Secured way of handling credentails in grafana

Grafana Configuration
1

Grafana configuration has few parameters which are considered as sensitive data. Follwoing are few examples:

database password
security admin_password, secret_key

Based on grafana documentation, Configurations including credentials can be passed to grafana in following ways:

  1. Plaintext in grafana.ini
  2. via env variable
  3. via file provider
  4. via vault.

As vault provider is only available in Grafana Enterprise, we are left with first 3 options. Option 3 might be more secured way in OSS grafana by controlling file ownership & file permission.

Could you please let us know if there is any better way to handle sensitive data in OSS grafana.

2
3

How are you deploying grafana?

4

Grafana is started using grafana binary in VNF(linux machine) and grafana.ini is passed as argument. Based on our understanding, admin username and admin password should be there in plain text in grafana.ini. We are looking for secured way of handling admin username as well as admin password.