From 5335cdf4e5b4b5a28d41bf83e1672447b49ae1f8 Mon Sep 17 00:00:00 2001
From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com>
Date: Wed, 18 Jan 2023 14:44:56 +0000
Subject: [PATCH] [v9.3.x] Docs: Renderer token (#61682)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Docs: Renderer token (#59560)

* Docs: renderer token

* Apply suggestions from code review

Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>

* Update docs/sources/setup-grafana/image-rendering/_index.md

* Update docs/sources/setup-grafana/configure-grafana/_index.md

* makes prettier

Co-authored-by: Joan López de la Franca Beltran <joanjan14@gmail.com>
Co-authored-by: Joan López de la Franca Beltran <5459617+joanlopez@users.noreply.github.com>
Co-authored-by: Christopher Moyer <35463610+chri2547@users.noreply.github.com>
Co-authored-by: Chris Moyer <chris.moyer@grafana.com>
(cherry picked from commit d042c0b30b4962497480feee3f57f24c6050ea4e)

Co-authored-by: Leonard Gram <leo@xlson.com>
---
 .../setup-grafana/configure-grafana/_index.md |  6 ++++
 .../setup-grafana/image-rendering/_index.md   | 28 +++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/docs/sources/setup-grafana/configure-grafana/_index.md b/docs/sources/setup-grafana/configure-grafana/_index.md
index f69a633dc57..9b113806842 100644
--- a/docs/sources/setup-grafana/configure-grafana/_index.md
+++ b/docs/sources/setup-grafana/configure-grafana/_index.md
@@ -1781,6 +1781,12 @@ This option does not require any configuration.
 
 Options to configure a remote HTTP image rendering service, e.g. using https://github.com/grafana/grafana-image-renderer.
 
+#### renderer_token
+
+> **Note**: Available in Grafana v9.1.2 and Image Renderer v3.6.1 or later.
+
+An auth token will be sent to and verified by the renderer. The renderer will deny any request without an auth token matching the one configured on the renderer.
+
 ### server_url
 
 URL to a remote HTTP image renderer service, e.g. http://localhost:8081/render, will enable Grafana to render panels and dashboards to PNG-images using HTTP requests to an external service.
diff --git a/docs/sources/setup-grafana/image-rendering/_index.md b/docs/sources/setup-grafana/image-rendering/_index.md
index 0bf6c283e0d..40ea9cf221a 100644
--- a/docs/sources/setup-grafana/image-rendering/_index.md
+++ b/docs/sources/setup-grafana/image-rendering/_index.md
@@ -54,6 +54,34 @@ docker run -d --name=renderer --network=host -v /some/path/config.json:/usr/src/
 
 You can see a docker-compose example using a custom configuration file [here](https://github.com/grafana/grafana-image-renderer/tree/master/devenv/docker/custom-config).
 
+### Security
+
+> **Note:** This feature is available in Image Renderer v3.6.1 and later.
+
+You can restrict access to the rendering endpoint by specifying a secret token. The token should be configured in the Grafana configuration file and the renderer configuration file. This token is important when you run the plugin in remote rendering mode.
+
+Renderer versions v3.6.1 or later require a Grafana version with this feature. These include:
+
+- Grafana v9.1.2 or later
+- Grafana v9.0.8 or later patch releases
+- Grafana v8.5.11 or later patch releases
+- Grafana v8.4.11 or later patch releases
+- Grafana v8.3.11 or later patch releases
+
+```bash
+AUTH_TOKEN=-
+```
+
+```json
+{
+  "security": {
+    "authToken": "-"
+  }
+}
+```
+
+See the [Grafana configuration]({{< relref "../configure-grafana/#renderer_token" >}}) for how to configure the token in Grafana.
+
 ### Rendering mode
 
 You can instruct how headless browser instances are created by configuring a rendering mode. Default is `default`, other supported values are `clustered` and `reusable`.