Add Dockerfile + Gitea Actions workflow for mcp-grafana container
build / build (push) Failing after 13s
build / build (push) Failing after 13s
- Dockerfile: fetches pinned upstream release binary (static Go) from grafana/mcp-grafana GitHub releases, sha256-verified against the release's own checksums file, runs from scratch. - Workflow: push-to-main / weekly Mon 06:00 UTC / manual dispatch; resolves newest release, skips if tag published, pushes gitea.williammiceli.systems/hermes/grafana-mcp:v<ver> + :latest. - REGISTRY_TOKEN repo Actions secret already provisioned.
This commit is contained in:
@@ -0,0 +1,109 @@
|
||||
# Builds and publishes the grafana-mcp (Grafana MCP server) container image
|
||||
# to the Gitea registry. This repo deliberately contains no build process
|
||||
# that depends on Hermes' container — Gitea Actions builds and pushes it
|
||||
# standalone.
|
||||
#
|
||||
# Triggers:
|
||||
# - push to main (e.g. bumping the Dockerfile default version ARG)
|
||||
# - weekly schedule, Mon 06:00 UTC — resolves the newest upstream release
|
||||
# and builds it if not yet published, ~7h BEFORE the cluster0
|
||||
# image-update cron (Mon 13:00 UTC) so the Monday pass picks it up like
|
||||
# any other app.
|
||||
# - workflow_dispatch with an explicit version input
|
||||
name: build
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
schedule:
|
||||
- cron: '0 6 * * 1'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
version:
|
||||
description: 'grafana/mcp-grafana GitHub release (empty = latest)'
|
||||
required: false
|
||||
default: ''
|
||||
|
||||
env:
|
||||
REGISTRY: gitea.williammiceli.systems
|
||||
IMAGE: gitea.williammiceli.systems/hermes/grafana-mcp
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest # cluster0 Gitea runner (registers this label; has docker + network)
|
||||
# Minimal explicit scopes: read code (checkout), write packages (registry push).
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Resolve upstream version
|
||||
id: ver
|
||||
run: |
|
||||
if [ -n "${{ github.event.inputs.version }}" ]; then
|
||||
VER="${{ github.event.inputs.version }}"
|
||||
else
|
||||
VER=$(curl -fsSL https://api.github.com/repos/grafana/mcp-grafana/releases/latest \
|
||||
| python3 -c "import sys,json;print(json.load(sys.stdin)['tag_name'])")
|
||||
fi
|
||||
[ -n "$VER" ] || { echo "could not resolve upstream version"; exit 1; }
|
||||
echo "version=$VER" >> "$GITHUB_OUTPUT"
|
||||
echo "Resolved grafana/mcp-grafana version: $VER"
|
||||
|
||||
- name: Skip if already published
|
||||
id: skip
|
||||
run: |
|
||||
if docker manifest inspect "$IMAGE:v${{ steps.ver.outputs.version }}" >/dev/null 2>&1; then
|
||||
echo "Image $IMAGE:v${{ steps.ver.outputs.version }} already exists — nothing to do."
|
||||
echo "skip=true" >> "$GITHUB_OUTPUT"
|
||||
else
|
||||
echo "skip=false" >> "$GITHUB_OUTPUT"
|
||||
fi
|
||||
|
||||
- name: Configure registry credentials
|
||||
# Dedicated scoped PAT (repo Actions secret REGISTRY_TOKEN) — Gitea's
|
||||
# container registry rejects scope requests from the Actions job token
|
||||
# (upstream issue #23642). Write config.json directly; no login ping.
|
||||
run: |
|
||||
mkdir -p "$HOME/.docker"
|
||||
AUTH=$(printf 'Hermes:%s' "${{ secrets.REGISTRY_TOKEN }}" | base64 -w0)
|
||||
printf '{"auths":{"%s":{"auth":"%s"}}}\n' "$REGISTRY" "$AUTH" > "$HOME/.docker/config.json"
|
||||
chmod 600 "$HOME/.docker/config.json"
|
||||
echo "docker config.json written for $REGISTRY"
|
||||
|
||||
- name: Diagnose registry auth (runs only if a later step fails)
|
||||
if: failure()
|
||||
# Prints only metadata (lengths, status codes) — never the token itself.
|
||||
run: |
|
||||
T="${{ secrets.REGISTRY_TOKEN }}"
|
||||
echo "REGISTRY_TOKEN length: ${#T} (0 = secret empty or missing)"
|
||||
echo "--- /v2/ ping with basic auth ---"
|
||||
curl -s -o /dev/null -w "HTTP %{http_code}\n" -u "Hermes:$T" \
|
||||
"https://gitea.williammiceli.systems/v2/" || true
|
||||
echo "--- bearer-token flow (what docker push does after a 401 challenge) ---"
|
||||
BT=$(curl -s -u "Hermes:$T" -G "https://gitea.williammiceli.systems/v2/token" \
|
||||
--data-urlencode "service=container_registry" \
|
||||
--data-urlencode "scope=repository:hermes/grafana-mcp:pull,push" \
|
||||
| python3 -c "import sys,json;print(json.load(sys.stdin).get('token',''))")
|
||||
echo "bearer token length: ${#BT}"
|
||||
curl -s -o /dev/null -w "bearer tags/list: HTTP %{http_code}\n" \
|
||||
-H "Authorization: Bearer $BT" \
|
||||
"https://gitea.williammiceli.systems/v2/hermes/grafana-mcp/tags/list" || true
|
||||
|
||||
- name: Build
|
||||
if: steps.skip.outputs.skip != 'true'
|
||||
run: |
|
||||
VER="${{ steps.ver.outputs.version }}"
|
||||
docker build --build-arg MCP_GRAFANA_VERSION="$VER" \
|
||||
-t "$IMAGE:v$VER" -t "$IMAGE:latest" .
|
||||
|
||||
- name: Push
|
||||
if: steps.skip.outputs.skip != 'true'
|
||||
run: |
|
||||
VER="${{ steps.ver.outputs.version }}"
|
||||
docker push "$IMAGE:v$VER"
|
||||
docker push "$IMAGE:latest"
|
||||
+62
@@ -0,0 +1,62 @@
|
||||
# grafana-mcp — Grafana's official MCP server (grafana/mcp-grafana) as a
|
||||
# streamable-HTTP container for cluster0.
|
||||
#
|
||||
# Built by Gitea Actions (.gitea/workflows/build.yaml):
|
||||
# - on push to main
|
||||
# - weekly Mon 06:00 UTC (resolves the newest upstream release, skips if
|
||||
# the tag is already published) — lands ~7h BEFORE the cluster0
|
||||
# image-update cron (Mon 13:00 UTC) so the Monday pass bumps the
|
||||
# deployment tag like any other app.
|
||||
# - on manual workflow_dispatch with an explicit version
|
||||
#
|
||||
# The upstream release is a SINGLE static Go binary, fetched from the pinned
|
||||
# GitHub release and verified against the release's own sha256 checksums
|
||||
# file. No vendored code. Published as
|
||||
# gitea.williammiceli.systems/hermes/grafana-mcp:v<version> (plus :latest).
|
||||
#
|
||||
# The upstream Grafana credentials (GRAFANA_URL is baked in as a default,
|
||||
# GRAFANA_SERVICE_ACCOUNT_TOKEN is deploy-time only) are NEVER baked into
|
||||
# this image — the token comes from the server's own Kubernetes secret
|
||||
# (Kubernetes_Cluster0, namespace ai-0-1) at deploy time.
|
||||
|
||||
ARG MCP_GRAFANA_VERSION=v1.1.0
|
||||
|
||||
FROM docker.io/library/alpine:3.22 AS fetch
|
||||
|
||||
ARG MCP_GRAFANA_VERSION
|
||||
ARG TARGETARCH
|
||||
|
||||
# curl + tar + coreutils (sha256sum/grep) to fetch and verify the pinned
|
||||
# upstream release. ca-certificates for HTTPS to github.com.
|
||||
RUN apk add --no-cache curl tar coreutils ca-certificates
|
||||
|
||||
WORKDIR /tmp
|
||||
|
||||
# Fetch the release checksums file and the linux/${TARGETARCH} tarball, then
|
||||
# verify the tarball's sha256 against the checksums file. Fails the build on
|
||||
# any mismatch (checksums.txt entries: "<sha256> mcp-grafana_Linux_<arch>.tar.gz").
|
||||
RUN set -eux; \
|
||||
SHORT="${MCP_GRAFANA_VERSION#v}"; \
|
||||
case "$TARGETARCH" in \
|
||||
amd64) ASSET="Linux_x86_64" ;; \
|
||||
arm64) ASSET="Linux_arm64" ;; \
|
||||
*) echo "unsupported TARGETARCH: $TARGETARCH"; exit 1 ;; \
|
||||
esac; \
|
||||
curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${SHORT}_checksums.txt" -o checksums.txt; \
|
||||
curl -fsSL "https://github.com/grafana/mcp-grafana/releases/download/${MCP_GRAFANA_VERSION}/mcp-grafana_${ASSET}.tar.gz" -o mcp.tar.gz; \
|
||||
grep "mcp-grafana_${ASSET}.tar.gz" checksums.txt | sha256sum -c -; \
|
||||
tar -xzf mcp.tar.gz mcp-grafana; \
|
||||
chmod +x mcp-grafana
|
||||
|
||||
# The binary is fully static (no INTERP segment) — scratch is sufficient.
|
||||
FROM scratch
|
||||
|
||||
COPY --from=fetch /tmp/mcp-grafana /mcp-grafana
|
||||
|
||||
EXPOSE 3000
|
||||
|
||||
# streamable-http on all interfaces, port 3000 (the service port).
|
||||
# --allowed-hosts is supplied by the Deployment args (DNS-rebinding
|
||||
# protection: only the in-cluster service hostname is trusted).
|
||||
# GRAFANA_URL + GRAFANA_SERVICE_ACCOUNT_TOKEN come from the pod env.
|
||||
ENTRYPOINT ["/mcp-grafana", "--transport", "streamable-http", "--address", "0.0.0.0:3000"]
|
||||
@@ -0,0 +1,49 @@
|
||||
# grafana-mcp
|
||||
|
||||
[Grafana's official MCP server](https://github.com/grafana/mcp-grafana)
|
||||
(`mcp-grafana`) packaged as a container image for cluster0, served over
|
||||
streamable-HTTP so the Hermes agent (namespace `ai-0`) can call it as an
|
||||
HTTP MCP server.
|
||||
|
||||
## What's in this repo
|
||||
|
||||
| File | Purpose |
|
||||
|---|---|
|
||||
| `Dockerfile` | Multi-stage: fetches the pinned upstream release binary from GitHub (sha256-verified against the release's own checksums file) and copies it into `scratch` (the binary is fully static). |
|
||||
| `.gitea/workflows/build.yaml` | Builds + pushes `gitea.williammiceli.systems/hermes/grafana-mcp:v<version>` (+ `latest`). Triggers: push to main, **weekly Mon 06:00 UTC** (lands before the cluster0 image-update cron at Mon 13:00 UTC), and manual dispatch. Skips if the tag already exists. |
|
||||
|
||||
The upstream version is pinned via the `MCP_GRAFANA_VERSION` build-arg
|
||||
(default `v1.1.0`); the workflow resolves the newest GitHub release and
|
||||
skips the build when it's already published.
|
||||
|
||||
## Deployment (cluster0)
|
||||
|
||||
Manifests: `William/Kubernetes_Cluster0`, app dir
|
||||
`cluster0 (Personal)/#active/#applications/ai-0 (Hermes Agent)/ai-0-1 (Grafana MCP)/`,
|
||||
namespace `ai-0-1`.
|
||||
|
||||
Runtime env (set by the Deployment, from the server's own Infisical-managed
|
||||
secret — never baked into the image):
|
||||
|
||||
| Var | Value |
|
||||
|---|---|
|
||||
| `GRAFANA_URL` | `http://grafana-service.personal-0.svc.cluster.local` |
|
||||
| `GRAFANA_SERVICE_ACCOUNT_TOKEN` | Grafana service-account token (Infisical project `ai-0-1`) |
|
||||
| `ALLOWED_HOSTS` (Deployment env, read by args) | `grafana-mcp-service.ai-0-1.svc.cluster.local` |
|
||||
|
||||
The service is **ClusterIP-only** (no Ingress/NodePort): it exposes Will's
|
||||
Grafana instance, so only in-cluster consumers can reach it. Hermes consumes
|
||||
it via `http://grafana-mcp-service.ai-0-1.svc.cluster.local:3000/mcp`.
|
||||
|
||||
### Grafana service account
|
||||
|
||||
Create in Grafana (Administration → Service Accounts) with the **Editor**
|
||||
built-in role (upstream-recommended quick setup; covers all read + most
|
||||
write tools) or granular RBAC scopes, then add a token and store it as
|
||||
`GRAFANA_SERVICE_ACCOUNT_TOKEN` in Infisical project `ai-0-1` (env `prod`).
|
||||
|
||||
## Registry auth for pushes
|
||||
|
||||
The workflow uses a scoped PAT (`write:package`) stored as repo Actions
|
||||
secret `REGISTRY_TOKEN` — Gitea's container registry rejects scoped token
|
||||
requests from the Actions job token (upstream #23642).
|
||||
Reference in New Issue
Block a user