Manage datasets and auth tokens as code

Manage Dash0 datasets and auth tokens with the Dash0 Terraform provider, the Dash0 CLI, or the Dash0 API, and keep them in the same repository as your dashboards and check rules.

Until now, you created datasets and auth tokens by hand in Dash0, even when the dashboards and check rules inside a dataset already lived in your repository.

You can now define both in YAML, as Dash0Dataset and Dash0AuthToken documents, and manage them with the Dash0 Terraform provider, the Dash0 CLI, or the Dash0 API.

How it works

A deleted dataset's dashboards, views, and check rules stay around for 30 days, and recreating the dataset with the same slug in that time brings them back.

Dash0 shows a token's secret once, when it creates the token, and the secret never changes. To rotate a token, create a second one, move your services to it, and delete the old one. Only an admin, or an auth token with the * action and no dataset or signal restriction, can manage auth tokens.

Dash0 Terraform provider

Since v1.20.0:

hcl

staging.tfresource "dash0_dataset" "staging" {
  dataset_yaml = <<-YAML
    apiVersion: dash0.com/v1alpha1
    kind: Dash0Dataset
    metadata:
      name: Staging
    spec:
      retention:
        logs: 60d
  YAML
}

resource "dash0_auth_token" "staging_ingest" {
  auth_token_yaml = <<-YAML
    apiVersion: dash0.com/v1alpha1
    kind: Dash0AuthToken
    metadata:
      name: Staging ingestion
    spec:
      actions:
        - ingest:*
      scope:
        datasets:
          restriction: restricted
          slugs:
            - ${dash0_dataset.staging.id}
      ingestion:
        defaultDataset: ${dash0_dataset.staging.id}
  YAML
}

output "staging_ingest_token" {
  value     = dash0_auth_token.staging_ingest.token
  sensitive = true
}

Terraform hides the sensitive token attribute in its output but writes the secret to your state in plain text, so lock down your state file.

Dash0 CLI

Datasets arrived in v1.19.0 and auth tokens in v1.20.0, both as experimental commands that need the --experimental (-X) flag:

datasets-and-tokens.sh# apply creates datasets before the dashboards and check rules that live in them
dash0 -X apply -f staging-dataset.yaml
dash0 -X datasets list
dash0 -X datasets get staging -o yaml

# Auth tokens have their own commands, because apply has no safe place to put a new secret.
# The secret is shown once. In CI or a pipe, write it to a file instead.
dash0 -X auth-tokens create -f staging-ingest-token.yaml --secret-file "$RUNNER_TEMP/staging-ingest-token"
dash0 -X auth-tokens list

Read the docs: dash0_dataset, dash0_auth_token, Dash0 CLI commands