fix(grafana): tmp dir permissions for plugin installation in grafana v12.4.0+ (#2574)

* fix(grafana): add emptyDir for tmp

* chore(grafana): deprecate TMPDIR env

Author: weisdd

controllers/config/operator_constants.go

@@ -10,6 +10,7 @@ const (
 	GrafanaLogsPath               = "/var/log/grafana"
 	GrafanaPluginsPath            = "/var/lib/grafana/plugins"
 	GrafanaProvisioningPath       = "/etc/grafana/provisioning/"
+	GrafanaTmpPath                = "/tmp"
 	GrafanaDashboardsRuntimeBuild = "/tmp/dashboards"
 
 	// Default limits
@@ -40,6 +41,7 @@ const (
 	GrafanaProvisionNotifierVolumeName  = "grafana-provision-notifiers"
 	GrafanaLogsVolumeName               = "grafana-logs"
 	GrafanaDataVolumeName               = "grafana-data"
+	GrafanaTmpVolumeName                = "grafana-tmp"
 	SecretsMountDir                     = "/etc/grafana-secrets/" // #nosec G101
 	ConfigMapsMountDir                  = "/etc/grafana-configmaps/"
 )

controllers/reconcilers/grafana/deployment_reconciler.go

@@ -120,6 +120,12 @@ func getVolumes(cr *v1beta1.Grafana, scheme *runtime.Scheme) []corev1.Volume {
 				EmptyDir: &corev1.EmptyDirVolumeSource{},
 			},
 		},
+		{
+			Name: config.GrafanaTmpVolumeName,
+			VolumeSource: corev1.VolumeSource{
+				EmptyDir: &corev1.EmptyDirVolumeSource{},
+			},
+		},
 	}
 
 	return volumes
@@ -142,6 +148,10 @@ func getVolumeMounts(cr *v1beta1.Grafana, scheme *runtime.Scheme) []corev1.Volum
 			Name:      config.GrafanaLogsVolumeName,
 			MountPath: config.GrafanaLogsPath,
 		},
+		{
+			Name:      config.GrafanaTmpVolumeName,
+			MountPath: config.GrafanaTmpPath,
+		},
 	}
 
 	return mounts
@@ -173,11 +183,6 @@ func getContainers(cr *v1beta1.Grafana, scheme *runtime.Scheme, vars *v1beta1.Op
 			Name:  "GF_INSTALL_PLUGINS",
 			Value: vars.Plugins,
 		},
-		{
-			// sets location where temporary files can be written (e.g. plugin downloads)
-			Name:  "TMPDIR",
-			Value: config.GrafanaDataPath,
-		},
 		{
 			// useful for unified alerting gossiping in HA-enabled setups
 			Name: "POD_IP",