Documentation Grafana documentation As code and provisioning Git Sync Set up Git Sync Set up Git Sync with Terraform

Set up Git Sync with Terraform

You can configure Git Sync via the Grafana provisioning app platform using Terraform.

To do so, follow these steps:

1. Read Before you begin.
2. Configure the Grafana Terraform provider.
3. Create the resources for Git Sync.

Before you begin

Before you begin, make sure to have the following:

• A Grafana Cloud account or an on-prem Grafana instance.
• Administrator permissions in your Grafana stack/instance.
• Terraform 1.11 or later installed on your machine. Refer to the Terraform install documentation to learn more.

You need the three files described in this document to set up Git Sync with Terraform:

• Grafana provider configuration file
• Connection resource
• Repository resource

Save all of them in the same directory.

Configure the Grafana Terraform provider

Configure the Grafana Terraform provider with the authentication required to set up Git Sync.

1. Create a service account and token in Grafana. For more information refer to Service account tokens or Create and manage a Grafana Cloud stack using Terraform.

2. Make sure that the token has the Admin or the Provisioning:Repositories writer permission.

3. Create a file named main.tf and add the following:

   terraform Copy

      terraform {
        required_providers {
          grafana = {
            source  = "grafana/grafana"
            version = ">= 4.28.1"
          }
        }
      }
   
      provider "grafana" {
        url = "https://'<STACK_URL>'.grafana.net/"
        auth = "<YOUR_SERVICE_ACCOUNT_TOKEN>"
        stack_id = "<YOUR_STACK_ID>"
      }

Replace the following field values:

• <STACK_URL>: The URL of your Grafana stack. For example, https://my-stack.grafana.net/.
• <YOUR_SERVICE_ACCOUNT_TOKEN>: The service account token that you created, or <USERNAME>:<PASSWORD> for basic auth.
• <YOUR_STACK_ID>: The Grafana stack ID, if you’re using a Grafana Cloud stack.

Create the resources to use Git Sync

You need to create one or two resources to configure and manage Git Sync:

• The connection resource configures your Git provider credentials. This resource is only needed if you’re connecting with OAuth or GitHub App.
• The repository resource configures the Git repository to sync Grafana resources with.

For better understanding of the required resources, refer to Git Sync key concepts.

Configure the Connection resource

The Connection resource manages the Git Sync connections used by repositories for provider authentication.

terraform Copy

resource "grafana_apps_provisioning_connection_v0alpha1" "example" {
  metadata {
    uid = "my-connection"
  }

  spec {
    title       = "My Connection"
    description = "Connection used by a folder-scoped Git Sync repository"
    type        = "<CONNECTION_TYPE>" # githubOAuth, githubEnterpriseOAuth, gitlabOAuth, bitbucketOAuth, or gitOAuth
    url         = "https://connection.com"
  }

  secure {
    private_key = {
      create = filebase64("${path.module}/private-key.pem")
    }
  }
  secure_version = 1
}

Replace the following field values:

• <CONNECTION_TYPE>: The Git provider type. Possible values are githubOAuth, githubEnterpriseOAuth, gitlabOAuth, bitbucketOAuth, and gitOAuth.

For more details, optional fields, and examples, refer to Connection resource in the Terraform registry.

Configure the Repository resource

The Repository resource manages your Git Sync repositories for provisioning dashboards and related resources.

For example, for a GitHub repository with token authentication:

terraform Copy

resource "grafana_apps_provisioning_repository_v0alpha1" "example" {
  metadata {
    uid = "my-github-folder-repo"
  }

  spec {
    title       = "My GitHub Folder Repository"
    description = "Folder-scoped GitHub repository authenticated directly with a token"
    type        = "github"

    workflows = "<YOUR-WORKFLOWS>" # For example, ["write", "branch"]

    sync {
      enabled          = "<SYNC_ENABLED>"
      target           = "<YOUR_SYNC_TARGET>"
      interval_seconds = "<SYNC_INTERVAL>"
    }

    github {
      url    = "<YOUR_GITHUB_REPO_URL>"
      branch = "<SYNC_BRANCH>"
      path   = "grafanatftest"
    }

    webhook {
      base_url = "https://grafana.example.com"
    }
  }

  secure {
    token = {
      create = "replace-me"
    }
  }
  secure_version = 1
}

Replace the following field values:

• <YOUR_WORKFLOWS>: Array with the workflows you want Git Sync to use. For example, ["write", "branch"]. Use write to allow direct commits, branch to force using PRs, or leave blank if the repository is read-only.
• <SYNC_ENABLED>: Whether you want to enable automatic synchronization. Allowed values are true and false.
• <YOUR_SYNC_TARGET>: Where you want to place your provisioned resources. Git Sync supports two sync targets: folder (default) creates a folder named after the repository and places synced resources inside it, while folderless places synced resources at the top level without creating a wrapper folder. Refer to Sync targets for details.
• <SYNC_INTERVAL>: How often your Grafana instance automatically pulls updates from the folder managed with Git Sync. The default value is 300 seconds in Grafana Cloud, and 60 seconds in Grafana OSS/Enterprise.
• <YOUR_GITHUB_REPO_URL>: The repository you want to synchronize using Git Sync. For example, https://github.com/example/grafana-dashboards.
• <SYNC_BRANCH>: The branch where you want to perform the sync. For example, main.

For more details and examples such as a GitHub repository via GitHub App Connection or a GitLab/Bitbucket repository with a token authentication, refer to Repository resource in the Terraform registry.