[
https://issues.apache.org/jira/browse/IMPALA-15017?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18104094#comment-18104094
]
ASF subversion and git services commented on IMPALA-15017:
----------------------------------------------------------
Commit 552e8dfec0640cd51e2c51ac2cb3f600c2492040 in impala's branch
refs/heads/master from Anubhav Jindal
[ https://gitbox.apache.org/repos/asf?p=impala.git;h=552e8dfec ]
IMPALA-15017: Add secure-cluster Helm options
Add structured security values for Istio sidecar injection, Kerberos
flags/keytab inputs, and TLS certificate inputs in the Impala Helm chart.
Wire secure options into impalad/catalogd/statestored startup args and
secret/config mounts behind opt-in flags, and document required secure
cluster inputs and usage in the Kubernetes deployment guide.
Testing:
- helm lint helm/impala
- helm template impala-default helm/impala -f helm/impala/values-example.yaml
- helm template impala-secure helm/impala -f helm/impala/values-example.yaml \
--set security.kerberos.enabled=true \
--set security.kerberos.principal='impala/[email protected]' \
--set security.kerberos.bePrincipal='impala/[email protected]' \
--set security.kerberos.keytabSecretName='impala-kerberos-keytab' \
--set security.kerberos.krb5ConfigMapName='impala-krb5-conf' \
--set security.tls.enabled=true \
--set security.tls.secretName='impala-tls' \
--set security.istio.enabled=true
- helm template impala-sec-missing helm/impala \
-f helm/impala/values-example.yaml --set security.kerberos.enabled=true
(fails with required keytabSecretName error)
- Deployed non-secure compatibility release on Kubernetes test cluster
using KUBECONFIG and verified all core pods were Running.
- Ran impala-shell smoke queries: select version(); select 1;
Change-Id: I02e4c4b466424a938151bd69b28bf99ae405fae7
Assisted-by: GPT-5.3 (Cursor)
Reviewed-on: http://gerrit.cloudera.org:8080/24367
Reviewed-by: Jason Fehr <[email protected]>
Tested-by: Jason Fehr <[email protected]>
> Add secure-cluster configuration support to Impala Helm chart
> -------------------------------------------------------------
>
> Key: IMPALA-15017
> URL: https://issues.apache.org/jira/browse/IMPALA-15017
> Project: IMPALA
> Issue Type: Task
> Reporter: Anubhav Jindal
> Assignee: Anubhav Jindal
> Priority: Major
>
> *Problem*
> The current Helm-based deployment focuses on non-secure defaults and does not
> provide a complete, documented path for secure-cluster configuration (for
> example TLS/Kerberos-related settings). Review feedback on {{IMPALA-14974}}
> requested secure-cluster support.
> *Proposed Change*
> Extend chart values and templates to support secure deployment configuration
> for Impala components.
> The change should:
> * Add structured security-related values in {{values.yaml}}
> * Wire required daemon flags/env/volume mounts/secrets references in
> templates
> * Preserve current defaults for non-secure quickstart deployment
> * Add documentation for secure setup, including required secrets/config
> inputs
> *Testing*
> * Run {{helm lint}} and {{helm template}} for secure and non-secure
> configurations
> * Validate secure settings render correctly and are gated behind explicit
> values
> * Deploy to a test Kubernetes cluster configured for security and validate
> component startup
> * Re-check non-secure deployment path remains functional
> *Compatibility/Risk*
> Medium risk due to security-sensitive configuration surface; mitigated by
> opt-in defaults and explicit documentation.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
