k.rennerandClaude Opus 4.7
818c71b032
Pipeline 876's seed Job kept failing once the SSH/CLI-version issue was
solved, this time with:
Error: failed to backup metadata: failed to download metadata
snapshot: 401 Unauthorized: read:authorizations is unauthorized
The Grafana token reused as legacy-token has all-access on the renner
org but is *not* an operator (system-wide) token. `influx backup` —
even with `--bucket NAME` — first downloads the global metadata
snapshot, which requires read:authorizations at the system level and
returns 401 for every non-operator token.
Drop `influx backup`/`influx restore` entirely. Stream the bucket
through the v2 HTTP query API instead:
influx query --host=<legacy> --raw 'from(bucket:X) |> range(start:-100y)'
| influx write --host=<local> --format csv --bucket X
InfluxData-annotated CSV is both `query --raw`'s output format and
`write --format csv`'s input format, so the pipe is direct — no
intermediate transform, no staging file (kept the staging PVC mount
for now in case we need it later for chunking on huge buckets).
read:buckets at org-scope is enough for `influx query`, write:buckets
at org-scope is enough for `influx write`; neither needs operator
scope. Pipe keeps memory bounded regardless of bucket size.
Trade-off: bucket-level metadata (retention, shard-group duration) is
NOT carried over from legacy. Chart's adminUser already pins
`retention_policy: "0s"` (forever), matching the legacy suedstr28
config, so this is a no-op for the only bucket we currently seed. Any
future bucket with non-default retention/sgd would need to be set in
the chart values explicitly.
Also drops the `influx bucket delete` step that the previous restore-
based flow needed (since `influx restore` cannot restore into an
existing bucket); `influx write` happily appends into an existing
bucket so the chart-bootstrap-created suedstr28 placeholder is the
write target directly.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>