Skip to content

Commit 062e54b

Browse files
adutraadutra
committed
feat(helm): Add support for external authentication
1 parent 05975a3 commit 062e54b

File tree

11 files changed

+463
-54
lines changed

11 files changed

+463
-54
lines changed

‎CHANGELOG.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,9 @@ request adding CHANGELOG notes for breaking (!) changes and possibly other secti
3333

3434
### Breaking changes
3535

36+
- Helm chart: the default value of the `authentication.tokenBroker.secret.symmetricKey.secretKey` property has changed
37+
from `symmetric.pem` to `symmetric.key`.
38+
3639
### New Features
3740

3841
- Added Catalog configuration for S3 and STS endpoints. This also allows using non-AWS S3 implementations.

‎helm/polaris/README.md

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -189,21 +189,24 @@ ct install --namespace polaris --charts ./helm/polaris
189189
|-----|------|---------|-------------|
190190
| advancedConfig | object | `{}` | Advanced configuration. You can pass here any valid Polaris or Quarkus configuration property. Any property that is defined here takes precedence over all the other configuration values generated by this chart. Properties can be passed "flattened" or as nested YAML objects (see examples below). Note: values should be strings; avoid using numbers, booleans, or other types. |
191191
| affinity | object | `{}` | Affinity and anti-affinity for polaris pods. See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity. |
192-
| authentication | object | `{"authenticator":{"type":"default"},"tokenBroker":{"maxTokenGeneration":"PT1H","secret":{"name":null,"privateKey":"private.pem","publicKey":"public.pem","rsaKeyPair":{"privateKey":"private.pem","publicKey":"public.pem"},"secretKey":"symmetric.pem","symmetricKey":{"secretKey":"symmetric.pem"}},"type":"rsa-key-pair"},"tokenService":{"type":"default"}}` | Polaris authentication configuration. |
193-
| authentication.authenticator | object | `{"type":"default"}` | The type of authentication to use. Two built-in types are supported: default and test; test is not recommended for production. |
194-
| authentication.tokenBroker | object | `{"maxTokenGeneration":"PT1H","secret":{"name":null,"privateKey":"private.pem","publicKey":"public.pem","rsaKeyPair":{"privateKey":"private.pem","publicKey":"public.pem"},"secretKey":"symmetric.pem","symmetricKey":{"secretKey":"symmetric.pem"}},"type":"rsa-key-pair"}` | The type of token broker to use. Two built-in types are supported: rsa-key-pair and symmetric-key. |
192+
| authentication | object | `{"activeRolesProvider":{"type":"default"},"authenticator":{"type":"default"},"realmOverrides":{},"tokenBroker":{"maxTokenGeneration":"PT1H","secret":{"name":null,"privateKey":"private.pem","publicKey":"public.pem","rsaKeyPair":{"privateKey":"private.pem","publicKey":"public.pem"},"secretKey":"symmetric.key","symmetricKey":{"secretKey":"symmetric.key"}},"type":"rsa-key-pair"},"tokenService":{"type":"default"},"type":"internal"}` | Polaris authentication configuration. |
193+
| authentication.activeRolesProvider | object | `{"type":"default"}` | The `ActiveRolesProvider` implementation to use. Only one built-in type is supported: default. |
194+
| authentication.authenticator | object | `{"type":"default"}` | The `Authenticator` implementation to use. Only one built-in type is supported: default. |
195+
| authentication.realmOverrides | object | `{}` | Authentication configuration overrides per realm. |
196+
| authentication.tokenBroker | object | `{"maxTokenGeneration":"PT1H","secret":{"name":null,"privateKey":"private.pem","publicKey":"public.pem","rsaKeyPair":{"privateKey":"private.pem","publicKey":"public.pem"},"secretKey":"symmetric.key","symmetricKey":{"secretKey":"symmetric.key"}},"type":"rsa-key-pair"}` | The TokenBroker implementation to use. Two built-in types are supported: rsa-key-pair and symmetric-key. |
195197
| authentication.tokenBroker.maxTokenGeneration | string | `"PT1H"` | Maximum token generation duration (e.g., PT1H for 1 hour). |
196-
| authentication.tokenBroker.secret | object | `{"name":null,"privateKey":"private.pem","publicKey":"public.pem","rsaKeyPair":{"privateKey":"private.pem","publicKey":"public.pem"},"secretKey":"symmetric.pem","symmetricKey":{"secretKey":"symmetric.pem"}}` | The secret name to pull the public and private keys, or the symmetric key secret from. |
198+
| authentication.tokenBroker.secret | object | `{"name":null,"privateKey":"private.pem","publicKey":"public.pem","rsaKeyPair":{"privateKey":"private.pem","publicKey":"public.pem"},"secretKey":"symmetric.key","symmetricKey":{"secretKey":"symmetric.key"}}` | The secret name to pull the public and private keys, or the symmetric key secret from. |
197199
| authentication.tokenBroker.secret.name | string | `nil` | The name of the secret to pull the keys from. If not provided, a key pair will be generated. This is not recommended for production. |
198200
| authentication.tokenBroker.secret.privateKey | string | `"private.pem"` | DEPRECATED: Use `authentication.tokenBroker.secret.rsaKeyPair.privateKey` instead. Key name inside the secret for the private key |
199201
| authentication.tokenBroker.secret.publicKey | string | `"public.pem"` | DEPRECATED: Use `authentication.tokenBroker.secret.rsaKeyPair.publicKey` instead. Key name inside the secret for the public key |
200202
| authentication.tokenBroker.secret.rsaKeyPair | object | `{"privateKey":"private.pem","publicKey":"public.pem"}` | Optional: configuration specific to RSA key pair secret. |
201203
| authentication.tokenBroker.secret.rsaKeyPair.privateKey | string | `"private.pem"` | Key name inside the secret for the private key |
202204
| authentication.tokenBroker.secret.rsaKeyPair.publicKey | string | `"public.pem"` | Key name inside the secret for the public key |
203-
| authentication.tokenBroker.secret.secretKey | string | `"symmetric.pem"` | DEPRECATED: Use `authentication.tokenBroker.secret.symmetricKey.secretKey` instead. Key name inside the secret for the symmetric key |
204-
| authentication.tokenBroker.secret.symmetricKey | object | `{"secretKey":"symmetric.pem"}` | Optional: configuration specific to symmetric key secret. |
205-
| authentication.tokenBroker.secret.symmetricKey.secretKey | string | `"symmetric.pem"` | Key name inside the secret for the symmetric key |
206-
| authentication.tokenService | object | `{"type":"default"}` | The type of token service to use. Two built-in types are supported: default and test; test is not recommended for production. |
205+
| authentication.tokenBroker.secret.secretKey | string | `"symmetric.key"` | DEPRECATED: Use `authentication.tokenBroker.secret.symmetricKey.secretKey` instead. Key name inside the secret for the symmetric key |
206+
| authentication.tokenBroker.secret.symmetricKey | object | `{"secretKey":"symmetric.key"}` | Optional: configuration specific to symmetric key secret. |
207+
| authentication.tokenBroker.secret.symmetricKey.secretKey | string | `"symmetric.key"` | Key name inside the secret for the symmetric key |
208+
| authentication.tokenService | object | `{"type":"default"}` | The token service (`IcebergRestOAuth2ApiService`) implementation to use. Two built-in types are supported: default and disabled. The disabled type is always used when `authentication.type` is set to external. |
209+
| authentication.type | string | `"internal"` | The type of authentication to use. Three built-in types are supported: internal, external, and mixed. |
207210
| autoscaling.enabled | bool | `false` | Specifies whether automatic horizontal scaling should be enabled. Do not enable this when using in-memory version store type. |
208211
| autoscaling.maxReplicas | int | `3` | The maximum number of replicas to maintain. |
209212
| autoscaling.minReplicas | int | `1` | The minimum number of replicas to maintain. |
@@ -283,6 +286,22 @@ ct install --namespace polaris --charts ./helm/polaris
283286
| metrics.enabled | bool | `true` | Specifies whether metrics for the polaris server should be enabled. |
284287
| metrics.tags | object | `{}` | Additional tags (dimensional labels) to add to the metrics. |
285288
| nodeSelector | object | `{}` | Node labels which must match for the polaris pod to be scheduled on that node. See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector. |
289+
| oidc | object | `{"authServeUrl":null,"client":{"id":"polaris","secret":{"clientSecret":"clientSecret","name":null}},"principalMapper":{"idClaimPath":null,"nameClaimPath":null,"type":"default"},"principalRolesMapper":{"filter":null,"mappings":[],"rolesClaimPath":null,"type":"default"}}` | Polaris OIDC configuration. Only relevant when at least one realm is configured for external (or mixed) authentication. The currently supported configuration is for a single, default OIDC tenant. For more complex scenarios, including OIDC multi-tenancy, you will need to provide the relevant configuration using the `advancedConfig` section. |
290+
| oidc.authServeUrl | string | `nil` | The authentication server URL. Must be provided if at least one realm is configured for external authentication. |
291+
| oidc.client | object | `{"id":"polaris","secret":{"clientSecret":"clientSecret","name":null}}` | The client to use when authenticating with the authentication server. |
292+
| oidc.client.id | string | `"polaris"` | The client ID to use when authenticating with the authentication server. |
293+
| oidc.client.secret | object | `{"clientSecret":"clientSecret","name":null}` | The secret to pull the client secret from. |
294+
| oidc.client.secret.clientSecret | string | `"clientSecret"` | The key name inside the secret to pull the client secret from. |
295+
| oidc.client.secret.name | string | `nil` | The name of the secret to pull the client secret from. |
296+
| oidc.principalMapper | object | `{"idClaimPath":null,"nameClaimPath":null,"type":"default"}` | Principal mapping configuration. |
297+
| oidc.principalMapper.idClaimPath | string | `nil` | The path to the claim that contains the principal ID. Nested paths can be expressed using "/" as a separator, e.g. "polaris/principal_id" would look for the "principal_id" field inside the "polaris" object in the token claims. |
298+
| oidc.principalMapper.nameClaimPath | string | `nil` | The claim that contains the principal name. Nested paths can be expressed using "/" as a separator, e.g. "polaris/principal_name" would look for the "principal_name" field inside the "polaris" object in the token claims. |
299+
| oidc.principalMapper.type | string | `"default"` | The `PrincipalMapper` implementation to use. Only one built-in type is supported: default. |
300+
| oidc.principalRolesMapper | object | `{"filter":null,"mappings":[],"rolesClaimPath":null,"type":"default"}` | Principal roles mapping configuration. |
301+
| oidc.principalRolesMapper.filter | string | `nil` | A regular expression that matches the role names in the identity. Only roles that match this regex will be included in the Polaris-specific roles. |
302+
| oidc.principalRolesMapper.mappings | list | `[]` | A list of regex mappings that will be applied to each role name in the identity. |
303+
| oidc.principalRolesMapper.rolesClaimPath | string | `nil` | The path to the claim that contains the principal roles. Nested paths can be expressed using "/" as a separator, e.g. "polaris/principal_roles" would look for the "principal_roles" field inside the "polaris" object in the token claims. |
304+
| oidc.principalRolesMapper.type | string | `"default"` | The `PrincipalRolesMapper` implementation to use. Only one built-in type is supported: default. |
286305
| persistence | object | `{"relationalJdbc":{"secret":{"jdbcUrl":"jdbcUrl","name":null,"password":"password","username":"username"}},"type":"in-memory"}` | Polaris persistence configuration. |
287306
| persistence.relationalJdbc | object | `{"secret":{"jdbcUrl":"jdbcUrl","name":null,"password":"password","username":"username"}}` | The configuration for the relational-jdbc persistence manager. |
288307
| persistence.relationalJdbc.secret | object | `{"jdbcUrl":"jdbcUrl","name":null,"password":"password","username":"username"}` | The secret name to pull the database connection properties from. |

‎helm/polaris/ci/authentication-values.yaml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing,
13+
# software distributed under the License is distributed on an
14+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
# KIND, either express or implied. See the License for the
16+
# specific language governing permissions and limitations
17+
# under the License.
18+
#
19+
20+
image:
21+
pullPolicy: Never
22+
23+
realmContext:
24+
realms:
25+
- realm0
26+
- realm1
27+
- realm2
28+
- REALM 3
29+
30+
authentication:
31+
type: internal
32+
authenticator:
33+
type: default
34+
activeRolesProvider:
35+
type: default
36+
tokenService:
37+
type: default
38+
tokenBroker:
39+
type: rsa-key-pair
40+
secret:
41+
name: polaris-token-broker
42+
rsaKeyPair:
43+
publicKey: public.pem
44+
privateKey: private.pem
45+
46+
realmOverrides:
47+
48+
realm1:
49+
type: mixed
50+
tokenBroker:
51+
type: rsa-key-pair
52+
secret:
53+
name: polaris-token-broker
54+
55+
realm2:
56+
type: external
57+
58+
"REALM 3":
59+
type: internal
60+
tokenBroker:
61+
type: symmetric-key
62+
secret:
63+
name: polaris-token-broker
64+
65+
oidc:
66+
authServeUrl: https://auth.example.com/realms/polaris
67+
client:
68+
id: polaris
69+
secret:
70+
name: polaris-oidc
71+
key: client-secret

‎helm/polaris/ci/fixtures/oidc.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing,
13+
# software distributed under the License is distributed on an
14+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
# KIND, either express or implied. See the License for the
16+
# specific language governing permissions and limitations
17+
# under the License.
18+
#
19+
20+
apiVersion: v1
21+
kind: Secret
22+
metadata:
23+
name: polaris-oidc
24+
type: Opaque
25+
stringData:
26+
client-secret: "secret"

‎helm/polaris/ci/fixtures/token-broker.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,3 +61,4 @@ stringData:
6161
wIGRMc6MkZboyVwbi+iUbTkmxGFaTVdZWlXQPFCdm+SNT4jZ1b8dZuIBYvwnpWuO/RDurfgAvmtX
6262
s/jMUwIDAQAB
6363
-----END PUBLIC KEY-----
64+
symmetric.key: "secret"

0 commit comments

Comments
 (0)