influxdata / influxdata/influxdb
Cannot init a new Stack from cli using an "All Access" token
- Dominant language
- Rust
- Stars
- 31.7k
- Forks
- 3.7k
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 8
Description
__Steps to reproduce:__
List the minimal actions needed to reproduce the behavior.
1. Create a new InfluxDB 2.0.3 instance
2. Create a token with "All Access" permissions
3. Configure influx CLI to use the token and set the default org
3. from the CLI run `influx stacks init -n TEST`
__Expected behavior:__
Stack is created and ID is returned
__Actual behavior:__
`Error: Not authorized to create stack.`
Interestingly though an "influx apply -f XXXX.json" works and create a new stack
__Environment info:__
* System info: Linux przx1 5.10.2-2-MANJARO influxdata/influxdb#1 SMP PREEMPT Tue Dec 22 08:14:42 UTC 2020 x86_64 GNU/Linux
* InfluxDB version: 2.0.3 both client and server
* Other relevant environment details: Kubernetes 1.19.1 / KinD
__Logs:__
* Token
```
influx auth list --id 06e370b23dbe4000
ID Description Token U
ser Name User ID Permissions
06e370b23dbe4000 All Powerful Token 6n5bIojkPl78eQIjKQo4ki27zDJKJQwSNupuHfSg-50ug7PD3s4m4x5yKeiHZahJcY58QDmxZjUYL
eNMeDyumQ== admin 06e37007a87e4000 [read:orgs/9a9e5751c4332d9b/authorizations write:orgs/9a9e5751c4332d9
b/authorizations read:orgs/9a9e5751c4332d9b/buckets write:orgs/9a9e5751c4332d9b/buckets read:orgs/9a9e5751c4332d9b/checks wri
te:orgs/9a9e5751c4332d9b/checks read:orgs/9a9e5751c4332d9b/dashboards write:orgs/9a9e5751c4332d9b/dashboards read:orgs/9a9e57
51c4332d9b/dbrp write:orgs/9a9e5751c4332d9b/dbrp read:orgs/9a9e5751c4332d9b/documents write:orgs/9a9e5751c4332d9b/documents r
ead:orgs/9a9e5751c4332d9b/labels write:orgs/9a9e5751c4332d9b/labels read:orgs/9a9e5751c4332d9b/notificationRules write:orgs/9
a9e5751c4332d9b/notificationRules read:orgs/9a9e5751c4332d9b/notificationEndpoints write:orgs/9a9e5751c4332d9b/notificationEn
dpoints read:orgs/9a9e5751c4332d9b read:orgs/9a9e5751c4332d9b/secrets write:orgs/9a9e5751c4332d9b/secrets read:orgs/9a9e5751c
4332d9b/scrapers write:orgs/9a9e5751c4332d9b/scrapers read:orgs/9a9e5751c4332d9b/sources write:orgs/9a9e5751c4332d9b/sources
read:orgs/9a9e5751c4332d9b/tasks write:orgs/9a9e5751c4332d9b/tasks read:orgs/9a9e5751c4332d9b/telegrafs write:orgs/9a9e5751c4
332d9b/telegrafs read:users/06e37007a87e4000 write:users/06e37007a87e4000 read:orgs/9a9e5751c4332d9b/variables write:orgs/9a9
e5751c4332d9b/variables read:orgs/9a9e5751c4332d9b/views write:orgs/9a9e5751c4332d9b/views]
```
* Influx CLI Config
```
influx config set -a -n LOCAL --org org --token 6n5bIojkPl78eQIjKQo4ki27zDJKJQwSNupuHfSg-50ug7PD3s4m4x5yKeiHZahJcY58QDmxZjUYLeNMeDyumQ==
```
* Error log
```
ts=2021-01-07T17:20:33.490509Z lvl=error msg="api error encountered" log_id=0RZRso3G000 handler=stacks error="not authorized to create stack"
```
Contributor guide
Research direction
Start by reproducing the authorization failure with `influx stacks init -n TEST` using an All Access token, then compare it with the successful `influx apply -f XXXX.json` path. Trace the CLI and server handling for stack creation and identify why the token is rejected; done means the CLI creates the stack and returns its ID with the documented token.
Written by the indexing model from the issue text.
Assessment
- Domain
- authorization, cli, databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100