|
| 1 | +#!/bin/bash -eu |
| 2 | +# |
| 3 | +# Copyright (c) 2026 by Delphix. All rights reserved. |
| 4 | +# |
| 5 | +# One-time InfluxDB initialization: creates org, bucket, admin token, |
| 6 | +# a read-only token for DCT Smart Proxy, and writes the |
| 7 | +# [[outputs.influxdb_v2]] stanza to /etc/telegraf/telegraf.outputs.influxdb, |
| 8 | +# which is included by delphix-telegraf-service when INFLUXDB_ENABLED flag exists. |
| 9 | +# Skips setup if InfluxDB is already initialized. |
| 10 | +# |
| 11 | + |
| 12 | +INFLUXDB_URL="http://127.0.0.1:8086" |
| 13 | +INFLUXDB_CONFIG_DIR="/etc/influxdb" |
| 14 | +INFLUXDB_META_FILE="$INFLUXDB_CONFIG_DIR/influxdb_meta" |
| 15 | +# State file written immediately after /api/v2/setup so the script can resume |
| 16 | +# if it is interrupted before the metadata file is fully written. |
| 17 | +INFLUXDB_SETUP_STATE_FILE="$INFLUXDB_CONFIG_DIR/influxdb_setup_state" |
| 18 | +INFLUXDB_FLAG=/etc/telegraf/INFLUXDB_ENABLED |
| 19 | +INFLUXDB_OUTPUT=/etc/telegraf/telegraf.outputs.influxdb |
| 20 | +INFLUXDB_INIT_CONF="$INFLUXDB_CONFIG_DIR/influxdb-init.conf" |
| 21 | + |
| 22 | +# Load tunable configuration (org, bucket, retention, wait parameters). |
| 23 | +# shellcheck source=/etc/influxdb/influxdb-init.conf |
| 24 | +# shellcheck disable=SC1091 |
| 25 | +source "$INFLUXDB_INIT_CONF" |
| 26 | + |
| 27 | +INFLUXDB_ADMIN_USER="admin" |
| 28 | +INFLUXDB_ADMIN_PASSWORD="" |
| 29 | + |
| 30 | +# |
| 31 | +# Log a message to stderr with a timestamp. |
| 32 | +# |
| 33 | +log() { |
| 34 | + echo "[$(date -u '+%Y-%m-%dT%H:%M:%SZ')] $*" >&2 |
| 35 | +} |
| 36 | + |
| 37 | +# |
| 38 | +# Extract a field from a JSON string using python3. |
| 39 | +# |
| 40 | +json_field() { |
| 41 | + local json="$1" |
| 42 | + local field="$2" |
| 43 | + echo "$json" | python3 -c "import json,sys; print(json.loads(sys.stdin.read())$field)" || |
| 44 | + { log "ERROR: Failed to parse field '$field' from JSON response."; return 1; } |
| 45 | +} |
| 46 | + |
| 47 | +# |
| 48 | +# POST to the InfluxDB HTTP API. Exits with an error if the request fails. |
| 49 | +# |
| 50 | +influx_post() { |
| 51 | + local endpoint="$1" |
| 52 | + local data="$2" |
| 53 | + local auth_header="${3:-}" |
| 54 | + |
| 55 | + local curl_args=(-sf -X POST "$INFLUXDB_URL$endpoint" -H 'Content-Type: application/json' -d "$data") |
| 56 | + [[ -n "$auth_header" ]] && curl_args+=(-H "Authorization: Token $auth_header") |
| 57 | + |
| 58 | + local response |
| 59 | + response=$(curl "${curl_args[@]}") || |
| 60 | + { log "ERROR: HTTP POST to '$endpoint' failed."; return 1; } |
| 61 | + echo "$response" |
| 62 | +} |
| 63 | + |
| 64 | +mkdir -p "$INFLUXDB_CONFIG_DIR" |
| 65 | + |
| 66 | +# Skip if already fully initialized. |
| 67 | +if [[ -f "$INFLUXDB_META_FILE" ]]; then |
| 68 | + log "InfluxDB already initialized, skipping." |
| 69 | + exit 0 |
| 70 | +fi |
| 71 | + |
| 72 | +# |
| 73 | +# Wait for InfluxDB to be ready. |
| 74 | +# |
| 75 | +ready=false |
| 76 | +for i in $(seq 1 "$INFLUXDB_WAIT_RETRIES"); do |
| 77 | + if curl -sf "$INFLUXDB_URL/health" &>/dev/null; then |
| 78 | + ready=true |
| 79 | + break |
| 80 | + fi |
| 81 | + sleep "$INFLUXDB_WAIT_INTERVAL" |
| 82 | +done |
| 83 | + |
| 84 | +if [[ "$ready" != "true" ]]; then |
| 85 | + log "ERROR: InfluxDB did not become ready after $((INFLUXDB_WAIT_RETRIES * INFLUXDB_WAIT_INTERVAL))s." |
| 86 | + exit 1 |
| 87 | +fi |
| 88 | + |
| 89 | +# |
| 90 | +# Initial setup — creates org, bucket, and returns admin token + IDs. |
| 91 | +# /api/v2/setup is a one-shot operation; if the script is interrupted after |
| 92 | +# this point and re-run, the state file lets us skip setup and reuse the |
| 93 | +# already-created admin token. |
| 94 | +# |
| 95 | +ADMIN_TOKEN="" |
| 96 | +ORG_ID="" |
| 97 | +BUCKET_ID="" |
| 98 | + |
| 99 | +if [[ -f "$INFLUXDB_SETUP_STATE_FILE" ]]; then |
| 100 | + while IFS= read -r line; do |
| 101 | + key="${line%%=*}" |
| 102 | + value="${line#*=}" |
| 103 | + case "$key" in |
| 104 | + ADMIN_TOKEN) ADMIN_TOKEN="$value" ;; |
| 105 | + ORG_ID) ORG_ID="$value" ;; |
| 106 | + BUCKET_ID) BUCKET_ID="$value" ;; |
| 107 | + INFLUXDB_ADMIN_PASSWORD) INFLUXDB_ADMIN_PASSWORD="$value" ;; |
| 108 | + WRITE_TOKEN) WRITE_TOKEN="$value" ;; |
| 109 | + READ_TOKEN) READ_TOKEN="$value" ;; |
| 110 | + esac |
| 111 | + done <"$INFLUXDB_SETUP_STATE_FILE" |
| 112 | +else |
| 113 | + # Generate password only when actually running setup for the first time. |
| 114 | + INFLUXDB_ADMIN_PASSWORD="$(openssl rand -hex 16)" |
| 115 | + SETUP_RESPONSE=$(influx_post "/api/v2/setup" "{ |
| 116 | + \"username\": \"$INFLUXDB_ADMIN_USER\", |
| 117 | + \"password\": \"$INFLUXDB_ADMIN_PASSWORD\", |
| 118 | + \"org\": \"$INFLUXDB_ORG\", |
| 119 | + \"bucket\": \"$INFLUXDB_BUCKET\", |
| 120 | + \"retentionPeriodSeconds\": $INFLUXDB_RETENTION_SECONDS |
| 121 | + }") || exit 1 |
| 122 | + |
| 123 | + ADMIN_TOKEN=$(json_field "$SETUP_RESPONSE" "['auth']['token']") || exit 1 |
| 124 | + ORG_ID=$(json_field "$SETUP_RESPONSE" "['org']['id']") || exit 1 |
| 125 | + BUCKET_ID=$(json_field "$SETUP_RESPONSE" "['bucket']['id']") || exit 1 |
| 126 | + |
| 127 | + # Persist admin token + IDs + password immediately so a subsequent re-run |
| 128 | + # can resume without repeating the one-shot setup call, and so the password |
| 129 | + # stored in influxdb_meta always matches what InfluxDB was initialised with. |
| 130 | + old_umask="$(umask)" |
| 131 | + umask 077 |
| 132 | + tmp_state="$(mktemp "${INFLUXDB_SETUP_STATE_FILE}.XXXXXX")" |
| 133 | + printf 'ADMIN_TOKEN=%s\nORG_ID=%s\nBUCKET_ID=%s\nINFLUXDB_ADMIN_PASSWORD=%s\n' \ |
| 134 | + "$ADMIN_TOKEN" "$ORG_ID" "$BUCKET_ID" "$INFLUXDB_ADMIN_PASSWORD" >"$tmp_state" |
| 135 | + chmod 600 "$tmp_state" |
| 136 | + mv "$tmp_state" "$INFLUXDB_SETUP_STATE_FILE" |
| 137 | + umask "$old_umask" |
| 138 | +fi |
| 139 | + |
| 140 | +# Token creation is guarded so that on crash-resume (setup state exists but |
| 141 | +# meta file not yet written), we reuse already-created tokens rather than |
| 142 | +# creating orphaned duplicates in InfluxDB on each retry. |
| 143 | +WRITE_TOKEN="${WRITE_TOKEN:-}" |
| 144 | +READ_TOKEN="${READ_TOKEN:-}" |
| 145 | + |
| 146 | +# |
| 147 | +# Create a write-only token for Telegraf (skipped if already persisted in state). |
| 148 | +# |
| 149 | +if [[ -z "$WRITE_TOKEN" ]]; then |
| 150 | + WRITE_TOKEN_RESPONSE=$(influx_post "/api/v2/authorizations" "{ |
| 151 | + \"orgID\": \"$ORG_ID\", |
| 152 | + \"description\": \"telegraf-write-token\", |
| 153 | + \"permissions\": [ |
| 154 | + {\"action\": \"write\", \"resource\": {\"type\": \"buckets\", \"id\": \"$BUCKET_ID\", \"orgID\": \"$ORG_ID\"}} |
| 155 | + ] |
| 156 | + }" "$ADMIN_TOKEN") || exit 1 |
| 157 | + WRITE_TOKEN=$(json_field "$WRITE_TOKEN_RESPONSE" "['token']") || exit 1 |
| 158 | + printf 'WRITE_TOKEN=%s\n' "$WRITE_TOKEN" >>"$INFLUXDB_SETUP_STATE_FILE" |
| 159 | +fi |
| 160 | + |
| 161 | +# |
| 162 | +# Create a read-only token for DCT Smart Proxy (skipped if already persisted in state). |
| 163 | +# |
| 164 | +if [[ -z "$READ_TOKEN" ]]; then |
| 165 | + READ_TOKEN_RESPONSE=$(influx_post "/api/v2/authorizations" "{ |
| 166 | + \"orgID\": \"$ORG_ID\", |
| 167 | + \"description\": \"dct-read-token\", |
| 168 | + \"permissions\": [ |
| 169 | + {\"action\": \"read\", \"resource\": {\"type\": \"buckets\", \"id\": \"$BUCKET_ID\", \"orgID\": \"$ORG_ID\"}} |
| 170 | + ] |
| 171 | + }" "$ADMIN_TOKEN") || exit 1 |
| 172 | + READ_TOKEN=$(json_field "$READ_TOKEN_RESPONSE" "['token']") || exit 1 |
| 173 | + printf 'READ_TOKEN=%s\n' "$READ_TOKEN" >>"$INFLUXDB_SETUP_STATE_FILE" |
| 174 | +fi |
| 175 | + |
| 176 | +# |
| 177 | +# Write the [[outputs.influxdb_v2]] stanza to a dedicated telegraf output file |
| 178 | +# and enable it via the INFLUXDB_ENABLED flag. The flag is read by |
| 179 | +# delphix-telegraf-service to conditionally include this output. |
| 180 | +# |
| 181 | +cat >"$INFLUXDB_OUTPUT" <<EOF |
| 182 | +[[outputs.influxdb_v2]] |
| 183 | + urls = ["http://127.0.0.1:8086"] |
| 184 | + token = "$WRITE_TOKEN" |
| 185 | + organization = "$INFLUXDB_ORG" |
| 186 | + bucket = "$INFLUXDB_BUCKET" |
| 187 | + namepass = ["cpu", "disk", "diskio", "mem", "net", "procstat", "processes", "swap", "system", "zfs"] |
| 188 | +EOF |
| 189 | +# Enforce restrictive permissions so the write token is not world-readable. |
| 190 | +chmod 640 "$INFLUXDB_OUTPUT" |
| 191 | +touch "$INFLUXDB_FLAG" |
| 192 | + |
| 193 | +# |
| 194 | +# Persist org/bucket/admin credentials/tokens so DE APIs can expose them to DCT |
| 195 | +# and so the admin can access the InfluxDB UI. File is chmod 600 (root-only). |
| 196 | +# |
| 197 | +# Use a restrictive umask and a temp file to avoid a window where tokens are |
| 198 | +# readable by non-root users, then atomically move the file into place. |
| 199 | +old_umask="$(umask)" |
| 200 | +umask 077 |
| 201 | +tmp_meta="$(mktemp "${INFLUXDB_META_FILE}.XXXXXX")" |
| 202 | +cat >"$tmp_meta" <<EOF |
| 203 | +INFLUXDB_ORG=$INFLUXDB_ORG |
| 204 | +INFLUXDB_BUCKET=$INFLUXDB_BUCKET |
| 205 | +INFLUXDB_ADMIN_USER=$INFLUXDB_ADMIN_USER |
| 206 | +INFLUXDB_ADMIN_PASSWORD=$INFLUXDB_ADMIN_PASSWORD |
| 207 | +INFLUXDB_WRITE_TOKEN=$WRITE_TOKEN |
| 208 | +INFLUXDB_READ_TOKEN=$READ_TOKEN |
| 209 | +EOF |
| 210 | +chmod 600 "$tmp_meta" |
| 211 | +mv "$tmp_meta" "$INFLUXDB_META_FILE" |
| 212 | +umask "$old_umask" |
| 213 | + |
| 214 | +rm -f "$INFLUXDB_SETUP_STATE_FILE" |
| 215 | +log "InfluxDB initialized successfully." |
0 commit comments