influxdata / influxdata/influxdb

influx CLI client with -type=flux ignores -ssl and -unsafeSsl flags

Open
#19,150 0 comments 3 reactions 1 assignee View on GitHub

@dgnorton is already working on this.

Since Aug 3, 2020.

1.x kind/bug
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

Steps to reproduce:
List the minimal actions needed to reproduce the behavior.

  1. Setup auth for influxdb with SSL (self-signed certs) -- see config below
  2. Create admin/admin user
  3. Connect with -ssl -unsafeSsl -type=flux flags
  4. Try to query using flux (see below)

Expected behavior:

SSL certificate is accepted.

Actual behavior:

root@monitoring:/data/influxdb# docker exec -it influxdb influx -type=flux -ssl -unsafeSsl -username 'admin' -password  'admin' -host influxdb
Connected to https://influxdb:8086 version 1.8.1
InfluxDB shell version: 1.8.1
> from(bucket:"telegraf/autogen")
Error: Post https://influxdb:8086: x509: certificate signed by unknown authority

Environment info:

  • System info: docker
  • InfluxDB version: 1.8.1
  • Other relevant environment details: debian

Config:

Note: config variables such as {{ influxdb_docker_port }}are rendered with jinja2 template engine (ansible).

reporting-disabled = true
bind-address = "127.0.0.1:{{ influxdb_docker_port }}"

[meta]
  dir = "/var/lib/influxdb/meta"
  retention-autocreate = true
  logging-enabled = true

[data]
  dir = "/var/lib/influxdb/data"
  index-version = "inmem"
  wal-dir = "/var/lib/influxdb/wal"
  wal-fsync-delay = "0s"
  validate-keys = false
  query-log-enabled = true
  cache-max-memory-size = 1073741824
  cache-snapshot-memory-size = 26214400
  cache-snapshot-write-cold-duration = "10m0s"
  compact-full-write-cold-duration = "4h0m0s"
  compact-throughput = 50331648
  compact-throughput-burst = 50331648
  max-series-per-database = 1000000
  max-values-per-tag = 100000
  max-concurrent-compactions = 0
  max-index-log-file-size = 1048576
  series-id-set-cache-size = 100
  series-file-max-concurrent-snapshot-compactions = 0
  trace-logging-enabled = false
  tsm-use-madv-willneed = false

[coordinator]
  write-timeout = "10s"
  max-concurrent-queries = 0
  query-timeout = "0s"
  log-queries-after = "0s"
  max-select-point = 0
  max-select-series = 0
  max-select-buckets = 0

[retention]
  enabled = true
  check-interval = "30m0s"

[shard-precreation]
  enabled = true
  check-interval = "10m0s"
  advance-period = "30m0s"

[monitor]
  store-enabled = true
  store-database = "_internal"
  store-interval = "10s"

[subscriber]
  enabled = true
  http-timeout = "30s"
  insecure-skip-verify = false
  ca-certs = ""
  write-concurrency = 40
  write-buffer-size = 1000

[http]
  enabled = true
  bind-address = ":8086"
  auth-enabled = true
  log-enabled = true
  suppress-write-log = false
  write-tracing = false
  flux-enabled = true
  flux-log-enabled = true
  pprof-enabled = true
  pprof-auth-enabled = false
  debug-pprof-enabled = false
  # https://github.com/influxdata/chronograf/issues/5545 ping-auth-enabled = true does not work with self-signed certs
  ping-auth-enabled = false
  https-enabled = true
  https-certificate = "{{ influxdb_docker_data_dir }}/server-cert.pem"
  https-private-key = "{{ influxdb_docker_data_dir }}/server-key.pem"
  max-row-limit = 0
  max-connection-limit = 0
  shared-secret = "{{ influxdb_shared_secret }}"
  realm = "InfluxDB"
  unix-socket-enabled = false
  unix-socket-permissions = "0777"
  bind-socket = "/var/run/influxdb.sock"
  max-body-size = 25000000
  access-log-path = ""
  max-concurrent-write-limit = 0
  max-enqueued-write-limit = 0
  enqueued-write-timeout = 30000000000

[logging]
  format = "auto"
  level = "info"
  suppress-logo = false

[[graphite]]
  enabled = false
  bind-address = ":2003"
  database = "graphite"
  retention-policy = ""
  protocol = "tcp"
  batch-size = 5000
  batch-pending = 10
  batch-timeout = "1s"
  consistency-level = "one"
  separator = "."
  udp-read-buffer = 0

[[collectd]]
  enabled = false
  bind-address = ":25826"
  database = "collectd"
  retention-policy = ""
  batch-size = 5000
  batch-pending = 10
  batch-timeout = "10s"
  read-buffer = 0
  typesdb = "/usr/share/collectd/types.db"
  security-level = "none"
  auth-file = "/etc/collectd/auth_file"
  parse-multivalue-plugin = "split"

[[opentsdb]]
  enabled = false
  bind-address = ":4242"
  database = "opentsdb"
  retention-policy = ""
  consistency-level = "one"
  tls-enabled = false
  certificate = "/etc/ssl/influxdb.pem"
  batch-size = 1000
  batch-pending = 5
  batch-timeout = "1s"
  log-point-errors = true

[[udp]]
  enabled = false
  bind-address = ":8089"
  database = "udp"
  retention-policy = ""
  batch-size = 5000
  batch-pending = 10
  read-buffer = 0
  batch-timeout = "1s"
  precision = ""

[continuous_queries]
  log-enabled = true
  enabled = true
  query-stats-enabled = false
  run-interval = "1s"

[tls]
  min-version = ""
  max-version = ""

Logs:

Error: Post https://influxdb:8086: x509: certificate signed by unknown authority

Performance:

not relevant

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.