Files

T

build / build (push) Failing after 13s

Details

Add Dockerfile + Gitea Actions workflow for mcp-grafana container

- Dockerfile: fetches pinned upstream release binary (static Go) from
  grafana/mcp-grafana GitHub releases, sha256-verified against the
  release's own checksums file, runs from scratch.
- Workflow: push-to-main / weekly Mon 06:00 UTC / manual dispatch;
  resolves newest release, skips if tag published, pushes
  gitea.williammiceli.systems/hermes/grafana-mcp:v<ver> + :latest.
- REGISTRY_TOKEN repo Actions secret already provisioned.

2026-08-15 22:24:37 +00:00

2.3 KiB

Raw Permalink Blame History

grafana-mcp

Grafana's official MCP server (mcp-grafana) packaged as a container image for cluster0, served over streamable-HTTP so the Hermes agent (namespace ai-0) can call it as an HTTP MCP server.

What's in this repo

File	Purpose
`Dockerfile`	Multi-stage: fetches the pinned upstream release binary from GitHub (sha256-verified against the release's own checksums file) and copies it into `scratch` (the binary is fully static).
`.gitea/workflows/build.yaml`	Builds + pushes `gitea.williammiceli.systems/hermes/grafana-mcp:v<version>` (+ `latest`). Triggers: push to main, weekly Mon 06:00 UTC (lands before the cluster0 image-update cron at Mon 13:00 UTC), and manual dispatch. Skips if the tag already exists.

The upstream version is pinned via the MCP_GRAFANA_VERSION build-arg (default v1.1.0); the workflow resolves the newest GitHub release and skips the build when it's already published.

Deployment (cluster0)

Manifests: William/Kubernetes_Cluster0, app dir cluster0 (Personal)/#active/#applications/ai-0 (Hermes Agent)/ai-0-1 (Grafana MCP)/, namespace ai-0-1.

Runtime env (set by the Deployment, from the server's own Infisical-managed secret — never baked into the image):

Var	Value
`GRAFANA_URL`	`http://grafana-service.personal-0.svc.cluster.local`
`GRAFANA_SERVICE_ACCOUNT_TOKEN`	Grafana service-account token (Infisical project `ai-0-1`)
`ALLOWED_HOSTS` (Deployment env, read by args)	`grafana-mcp-service.ai-0-1.svc.cluster.local`

The service is ClusterIP-only (no Ingress/NodePort): it exposes Will's Grafana instance, so only in-cluster consumers can reach it. Hermes consumes it via http://grafana-mcp-service.ai-0-1.svc.cluster.local:3000/mcp.

Grafana service account

Create in Grafana (Administration → Service Accounts) with the Editor built-in role (upstream-recommended quick setup; covers all read + most write tools) or granular RBAC scopes, then add a token and store it as GRAFANA_SERVICE_ACCOUNT_TOKEN in Infisical project ai-0-1 (env prod).

Registry auth for pushes

The workflow uses a scoped PAT (write:package) stored as repo Actions secret REGISTRY_TOKEN — Gitea's container registry rejects scoped token requests from the Actions job token (upstream #23642).