From 2bfb3d12e29209d06be760affeaf376aec767d03 Mon Sep 17 00:00:00 2001
From: atlas-bot <atlas-bot@renner.uno>
Date: Mon, 5 Oct 2026 17:14:13 +0000
Subject: [PATCH] fix(influxdb): keep API tokens unhashed on 2.9 (REN-723)

InfluxDB 2.9 hashes tokens on startup by default. The HA and Grafana
token Jobs read tokens back via `influx auth list`, which returns no
token once hashed, and a downgrade below 2.8 would erase all tokens.
Set INFLUXD_USE_HASHED_TOKENS=false so the 2.9.1 bump stays reversible
with `influxd downgrade 2.4`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 kubernetes/apps/influxdb/ha-token-job.yaml | 2 +-
 kubernetes/apps/influxdb/helmrelease.yaml  | 9 ++++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/kubernetes/apps/influxdb/ha-token-job.yaml b/kubernetes/apps/influxdb/ha-token-job.yaml
index 61036c9d..17bcf2c0 100644
--- a/kubernetes/apps/influxdb/ha-token-job.yaml
+++ b/kubernetes/apps/influxdb/ha-token-job.yaml
@@ -133,7 +133,7 @@ spec:
               set -euo pipefail
               log() { printf '[%s] %s\n' "$(date -u +%H:%M:%S)" "$*"; }
 
-              # Need jq + kubectl. influxdb:2.7.4 has neither baked in.
+              # Need jq + kubectl. The influxdb image has neither baked in.
               apt-get update -qq
               apt-get install -y --no-install-recommends curl jq ca-certificates >/dev/null
               KV=$(curl -fsSL https://dl.k8s.io/release/stable.txt)
diff --git a/kubernetes/apps/influxdb/helmrelease.yaml b/kubernetes/apps/influxdb/helmrelease.yaml
index 56721c94..98dff28b 100644
--- a/kubernetes/apps/influxdb/helmrelease.yaml
+++ b/kubernetes/apps/influxdb/helmrelease.yaml
@@ -53,7 +53,8 @@ spec:
   values:
     image:
       repository: influxdb
-      # Match VM 108 for format compatibility with `influx restore`.
+      # Was pinned to VM 108's 2.7.4 for the one-time `influx restore`; that
+      # migration is done. No downgrade below 2.9 without `influxd downgrade`.
       tag: "2.9.1@sha256:db0bdab1e5ad5ee899c127b8c13d9c986a3ced78cd9200dd80a1064bf1533b6e"
     # Single replica — InfluxDB OSS doesn't cluster. RWO Ceph-block + Velero
     # backups (pending) is the durability story.
@@ -93,6 +94,12 @@ spec:
     env:
       - name: INFLUXD_STORAGE_WRITE_TIMEOUT
         value: "60s"
+      # 2.9 hashes API tokens on startup by default. Hashed tokens cannot be
+      # read back, so the token Jobs' `influx auth list` reuse would break,
+      # and a downgrade below 2.8 would erase every token (HA, Grafana).
+      # Keep tokens unhashed; enable hashing later as its own change.
+      - name: INFLUXD_USE_HASHED_TOKENS
+        value: "false"
     # The chart defaults to liveness/readiness with initialDelaySeconds=0,
     # so after a crash restart the kubelet kills the pod before shards
     # finish opening. Give it 10 minutes to come up cleanly.