influxdata / influxdata/influxdb

InfluxDB 2.0 Vault storage enhancement request

Open
#20,177 0 comments 4 reactions 0 assignees View on GitHub
area/2.x kind/feature-request
Dominant language
Rust
Stars
31.7k
Forks
3.7k
Avg merge
13h 37m
Merged PRs (30d)
8

Description

We have recently integrated InfluxDB 2.0.2 with Hashicorp vault and it is apparent that InfluxDB can only write secrets to `/secret/`

This makes structuring the vault difficult and secrets shared between InfluxDB and other applications, hard to locate when the mapping of the InfluxDB orgID to organisation name may not be known.

Secondly, Influx's use of `/secret` makes it difficult to implement meaningful policies within Vault, such as restricting teams to a specific vault path or to credentials stored within the organisations.

A more suitable solution would be to allow the mount, path and organisation ID to be controlled from flags or environment variables configurable at application startup or through `config.[yaml|toml|json]`

A potential configuration map for this might be:

```
vault-mount: /secret
vault-path: apps/influxdb
vault-org: orgName
```
Of these, `vault-mount` would need to be a valid kv2 mount in Vault, `vault-path` would be optionally empty and `vault-org` would be set to one of `orgId`, `orgName` or `none` to not require the organisation as part of the path structure.

This would give greater flexibility and control over how InfluxDB secrets were accessed in vault and allow policies to be developed controlling who and how those secrets are managed.

Contributor guide

Open the contributing guide

Research direction

No files or tests are named in the issue. Start by locating the existing Vault storage configuration and handling of the /secret path, then determine how startup flags, environment variables, or config.[yaml|toml|json] would represent the mount, path, and organisation mode. Done means supported configuration allows the requested Vault paths and organisation ID, name, or omission while preserving valid KV2 access.

Written by the indexing model from the issue text.

Assessment

Domain
databases, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.