Skip to content

Commit b952af9

Browse files
adwk67adwk67
committed
add kerberos and override static mapping
1 parent 2be7fa2 commit b952af9

File tree

7 files changed

+180
-31
lines changed

7 files changed

+180
-31
lines changed

‎Tiltfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
k8s_yaml('test/stack/01-install-krb5-kdc.yaml')
2+
k8s_yaml('test/stack/02-create-kerberos-secretclass.yaml')
13
k8s_yaml('test/stack/05-opa.yaml')
24
k8s_yaml('test/stack/10-hdfs.yaml')
35

‎src/main/java/tech/stackable/hadoop/StackableGroupMapper.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,6 @@ public void cacheGroupsRefresh() {
9595
@Override
9696
public void cacheGroupsAdd(List<String> groups) {
9797
// does nothing in this provider of user to groups mapping
98-
LOG.info("ignoring cacheGroupsAdd: caching should be provided by the policy provider");
98+
LOG.info("ignoring cacheGroupsAdd for groups [{}]: caching should be provided by the policy provider", groups);
9999
}
100100
}

‎test/stack/01-install-krb5-kdc.yaml‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: krb5-kdc
6+
spec:
7+
selector:
8+
app: krb5-kdc
9+
ports:
10+
- name: kadmin
11+
port: 749
12+
- name: kdc
13+
port: 88
14+
- name: kdc-udp
15+
port: 88
16+
protocol: UDP
17+
---
18+
apiVersion: apps/v1
19+
kind: StatefulSet
20+
metadata:
21+
name: krb5-kdc
22+
spec:
23+
serviceName: krb5-kdc
24+
selector:
25+
matchLabels:
26+
app: krb5-kdc
27+
template:
28+
metadata:
29+
labels:
30+
app: krb5-kdc
31+
spec:
32+
initContainers:
33+
- name: init
34+
image: docker.stackable.tech/stackable/krb5:1.18.2-stackable0.0.0-dev
35+
args:
36+
- sh
37+
- -euo
38+
- pipefail
39+
- -c
40+
- |
41+
test -e /var/kerberos/krb5kdc/principal || kdb5_util create -s -P asdf
42+
kadmin.local get_principal -terse root/admin || kadmin.local add_principal -pw asdf root/admin
43+
# stackable-secret-operator principal must match the keytab specified in the SecretClass
44+
kadmin.local get_principal -terse stackable-secret-operator || kadmin.local add_principal -e aes256-cts-hmac-sha384-192:normal -pw asdf stackable-secret-operator
45+
env:
46+
- name: KRB5_CONFIG
47+
value: /stackable/config/krb5.conf
48+
volumeMounts:
49+
- mountPath: /stackable/config
50+
name: config
51+
- mountPath: /var/kerberos/krb5kdc
52+
name: data
53+
containers:
54+
- name: kdc
55+
image: docker.stackable.tech/stackable/krb5:1.18.2-stackable0.0.0-dev
56+
args:
57+
- krb5kdc
58+
- -n
59+
env:
60+
- name: KRB5_CONFIG
61+
value: /stackable/config/krb5.conf
62+
volumeMounts:
63+
- mountPath: /stackable/config
64+
name: config
65+
- mountPath: /var/kerberos/krb5kdc
66+
name: data
67+
- name: kadmind
68+
image: docker.stackable.tech/stackable/krb5:1.18.2-stackable0.0.0-dev
69+
args:
70+
- kadmind
71+
- -nofork
72+
env:
73+
- name: KRB5_CONFIG
74+
value: /stackable/config/krb5.conf
75+
volumeMounts:
76+
- mountPath: /stackable/config
77+
name: config
78+
- mountPath: /var/kerberos/krb5kdc
79+
name: data
80+
- name: client
81+
image: docker.stackable.tech/stackable/krb5:1.18.2-stackable0.0.0-dev
82+
tty: true
83+
stdin: true
84+
env:
85+
- name: KRB5_CONFIG
86+
value: /stackable/config/krb5.conf
87+
volumeMounts:
88+
- mountPath: /stackable/config
89+
name: config
90+
volumes:
91+
- name: config
92+
configMap:
93+
name: krb5-kdc
94+
volumeClaimTemplates:
95+
- metadata:
96+
name: data
97+
spec:
98+
accessModes:
99+
- ReadWriteOnce
100+
resources:
101+
requests:
102+
storage: 1Gi
103+
---
104+
apiVersion: v1
105+
kind: ConfigMap
106+
metadata:
107+
name: krb5-kdc
108+
data:
109+
krb5.conf: |
110+
[logging]
111+
default = STDERR
112+
kdc = STDERR
113+
admin_server = STDERR
114+
# default = FILE:/var/log/krb5libs.log
115+
# kdc = FILE:/var/log/krb5kdc.log
116+
# admin_server = FILE:/vaggr/log/kadmind.log
117+
[libdefaults]
118+
dns_lookup_realm = false
119+
ticket_lifetime = 24h
120+
renew_lifetime = 7d
121+
forwardable = true
122+
rdns = false
123+
default_realm = CLUSTER.LOCAL
124+
spake_preauth_groups = edwards25519
125+
[realms]
126+
CLUSTER.LOCAL = {
127+
acl_file = /stackable/config/kadm5.acl
128+
disable_encrypted_timestamp = false
129+
}
130+
[domain_realm]
131+
.cluster.local = CLUSTER.LOCAL
132+
cluster.local = CLUSTER.LOCAL
133+
kadm5.acl: |
134+
root/admin *e
135+
stackable-secret-operator *e

‎test/stack/02-create-kerberos-secretclass.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
apiVersion: secrets.stackable.tech/v1alpha1
3+
kind: SecretClass
4+
metadata:
5+
name: kerberos-default
6+
spec:
7+
backend:
8+
kerberosKeytab:
9+
realmName: CLUSTER.LOCAL
10+
kdc: krb5-kdc.default.svc.cluster.local
11+
admin:
12+
mit:
13+
kadminServer: krb5-kdc.default.svc.cluster.local
14+
adminKeytabSecret:
15+
namespace: default
16+
name: secret-operator-keytab
17+
adminPrincipal: stackable-secret-operator
18+
---
19+
apiVersion: v1
20+
kind: Secret
21+
metadata:
22+
name: secret-operator-keytab
23+
data:
24+
# To create keytab. When promted enter password asdf
25+
# cat | ktutil << 'EOF'
26+
# list
27+
# add_entry -password -p stackable-secret-operator@CLUSTER.LOCAL -k 1 -e aes256-cts-hmac-sha384-192
28+
# wkt /tmp/keytab
29+
# EOF
30+
keytab: BQIAAABdAAEADUNMVVNURVIuTE9DQUwAGXN0YWNrYWJsZS1zZWNyZXQtb3BlcmF0b3IAAAABZAYWIgEAFAAgm8MCZ8B//XF1tH92GciD6/usWUNAmBTZnZQxLua2TkgAAAAB

‎test/stack/05-opa.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,13 @@ data:
3131
"groups": ["/admin", "/superuser"],
3232
"customAttributes": {},
3333
},
34+
# Hadoop will use the short-name for group mappings
35+
"nn": {
36+
"id": "af07f12c-7890-40a7-93e0-874537bdf3f5",
37+
"username": "nn",
38+
"groups": ["/admin", "/superuser"],
39+
"customAttributes": {},
40+
},
3441
}
3542
3643
---

‎test/stack/10-hdfs.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,12 @@ spec:
2828
productVersion: 3.3.6
2929
custom: hdfs
3030
clusterConfig:
31-
listenerClass: external-unstable
3231
dfsReplication: 1
3332
zookeeperConfigMapName: simple-hdfs-znode
33+
authentication:
34+
tlsSecretClass: tls
35+
kerberos:
36+
secretClass: kerberos-default
3437
nameNodes:
3538
roleGroups:
3639
default:
@@ -40,6 +43,7 @@ spec:
4043
core-site.xml:
4144
hadoop.security.group.mapping: "tech.stackable.hadoop.StackableGroupMapper"
4245
hadoop.security.group.mapping.opa.url: "http://test-opa.default.svc.cluster.local:8081/v1/data/hdfs"
46+
hadoop.user.group.static.mapping.overrides: ""
4347
replicas: 2
4448
dataNodes:
4549
roleGroups:

‎test/stack/15-rolebinding.yaml‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

0 commit comments

Comments
 (0)