Flux to() function fails on influxdb 2.7.0 oss (arm64) when run inside a task

Hi Community,

I’m tearing my hair out trying to figure out why my downsampling tasks have started failing since upgrading to influxdb oss 2.7.0 (arm64). Help sought (please) as to whether this in an influxdb issue, or user error :slight_smile: as I can’t find any similar reports.

$influxd version
InfluxDB v2.7.0 (git: 85f725f8b9) build_date: 2023-04-05T15:32:18Z

In my case influxdb oss runs on a raspberrypi4 running ubuntu 22.11 stable…

uname -a
Linux pieman 5.19.0-1016-raspi #23-Ubuntu SMP PREEMPT Fri Mar 31 13:54:29 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux

I think I’m hitting the issue as a result of this fix introduced in influxdb 2.7.0…

  • 06a5902: Prevent unauthorized writes in flux “to” function

Any downsampling tasks that include a to() function fail with…

error exhausting result iterator: failed to initialize execute state: user not authorized to write

…however the flux code runs successfully (with same user and/ or token) when run as a regular query, including in the explorer.

Here’s a simple example that fails consistently for me with the arm64 variant of influxdb oss 2.7.0 on a raspberrypi4. I’ve tried running alpine, ubuntu and docker image using both the .deb and arm64 binaries.

$ influx setup --username admin-user --password admin-password --org my-org --bucket my-bucket

$ influx user create --org my-org --name testuser --password testpassword

$ influx auth create --user testuser --org my-org --description "test all-access token" --all-access

$ influx config create -a -n test -u http://localhost:8086 --org my-org -t <token produced by command above>

$ influx bucket create --org my-org -n testbucket

$ influx task create --org my-org - # <return> to open stdin pipe
import "influxdata/influxdb/sample"

option task = {
  name: "Collect air sensor sample data",
  every: 15m,
}

sample.data(set: "airSensor")
    |> to(bucket: "testbucket")
# Linux & macOS: <ctrl-d> to close the pipe and submit the command

I believe this task should run successfully using the testuser all-access token (which I believe has write access to the bucket named testbucket) as it does when run as a query, or in the InfluxDB UI (explorer).

If I revert to the 2.6.1 version of influxdb oss the task completes successfully, though this release does not include the fix described above.

Any ideas?

Thanks!

Hi,
Same over here,
The jobs fails when using the .to function in 2.7.1
The only way around is to explicitly give a token and host as arguments.

|> to(
        bucket: "mybucket",
        org: "myorganisation",
        host: "http://myhost:myport/",
        token: secrets.get(key: "MySecret"),

But this means that I need to put the API token in a secret and that’s weird. It looks like there is not something as a system job user where you can assign this api token

br
Frederik

Thanks frederik.

I tried this on x86 and same issue, so not limited to arm64 as the title and my original post suggests.