Influxdata
/
docs-v2
mirror of https://github.com/influxdata/docs-v2.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
docs-v2/content/influxdb3/clustered/admin/users/add.md

12 KiB
Raw Permalink Blame History

title list_title description menu weight
Add a user to your InfluxDB cluster Add a user Add a user with administrative access to your InfluxDB cluster through your identity provider and your InfluxDB `AppInstance` resource.
influxdb3_clustered
name parent
Add a user Manage users
201

Add a user with administrative access to your InfluxDB cluster through your identity provider and your InfluxDB AppInstance resource:

  1. Use your identity provider to create an OAuth2 account for the user that needs administrative access to your InfluxDB cluster.

    Refer to your identity provider's documentation for information about adding users:

  2. Add the user to your InfluxDB AppInstance resource. You can edit your AppInstance resource directly in your myinfluxdb.yml, or, if you're using the InfluxDB Clustered Helm chart, you can add users to your values.yaml to modify your AppInstance resource. Required credentials depend on your identity provider.

    {{< tabs-wrapper >}} {{% tabs %}} AppInstance Helm {{% /tabs %}}

{{% tab-content %}}

If editing your AppInstance resource directly, provide values for the following fields in your myinfluxdb.yml configuration file:

  • spec.package.spec.admin
    • identityProvider: Identity provider name. If using Microsoft Entra ID (formerly Azure Active Directory), set the name to azure.
    • jwksEndpoint: JWKS endpoint provide by your identity provider.
    • users: List of OAuth2 users to grant administrative access to your InfluxDB cluster. IDs are provided by your identity provider.

Below are examples for Keycloak, Auth0, and Microsoft Entra ID, but other OAuth2 providers should work as well:

{{< code-tabs-wrapper >}} {{% code-tabs %}} Keycloak Auth0 Microsoft Entra ID {{% /code-tabs %}} {{% code-tab-content %}}

{{% code-callout "keycloak" "green" %}} {{% code-placeholders "KEYCLOAK_(HOST|REALM|USER_ID)" %}}

apiVersion: kubecfg.dev/v1alpha1
kind: AppInstance
# ...
spec:
  package:
    spec:
      admin:
        identityProvider: keycloak
        jwksEndpoint: |-
          https://KEYCLOAK_HOST/auth/realms/KEYCLOAK_REALM/protocol/openid-connect/certs          
        users:
          # All fields are required but `firstName`, `lastName`, and `email` can be
          # arbitrary values. However, `id` must match the user ID provided by Keycloak.
          - id: KEYCLOAK_USER_ID
            firstName: Marty
            lastName: McFly
            email: mcfly@influxdata.com

{{% /code-placeholders %}} {{% /code-callout %}}

Replace the following:

  • {{% code-placeholder-key %}}KEYCLOAK_HOST{{% /code-placeholder-key %}}: Host and port of your Keycloak server
  • {{% code-placeholder-key %}}KEYCLOAK_REALM{{% /code-placeholder-key %}}: Keycloak realm
  • {{% code-placeholder-key %}}KEYCLOAK_USER_ID{{% /code-placeholder-key %}}: Keycloak user ID to grant InfluxDB administrative access to (See Find user IDs with Keycloak)

{{% /code-tab-content %}} {{% code-tab-content %}}

{{% code-callout "auth0" "green" %}} {{% code-placeholders "AUTH0_(HOST|USER_ID)" %}}

apiVersion: kubecfg.dev/v1alpha1
kind: AppInstance
# ...
spec:
  package:
    spec:
      admin:
        identityProvider: auth0
        jwksEndpoint: |-
          https://AUTH0_HOST/.well-known/openid-configuration          
        users:
          # All fields are required but `firstName`, `lastName`, and `email` can be
          # arbitrary values. However, `id` must match the user ID provided by Auth0.
          - id: AUTH0_USER_ID
            firstName: Marty
            lastName: McFly
            email: mcfly@influxdata.com

{{% /code-placeholders %}} {{% /code-callout %}}

Replace the following:

  • {{% code-placeholder-key %}}AUTH0_HOST{{% /code-placeholder-key %}}: Host and port of your Auth0 server
  • {{% code-placeholder-key %}}AUTH0_USER_ID{{% /code-placeholder-key %}}: Auth0 user ID to grant InfluxDB administrative access to

{{% /code-tab-content %}} {{% code-tab-content %}}

{{% code-callout "azure" "green" %}} {{% code-placeholders "AZURE_(USER|TENANT)_ID" %}}

apiVersion: kubecfg.dev/v1alpha1
kind: AppInstance
# ...
spec:
  package:
    spec:
      admin:
        identityProvider: azure
        jwksEndpoint: |-
          https://login.microsoftonline.com/AZURE_TENANT_ID/discovery/v2.0/keys          
        users:
          # All fields are required but `firstName`, `lastName`, and `email` can be
          # arbitrary values. However, `id` must match the user ID provided by Azure.
          - id: AZURE_USER_ID
            firstName: Marty
            lastName: McFly
            email: mcfly@influxdata.com

{{% /code-placeholders %}} {{% /code-callout %}}

Replace the following:

  • {{% code-placeholder-key %}}AZURE_TENANT_ID{{% /code-placeholder-key %}}: Microsoft Entra tenant ID
  • {{% code-placeholder-key %}}AZURE_USER_ID{{% /code-placeholder-key %}}: Microsoft Entra user ID to grant InfluxDB administrative access to (See Find user IDs with Microsoft Entra ID)

{{% /code-tab-content %}} {{< /code-tabs-wrapper >}}

{{% /tab-content %}} {{% tab-content %}}

If using the InfluxDB Clustered Helm chart, provide values for the following fields in your values.yaml:

  • admin
    • identityProvider: Identity provider name. If using Microsoft Entra ID (formerly Azure Active Directory), set the name to azure.
    • jwksEndpoint: JWKS endpoint provide by your identity provider.
    • users: List of OAuth2 users to grant administrative access to your InfluxDB cluster. IDs are provided by your identity provider.

Below are examples for Keycloak, Auth0, and Microsoft Entra ID, but other OAuth2 providers should work as well:

{{< code-tabs-wrapper >}} {{% code-tabs %}} Keycloak Auth0 Microsoft Entra ID {{% /code-tabs %}} {{% code-tab-content %}}

{{% code-callout "keycloak" "green" %}} {{% code-placeholders "KEYCLOAK_(HOST|REALM|USER_ID)" %}}

admin:
  # The identity provider to be used (such as "keycloak", "auth0", or "azure")
  # Note, use "azure" for Azure Active Directory
  identityProvider: keycloak
  # The JWKS endpoint provided by the Identity Provider
  jwksEndpoint: |-
    https://KEYCLOAK_HOST/auth/realms/KEYCLOAK_REALM/protocol/openid-connect/certs    
  # The list of users to grant access to Clustered via influxctl
  users:
    # All fields are required but `firstName`, `lastName`, and `email` can be
    # arbitrary values. However, `id` must match the user ID provided by Keycloak.
    - id: KEYCLOAK_USER_ID
      firstName: Marty
      lastName: McFly
      email: mcfly@influxdata.com

{{% /code-placeholders %}} {{% /code-callout %}}

Replace the following:

  • {{% code-placeholder-key %}}KEYCLOAK_HOST{{% /code-placeholder-key %}}: Host and port of your Keycloak server
  • {{% code-placeholder-key %}}KEYCLOAK_REALM{{% /code-placeholder-key %}}: Keycloak realm
  • {{% code-placeholder-key %}}KEYCLOAK_USER_ID{{% /code-placeholder-key %}}: Keycloak user ID to grant InfluxDB administrative access to

{{% /code-tab-content %}} {{% code-tab-content %}}

{{% code-callout "auth0" "green" %}} {{% code-placeholders "AUTH0_(HOST|USER_ID)" %}}

admin:
  # The identity provider to be used e.g. "keycloak", "auth0", "azure", etc
  # Note, use "azure" for Azure Active Directory.
  identityProvider: auth0
  # The JWKS endpoint provided by the Identity Provider
  jwksEndpoint: |-
    https://AUTH0_HOST/.well-known/openid-configuration    
  # The list of users to grant access to Clustered via influxctl
  users:
    # All fields are required but `firstName`, `lastName`, and `email` can be
    # arbitrary values. However, `id` must match the user ID provided by Auth0.
    - id: AUTH0_USER_ID
      firstName: Marty
      lastName: McFly
      email: mcfly@influxdata.com

{{% /code-placeholders %}} {{% /code-callout %}}

Replace the following:

  • {{% code-placeholder-key %}}AUTH0_HOST{{% /code-placeholder-key %}}: Host and port of your Auth0 server
  • {{% code-placeholder-key %}}AUTH0_USER_ID{{% /code-placeholder-key %}}: Auth0 user ID to grant InfluxDB administrative access to

{{% /code-tab-content %}} {{% code-tab-content %}}

{{% code-callout "azure" "green" %}} {{% code-placeholders "AZURE_(USER|TENANT)_ID" %}}

admin:
  # The identity provider to be used e.g. "keycloak", "auth0", "azure", etc
  # Note, use "azure" for Azure Active Directory.
  identityProvider: azure
  # The JWKS endpoint provided by the Identity Provider
  jwksEndpoint: |-
    https://login.microsoftonline.com/AZURE_TENANT_ID/discovery/v2.0/keys    
  # The list of users to grant access to Clustered via influxctl
  users:
    # All fields are required but `firstName`, `lastName`, and `email` can be
    # arbitrary values. However, `id` must match the user ID provided by Azure.
    - id: AZURE_USER_ID
      firstName: Marty
      lastName: McFly
      email: mcfly@influxdata.com

{{% /code-placeholders %}} {{% /code-callout %}}

Replace the following:

  • {{% code-placeholder-key %}}AZURE_TENANT_ID{{% /code-placeholder-key %}}: Microsoft Entra tenant ID
  • {{% code-placeholder-key %}}AZURE_USER_ID{{% /code-placeholder-key %}}: Microsoft Entra user ID to grant InfluxDB administrative access to (See Find user IDs with Microsoft Entra ID)

{{% /code-tab-content %}} {{< /code-tabs-wrapper >}}

{{% /tab-content %}} {{< /tabs-wrapper >}}

  1. Apply the change to your InfluxDB cluster.

    • If updating the AppInstance resource directly, use kubectl to apply the change.
    • If using the InfluxDB Clustered Helm chart, use helm to apply the change.

{{< code-tabs-wrapper >}} {{% code-tabs %}} kubectl Helm {{% /code-tabs %}} {{% code-tab-content %}}

kubectl apply \
  --filename myinfluxdb.yml \
  --namespace influxdb

{{% /code-tab-content %}} {{% code-tab-content %}}

helm upgrade \
  influxdb \
  influxdata/influxdb3-clustered \
  -f ./values.yaml \
  --namespace influxdb

{{% /code-tab-content %}} {{< /code-tabs-wrapper >}}

Once applied, the added user is granted administrative access to your InfluxDB cluster and can use influxctl to perform administrative actions. See Set up Authorization--Configure influxctl for information about configuring the new user's influxctl client to communicate and authenticate with your InfluxDB cluster's identity provider.