-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Feature/influxdb non admin token #153
base: main
Are you sure you want to change the base?
Conversation
done | ||
|
||
# Get the bucket ID | ||
BUCKET_ID=$(curl -s -X GET http://{{INFLUXDB_HOSTNAME}}:8086/api/v2/buckets -H 'Authorization: Token "{{INFLUXDB_TOKEN}}"' -H "Accept: application/json" | jq -r '.buckets[] | select(.name=="{{DOCKER_INFLUXDB_INIT_BUCKET}}") | .id') |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Even though we create just one bucket, there can be multiple in the influx in the end if created manually by the user.
USER_ID=$(curl -s -X GET http://{{INFLUXDB_HOSTNAME}}:8086/api/v2/users -H 'Authorization: Token "{{INFLUXDB_TOKEN}}"' -H "Accept: application/json" | jq -r '.users[] | select(.name=="{{DOCKER_INFLUXDB_INIT_USERNAME}}") | .id') | ||
|
||
# Create the non-admin token using the InfluxDB API v2 | ||
curl -X POST http://{{INFLUXDB_HOSTNAME}}:8086/api/v2/authorizations \ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we need to get the token itself and send it to vault.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
even if you manage to send the token into vault, I don't know how to effectively distribute it.
but I can probably somehow solve this in the influxdb tech.
@@ -40,6 +40,26 @@ nginx: | |||
- rewrite ^/influxdb/(.*) /$1 break | |||
- proxy_pass http://upstream-influxdb | |||
|
|||
sherpas: |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
sherpa runs with every UP. so it must be restartable without breaking antyhing or creating bambilion of new tokens.
This is about generating a non admin token for the services to use. I am kind of lost what variables I can use, but I think I may have found them (needs to be checked). Also, there is one thing remaining, how do I pass on the generated token to be used. The output of the script looks like this:
{
"id":"0dd2e35923eb7000",
"token":"t4ZRXhJqhNoqA0R7Z6Fz5X_tkvgzEXfreoZUpMwp801M31b31M7xg10tYpmD1CDO4pZuWxR9b3G0p_BpMSMy5Q==",
"status":"active",
"description":"Non-admin user with write access",
"orgID":"29ecabe6fff1d77b",
"org":"myorg",
"userID":"0dd2e0e2c641d000",
"user":"myuser",
"permissions":[
{
"action":"write",
"resource":{
"type":"buckets",
"id":"890ceddae8caa7af",
"name":"mybucket"
}
}
],
"links":{
"self":"/api/v2/authorizations/0dd2e35923eb7000",
"user":"/api/v2/users/0dd2e0e2c641d000"
},
"createdAt":"2024-10-17T17:39:18.799029086Z",
"updatedAt":"2024-10-17T17:39:18.799029086Z"
}
I will neet to extract the token somehow.