Jason Fehr has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24366 )
Change subject: IMPALA-15016: Add OAuth Helm auth options ...................................................................... IMPALA-15016: Add OAuth Helm auth options Add typed auth.oauth Helm values and wire them into impalad startup args so OAuth token authentication can be configured without raw extraArgs overrides. Validate OAuth JWKS configuration so signature verification requires exactly one of auth.oauth.jwksUrl or auth.oauth.jwksFilePath. Document Helm and operator override usage for OAuth settings in the Kubernetes deployment guide and chart example values. Testing: - helm lint helm/impala - helm template impala-no-oauth helm/impala -f helm/impala/values-example.yaml - helm template impala-oauth helm/impala -f helm/impala/values-example.yaml \ --set auth.oauth.enabled=true \ --set auth.oauth.jwksUrl=https://idp.example.org/.well-known/jwks.json \ --set auth.oauth.jwtCustomClaimUsername=sub - helm template impala15016-oauth-valid-file helm/impala \ --set auth.oauth.enabled=true --set auth.oauth.jwtValidateSignature=true \ --set auth.oauth.jwksFilePath=/etc/impala/jwks.json - helm template impala15016-oauth-invalid-none helm/impala \ --set auth.oauth.enabled=true --set auth.oauth.jwtValidateSignature=true (fails as expected) - helm template impala15016-oauth-invalid-both helm/impala \ --set auth.oauth.enabled=true --set auth.oauth.jwtValidateSignature=true \ --set auth.oauth.jwksUrl=https://idp.example.org/jwks \ --set auth.oauth.jwksFilePath=/etc/impala/jwks.json (fails as expected) - Deployed on a Kubernetes test cluster using KUBECONFIG. - Verified impalad includes OAuth startup flags when enabled. - Ran impala-shell smoke queries: select version(); select 1; Change-Id: Ibf9d305dd37f1d173b0d2339c7a7d5098718e2fd Assisted-by: GPT-5.3 (Cursor) Reviewed-on: http://gerrit.cloudera.org:8080/24366 Reviewed-by: Jason Fehr <[email protected]> Tested-by: Jason Fehr <[email protected]> --- M helm/impala/README.md M helm/impala/templates/impalad-deployment.yaml A helm/impala/templates/oauth-validation.yaml M helm/impala/values-example.yaml M helm/impala/values.yaml 5 files changed, 108 insertions(+), 0 deletions(-) Approvals: Jason Fehr: Looks good to me, approved; Verified -- To view, visit http://gerrit.cloudera.org:8080/24366 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: merged Gerrit-Change-Id: Ibf9d305dd37f1d173b0d2339c7a7d5098718e2fd Gerrit-Change-Number: 24366 Gerrit-PatchSet: 47 Gerrit-Owner: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Abhishek Rawat <[email protected]> Gerrit-Reviewer: Anubhav Jindal <[email protected]> Gerrit-Reviewer: Gokul Kolady <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Jason Fehr <[email protected]>
