New Authentication Type: Support to retrieve a Bearer Token from the Google Metadata Service when running in a Compute

[ArchiZ0]

This is a variation of the Bearer Token authentication type. When running Grafana in a Google Cloud Compute, the metadata service is always available to retrieve a valid and always fresh Bearer token. This will use the Service Account the Compute is running with as identity. This will allow querying any service running on Google Cloud (custom, like Cloud Run, Function, etc. or Google APIs).

The required values are:

• URL : GET http://metadata/computeMetadata/v1/instance/service-accounts/default/identity
• Header : Metadata-Flavor: Google
• Query String : audience=XXXXXX

The URL and Header can be hardcoded, but the audience (Query String) need to be configurable.

I have a "working" workaround right now but it's not super secure / ideal:

1. Add a variable to store the token by querying the metadata server
2. On each visualization when I need Infinity, I need to add an "Authorization" header that point to that variable

While this is working, the panel complain about it and also, the variable (and token) is visible in the URL.

[Junglur]

I am doing something similar but for authentication. I have a different URL that I need to hit with a bearer token which will generate an AccessToken. Once I have that access token I can then query other API endpoints.

There appears to be something close for this under the OAuth2 Auth Type where you can put in a Token URL but the API I'm accessing doesn't support that standard.

Would be great to have an Auth Type that you can specify and auth URL to generate an AccessToken with and then filter it by JSON fields or perhaps regex.