Huang Kuan Hao created HDDS-16112:
-------------------------------------
Summary: OzoneContainer: optional secure (Kerberos) mode
Key: HDDS-16112
URL: https://issues.apache.org/jira/browse/HDDS-16112
Project: Apache Ozone
Issue Type: Sub-task
Reporter: Huang Kuan Hao
Assignee: Huang Kuan Hao
{\{OzoneContainer}} runs non-secure only, so S3G accepts any access key/secret.
Add a secure variant to exercise real SigV4 validation, ACLs and the S3 secret
flow.
- Add \{{withSecurityEnabled()}} to start Ozone in secure mode
- Run a KDC sidecar (\{{docker.ozone-testkr5b.image}}, as in
\{{compose/ozonesecure}}) on a shared Testcontainers \{{Network}}
- Provision principals/keytabs; fetch real S3 credentials via \{{ozone s3
getsecret}} and return them from \{{getAccessKey()}}/\{{getSecretKey()}}
- Add a smoke test: a signed S3 op succeeds with the fetched secret, wrong
credentials are rejected
Note: no secure all-in-one image exists yet — either build one, or compose the
all-in-one image with a KDC and secure \{{docker-config}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
