Bypass your identity provider

InfluxDB Clustered generates a valid access token (known as the admin token) for managing databases and database tokens and stores it as a secret in your InfluxDB namespace. You can use the admin token with the influxctl CLI in lieu of configuring and using an OAuth2 identity provider.

Configure influxctl to use the admin token

1. If you haven’t already, download, install, or upgrade to influxctl v2.2.0 or newer.

2. Use kubectl to retrieve the admin token from your cluster namespace’s secret store and copy it to a file:

   kubectl get secrets/admin-token \
     --template={{.data.token}} \
     --namespace 
   INFLUXDB_NAMESPACE
    | base64 -d > token.json
   

3. Update your influxctl connection profile with a new [profile.auth.token] section.

4. In the [profile.auth.token] section, assign the token_file setting to the location of your saved admin token file:

   [[profile]]
   # ...
     [profile.auth.token]
       token_file = "/
   DIRECTORY_PATH
   /token.json"
   

In the examples above, replace the following:

• INFLUXDB_NAMESPACE: The name of your InfluxDB namespace.
• DIRECTORY_PATH: The directory path to your admin token file, token.json.

Revoke an admin token

The admin token is a long-lived access token. The only way to revoke the token is to do the following:

1. Delete the rsa-keys secret from your InfluxDB cluster’s context and namespace:

   kubectl delete secrets/rsa-keys --namespace 
   INFLUXDB_NAMESPACE
   

2. Rerun the key-gen job:

   1. List the jobs in your InfluxDB namespace to find the key-gen job pod:

      # List jobs to find the key-gen job pod
      kubectl get jobs --namespace 
      INFLUXDB_NAMESPACE
      

   2. Run the key-gen job and increment the job number as needed:

      kubectl create job \
        --from=job/
      KEY_GEN_JOB
       key-gen-
      001
       \
        --namespace 
      INFLUXDB_NAMESPACE
      

3. Restart the token-management service:

   kubectl delete pods \
     --selector app=token-management \
     --namespace 
   INFLUXDB_NAMESPACE
   

In the examples above, replace the following:

• INFLUXDB_NAMESPACE: The name of your InfluxDB namespace.
• KEY_GEN_JOB: The name of the key-gen job pod.
• 001: A unique number used to increment the key-gen job.