influxdata / influxdata/influxdb
InfluxDB 2.0 Vault storage enhancement request
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
We have recently integrated InfluxDB 2.0.2 with Hashicorp vault and it is apparent that InfluxDB can only write secrets to `/secret/`
This makes structuring the vault difficult and secrets shared between InfluxDB and other applications, hard to locate when the mapping of the InfluxDB orgID to organisation name may not be known.
Secondly, Influx's use of `/secret` makes it difficult to implement meaningful policies within Vault, such as restricting teams to a specific vault path or to credentials stored within the organisations.
A more suitable solution would be to allow the mount, path and organisation ID to be controlled from flags or environment variables configurable at application startup or through `config.[yaml|toml|json]`
A potential configuration map for this might be:
```
vault-mount: /secret
vault-path: apps/influxdb
vault-org: orgName
```
Of these, `vault-mount` would need to be a valid kv2 mount in Vault, `vault-path` would be optionally empty and `vault-org` would be set to one of `orgId`, `orgName` or `none` to not require the organisation as part of the path structure.
This would give greater flexibility and control over how InfluxDB secrets were accessed in vault and allow policies to be developed controlling who and how those secrets are managed.
Contributor guide
Research direction
No files or tests are named in the issue. Start by locating the existing Vault storage configuration and handling of the /secret path, then determine how startup flags, environment variables, or config.[yaml|toml|json] would represent the mount, path, and organisation mode. Done means supported configuration allows the requested Vault paths and organisation ID, name, or omission while preserving valid KV2 access.
Written by the indexing model from the issue text.
Assessment
- Domain
- databases, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100