build-trust / demo-influxdb-telegraf Goto Github PK

As it stands, here's a summary of how a Telegraf instance connects to InfluxDB via Ockam (skipping the initial Orchestrator setup).

First, an Ockam Admin needs to create an enrolment token for the Influx node:

INFLUXDB_TOKEN=$(ockam project enroll --to /project/$PROJECT_NAME/service/authenticator --attribute component=influxdb)

Then the InfluxDB Admin can use that to create + enroll a node, set a policy to only allow access from a Telegraf node, create a TCP outlet, and finally create a forwarder:

NODE="influxdb"
ockam node create $NODE --project /config/project.json --enrollment-token $OCKAM_TOKEN
ockam policy set --at $NODE --resource tcp-outlet --expression '(= subject.component "telegraf")'
ockam tcp-outlet create --at /node/$NODE --from /service/outlet --to 127.0.0.1:8086
ockam forwarder create $NODE --at /project/$OCKAM_PROJECT_NAME --to /node/$NODE

Once that's running the Ockam Admin can then create an enrolment token for the Telegraf node:

export TELEGRAF_TOKEN=$(ockam project enroll --to /project/$PROJECT_NAME/service/authenticator --attribute component=telegraf)

and the Telegraf Admin can use that to create + enroll a node, set a policy, create an inlet so that Telegraf can connect to the local node and have packets forwarded to InfluxDB:

NODE="telegraf"
ockam node create $NODE --project /config/project.json --enrollment-token $OCKAM_TOKEN
ockam policy set --at $NODE --resource tcp-inlet --expression '(= subject.component "influxdb")'
sleep 30
ockam tcp-inlet create --at /node/$NODE --from 127.0.0.1:8086 --to /project/$OCKAM_PROJECT_NAME/service/forward_to_influxdb/secure/api/service/outlet

This will work and successfully have data transferred via the secure channel, but only because the Telegraf config is hard-coded to use the InfluxDB admin token. Wouldn't it be great if instead of hard-coding the token into the Telegraf config, Telegraf could instead delegate authentication to Ockam as part of the setup of creating the secure channel. Instead of using a broad privilege and perpetual token, a token with a lesser scope and a TTL could be issued. Without the need for code, config, or network topology changes on either the InfluxDB or Telegraf side.