229,8 +148,8 @@ resource "google_secret_manager_secret" "grafana_logs_username" {
   depends_on = [time_sleep.secrets_api_wait_60_seconds]
 }
 
-resource "google_secret_manager_secret_version" "grafana_logs_username" {
-  secret      = google_secret_manager_secret.grafana_logs_username.name
+resource "google_secret_manager_secret_version" "grafana_api_key" {
+  secret      = google_secret_manager_secret.grafana_api_key.name
   secret_data = " "
 
   lifecycle {
@@ -240,26 +159,6 @@ resource "google_secret_manager_secret_version" "grafana_logs_username" {
   depends_on = [time_sleep.secrets_api_wait_60_seconds]
 }
 
-resource "google_secret_manager_secret" "grafana_metrics_username" {
-  secret_id = "${var.prefix}grafana-metrics-username"
-
-  replication {
-    auto {}
-  }
-
-  depends_on = [time_sleep.secrets_api_wait_60_seconds]
-}
-
-resource "google_secret_manager_secret_version" "grafana_metrics_username" {
-  secret      = google_secret_manager_secret.grafana_metrics_username.name
-  secret_data = " "
-
-  lifecycle {
-    ignore_changes = [secret_data]
-  }
-
-  depends_on = [time_sleep.secrets_api_wait_60_seconds]
-}
 
 resource "google_secret_manager_secret" "analytics_collector_host" {
   secret_id = "${var.prefix}analytics-collector-host"

packages/init/outputs.tf

@@ -18,29 +18,10 @@ output "grafana_api_key_secret_name" {
   value = google_secret_manager_secret.grafana_api_key.name
 }
 
-output "grafana_logs_username_secret_name" {
-  value = google_secret_manager_secret.grafana_logs_username.name
+output "grafana_username__secret_name" {
+  value = google_secret_manager_secret.grafana_username.name
 }
 
-output "grafana_traces_username_secret_name" {
-  value = google_secret_manager_secret.grafana_traces_username.name
-}
-
-output "grafana_metrics_username_secret_name" {
-  value = google_secret_manager_secret.grafana_metrics_username.name
-}
-
-output "grafana_logs_endpoint_secret_name" {
-  value = google_secret_manager_secret.grafana_logs_endpoint.name
-}
-
-output "grafana_traces_endpoint_secret_name" {
-  value = google_secret_manager_secret.grafana_traces_endpoint.name
-}
-
-output "grafana_metrics_endpoint_secret_name" {
-  value = google_secret_manager_secret.grafana_metrics_endpoint.name
-}
 
 output "analytics_collector_host_secret_name" {
   value = google_secret_manager_secret.analytics_collector_host.name

packages/nomad/main.tf

@@ -12,30 +12,6 @@ data "google_secret_manager_secret_version" "grafana_api_key" {
   secret = var.grafana_api_key_secret_name
 }
 
-data "google_secret_manager_secret_version" "grafana_traces_endpoint" {
-  secret = var.grafana_traces_endpoint_secret_name
-}
-
-data "google_secret_manager_secret_version" "grafana_logs_endpoint" {
-  secret = var.grafana_logs_endpoint_secret_name
-}
-
-data "google_secret_manager_secret_version" "grafana_metrics_endpoint" {
-  secret = var.grafana_metrics_endpoint_secret_name
-}
-
-data "google_secret_manager_secret_version" "grafana_traces_username" {
-  secret = var.grafana_traces_username_secret_name
-}
-
-data "google_secret_manager_secret_version" "grafana_logs_username" {
-  secret = var.grafana_logs_username_secret_name
-}
-
-data "google_secret_manager_secret_version" "grafana_metrics_username" {
-  secret = var.grafana_metrics_username_secret_name
-}
-
 data "google_secret_manager_secret_version" "analytics_collector_host" {
   secret = var.analytics_collector_host_secret_name
 }
@@ -137,48 +113,39 @@ resource "nomad_job" "session_proxy" {
   }
 }
 
-resource "nomad_job" "otel_collector" {
-  jobspec = file("${path.module}/otel-collector.hcl")
-
-  hcl2 {
-    vars = {
-      grafana_traces_endpoint  = data.google_secret_manager_secret_version.grafana_traces_endpoint.secret_data
-      grafana_logs_endpoint    = data.google_secret_manager_secret_version.grafana_logs_endpoint.secret_data
-      grafana_metrics_endpoint = data.google_secret_manager_secret_version.grafana_metrics_endpoint.secret_data
+# resource "nomad_job" "otel_collector" {
+#   jobspec = file("${path.module}/otel-collector.hcl")
 
-      grafana_traces_username  = data.google_secret_manager_secret_version.grafana_traces_username.secret_data
-      grafana_logs_username    = data.google_secret_manager_secret_version.grafana_logs_username.secret_data
-      grafana_metrics_username = data.google_secret_manager_secret_version.grafana_metrics_username.secret_data
+#   hcl2 {
+#     vars = {
 
-      grafana_api_key = data.google_secret_manager_secret_version.grafana_api_key.secret_data
+#       grafana_api_key = data.google_secret_manager_secret_version.grafana_api_key.secret_data
 
-      consul_token = var.consul_acl_token_secret
+#       consul_token = var.consul_acl_token_secret
 
-      gcp_zone = var.gcp_zone
-    }
-  }
-}
+#       gcp_zone = var.gcp_zone
+#     }
+#   }
+# }
 
-resource "nomad_job" "logs_collector" {
-  jobspec = file("${path.module}/logs-collector.hcl")
+# resource "nomad_job" "logs_collector" {
+#   jobspec = file("${path.module}/logs-collector.hcl")
 
-  hcl2 {
-    vars = {
-      gcp_zone = var.gcp_zone
+#   hcl2 {
+#     vars = {
+#       gcp_zone = var.gcp_zone
 
-      logs_port_number        = var.logs_proxy_port.port
-      logs_health_port_number = var.logs_health_proxy_port.port
-      logs_health_path        = var.logs_health_proxy_port.health_path
-      logs_port_name          = var.logs_proxy_port.name
+#       logs_port_number        = var.logs_proxy_port.port
+#       logs_health_port_number = var.logs_health_proxy_port.port
+#       logs_health_path        = var.logs_health_proxy_port.health_path
+#       logs_port_name          = var.logs_proxy_port.name
 
-      loki_service_port_number = var.loki_service_port.port
+#       loki_service_port_number = var.loki_service_port.port
 
-      grafana_api_key       = data.google_secret_manager_secret_version.grafana_api_key.secret_data
-      grafana_logs_endpoint = data.google_secret_manager_secret_version.grafana_logs_endpoint.secret_data
-      grafana_logs_username = data.google_secret_manager_secret_version.grafana_logs_username.secret_data
-    }
-  }
-}
+#       grafana_api_key = data.google_secret_manager_secret_version.grafana_api_key.secret_data
+#     }
+#   }
+# }
 
 data "google_storage_bucket_object" "orchestrator" {
   name   = "orchestrator"

packages/nomad/variables.tf

@@ -140,30 +140,6 @@ variable "grafana_api_key_secret_name" {
   type = string
 }
 
-variable "grafana_logs_username_secret_name" {
-  type = string
-}
-
-variable "grafana_traces_username_secret_name" {
-  type = string
-}
-
-variable "grafana_metrics_username_secret_name" {
-  type = string
-}
-
-variable "grafana_logs_endpoint_secret_name" {
-  type = string
-}
-
-variable "grafana_traces_endpoint_secret_name" {
-  type = string
-}
-
-variable "grafana_metrics_endpoint_secret_name" {
-  type = string
-}
-
 variable "analytics_collector_host_secret_name" {
   type = string
 }

self-host.md

@@ -65,7 +65,7 @@ Check if you can use config for terraform state management
 12. Secrets are created and stored in GCP Secrets Manager. Once created, that is the source of truth--you will need to update values there to make changes. Create a secret value for the following secrets:
 - e2b-cloudflare-api-token
 - e2b-postgres-connection-string
-- Grafana secrets (optional)
+- e2b-grafana-cloud-access-policy-token (optional)
 - Posthog API keys for monitoring (optional)
 13. Run `make plan-without-jobs` and then `make apply`
 14. Run `make plan` and then `make apply`. Note: This will work after the TLS certificates was issued. It1 can take some time; you can check the status in the Google Cloud Console

terraform/grafana/.gitignore

@@ -0,0 +1 @@
+.tfplan