[
https://issues.apache.org/jira/browse/IMPALA-15016?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18099574#comment-18099574
]
ASF subversion and git services commented on IMPALA-15016:
----------------------------------------------------------
Commit 05ffd62a742a7bc21990b0777962b29cfce0fdb3 in impala's branch
refs/heads/master from Anubhav Jindal
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=05ffd62a7 ]
IMPALA-15016: Add OAuth Helm auth options
Add typed auth.oauth Helm values and wire them into impalad startup
args so OAuth token authentication can be configured without raw
extraArgs overrides.
Validate OAuth JWKS configuration so signature verification requires
exactly one of auth.oauth.jwksUrl or auth.oauth.jwksFilePath.
Document Helm and operator override usage for OAuth settings in the
Kubernetes deployment guide and chart example values.
Testing:
- helm lint helm/impala
- helm template impala-no-oauth helm/impala -f helm/impala/values-example.yaml
- helm template impala-oauth helm/impala -f helm/impala/values-example.yaml \
--set auth.oauth.enabled=true \
--set auth.oauth.jwksUrl=https://idp.example.org/.well-known/jwks.json \
--set auth.oauth.jwtCustomClaimUsername=sub
- helm template impala15016-oauth-valid-file helm/impala \
--set auth.oauth.enabled=true --set auth.oauth.jwtValidateSignature=true \
--set auth.oauth.jwksFilePath=/etc/impala/jwks.json
- helm template impala15016-oauth-invalid-none helm/impala \
--set auth.oauth.enabled=true --set auth.oauth.jwtValidateSignature=true
(fails as expected)
- helm template impala15016-oauth-invalid-both helm/impala \
--set auth.oauth.enabled=true --set auth.oauth.jwtValidateSignature=true \
--set auth.oauth.jwksUrl=https://idp.example.org/jwks \
--set auth.oauth.jwksFilePath=/etc/impala/jwks.json (fails as expected)
- Deployed on a Kubernetes test cluster using KUBECONFIG.
- Verified impalad includes OAuth startup flags when enabled.
- Ran impala-shell smoke queries: select version(); select 1;
Change-Id: Ibf9d305dd37f1d173b0d2339c7a7d5098718e2fd
Assisted-by: GPT-5.3 (Cursor)
Reviewed-on: http://gerrit.cloudera.org:8080/24366
Reviewed-by: Jason Fehr <[email protected]>
Tested-by: Jason Fehr <[email protected]>
> Add OAuth authentication options to Impala Helm chart
> -----------------------------------------------------
>
> Key: IMPALA-15016
> URL: https://issues.apache.org/jira/browse/IMPALA-15016
> Project: IMPALA
> Issue Type: Task
> Reporter: Anubhav Jindal
> Assignee: Anubhav Jindal
> Priority: Major
>
> *Problem*
> The current Impala Helm chart supports LDAP and Ranger-related options, but
> does not expose OAuth authentication configuration for {{{}impalad{}}}.
> Review feedback on {{IMPALA-14974}} requested OAuth support since it is
> commonly used in Kubernetes environments.
> *Proposed Change*
> Add Helm values and template wiring to configure OAuth-related {{impalad}}
> startup flags in a typed and discoverable way.
> The change should:
> * Introduce OAuth config keys under {{values.yaml}} (for example, enablement
> and provider settings)
> * Render corresponding {{impalad}} args only when OAuth is enabled
> * Keep existing LDAP behavior unchanged and backward-compatible
> * Document usage in chart examples and Kubernetes deployment docs
> *Testing*
> * Run {{helm lint}} for the chart
> * Run {{helm template}} and verify OAuth args are rendered only when enabled
> * Deploy on a test Kubernetes cluster and validate {{impalad}} starts with
> expected OAuth flags
> * Verify no behavior change when OAuth config is omitted
> *Compatibility/Risk*
> Low risk. Defaults remain unchanged, and OAuth flags are opt-in.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
