You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@impala.apache.org by st...@apache.org on 2026/08/12 14:57:57 UTC
(impala) 01/02: IMPALA-15017: Add secure-cluster Helm options
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/impala.git
commit 552e8dfec0640cd51e2c51ac2cb3f600c2492040
Author: Anubhav Jindal <an...@gmail.com>
AuthorDate: Wed Jun 3 14:55:11 2026 -0700
IMPALA-15017: Add secure-cluster Helm options
Add structured security values for Istio sidecar injection, Kerberos
flags/keytab inputs, and TLS certificate inputs in the Impala Helm chart.
Wire secure options into impalad/catalogd/statestored startup args and
secret/config mounts behind opt-in flags, and document required secure
cluster inputs and usage in the Kubernetes deployment guide.
Testing:
- helm lint helm/impala
- helm template impala-default helm/impala -f helm/impala/values-example.yaml
- helm template impala-secure helm/impala -f helm/impala/values-example.yaml \
--set security.kerberos.enabled=true \
--set security.kerberos.principal='impala/_HOST@EXAMPLE.COM' \
--set security.kerberos.bePrincipal='impala/_HOST@EXAMPLE.COM' \
--set security.kerberos.keytabSecretName='impala-kerberos-keytab' \
--set security.kerberos.krb5ConfigMapName='impala-krb5-conf' \
--set security.tls.enabled=true \
--set security.tls.secretName='impala-tls' \
--set security.istio.enabled=true
- helm template impala-sec-missing helm/impala \
-f helm/impala/values-example.yaml --set security.kerberos.enabled=true
(fails with required keytabSecretName error)
- Deployed non-secure compatibility release on Kubernetes test cluster
using KUBECONFIG and verified all core pods were Running.
- Ran impala-shell smoke queries: select version(); select 1;
Change-Id: I02e4c4b466424a938151bd69b28bf99ae405fae7
Assisted-by: GPT-5.3 (Cursor)
Reviewed-on: http://gerrit.cloudera.org:8080/24367
Reviewed-by: Jason Fehr <jf...@cloudera.com>
Tested-by: Jason Fehr <jf...@cloudera.com>
---
helm/impala/README.md | 73 ++++++++++++++++++++++
helm/impala/templates/catalogd-deployment.yaml | 60 ++++++++++++++++++
helm/impala/templates/hms-deployment.yaml | 9 +++
helm/impala/templates/impalad-deployment.yaml | 60 ++++++++++++++++++
helm/impala/templates/kudu-master-deployment.yaml | 9 +++
helm/impala/templates/kudu-tserver-deployment.yaml | 9 +++
helm/impala/templates/ranger-deployment.yaml | 9 +++
helm/impala/templates/statestored-deployment.yaml | 60 ++++++++++++++++++
helm/impala/values-example.yaml | 12 ++++
helm/impala/values.yaml | 26 ++++++++
10 files changed, 327 insertions(+)
diff --git a/helm/impala/README.md b/helm/impala/README.md
index 31a5b3647..88f2eb0ce 100644
--- a/helm/impala/README.md
+++ b/helm/impala/README.md
@@ -173,6 +173,62 @@ helm upgrade impala ./helm/impala -n impala \
--set auth.oauth.allowWithoutTls=true
```
+## Secure cluster configuration (Helm)
+
+Security options are opt-in and preserve non-secure quickstart defaults.
+
+### 1) Create required inputs
+
+Create a keytab secret (required when Kerberos is enabled):
+
+```bash
+kubectl -n impala create secret generic impala-kerberos-keytab \
+ --from-file=impala.keytab=/path/to/impala.keytab
+```
+
+Create a TLS secret (required when TLS is enabled):
+
+```bash
+kubectl -n impala create secret generic impala-tls \
+ --from-file=tls.crt=/path/to/tls.crt \
+ --from-file=tls.key=/path/to/tls.key \
+ --from-file=ca.crt=/path/to/ca.crt
+```
+
+Optional non-default krb5.conf:
+
+```bash
+kubectl -n impala create configmap impala-krb5-conf \
+ --from-file=krb5.conf=/path/to/krb5.conf
+```
+
+### 2) Enable Kerberos/TLS flags in chart values
+
+```bash
+helm upgrade impala ./helm/impala -n impala \
+ -f ./helm/impala/values-example.yaml \
+ --set security.kerberos.enabled=true \
+ --set security.kerberos.principal='impala/_HOST@EXAMPLE.COM' \
+ --set security.kerberos.bePrincipal='impala/_HOST@EXAMPLE.COM' \
+ --set security.kerberos.keytabSecretName='impala-kerberos-keytab' \
+ --set security.kerberos.krb5ConfigMapName='impala-krb5-conf' \
+ --set security.tls.enabled=true \
+ --set security.tls.secretName='impala-tls'
+```
+
+### 3) (Optional) Enable Istio sidecar injection
+
+```bash
+helm upgrade impala ./helm/impala -n impala \
+ -f ./helm/impala/values-example.yaml \
+ --set security.istio.enabled=true
+```
+
+If Istio ingress/gateway terminates external TLS, prefer using Istio TLS and
+leave `security.tls.enabled=false`. Enabling both Istio TLS termination and
+`security.tls.secretName` at the same external endpoint can present different
+certificates to clients and is usually not desired unless explicitly configured.
+
## Run Impala shell from laptop (tunnel)
Port-forward HS2:
@@ -297,6 +353,23 @@ kubectl patch impalacluster impala-demo -n impala --type merge -p '{
}'
```
+Enable secure-cluster overrides via `spec.set`:
+
+```bash
+kubectl patch impalacluster impala-demo -n impala --type merge -p '{
+ "spec": {
+ "set": {
+ "security.kerberos.enabled": "true",
+ "security.kerberos.principal": "impala/_HOST@EXAMPLE.COM",
+ "security.kerberos.keytabSecretName": "impala-kerberos-keytab",
+ "security.tls.enabled": "true",
+ "security.tls.secretName": "impala-tls",
+ "security.istio.enabled": "true"
+ }
+ }
+}'
+```
+
## Troubleshooting
If HMS fails creating directories on the storage volume, set HMS pod user/group:
diff --git a/helm/impala/templates/catalogd-deployment.yaml b/helm/impala/templates/catalogd-deployment.yaml
index 4d7eba7c1..1bdda28a6 100644
--- a/helm/impala/templates/catalogd-deployment.yaml
+++ b/helm/impala/templates/catalogd-deployment.yaml
@@ -36,6 +36,15 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/name: {{ include "impala.name" . }}
app.kubernetes.io/component: catalogd
+{{- if or .Values.security.istio.enabled .Values.security.istio.podAnnotations }}
+ annotations:
+{{- if .Values.security.istio.enabled }}
+ sidecar.istio.io/inject: "true"
+{{- end }}
+{{- with .Values.security.istio.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- end }}
spec:
{{- with .Values.nodeSelector }}
nodeSelector:
@@ -69,6 +78,25 @@ spec:
- -ranger_app_id={{ .Values.auth.ranger.appId }}
- -server_name={{ .Values.auth.ranger.serverName }}
{{- end }}
+{{- if .Values.security.kerberos.enabled }}
+ - -principal={{ required "security.kerberos.principal is required when security.kerberos.enabled=true" .Values.security.kerberos.principal }}
+{{- if .Values.security.kerberos.bePrincipal }}
+ - -be_principal={{ .Values.security.kerberos.bePrincipal }}
+{{- end }}
+ - -keytab_file={{ printf "%s/%s" .Values.security.kerberos.keytabMountPath .Values.security.kerberos.keytabFileName }}
+{{- if .Values.security.kerberos.krb5ConfigMapName }}
+ - -krb5_conf={{ printf "%s/%s" .Values.security.kerberos.krb5ConfigMountPath .Values.security.kerberos.krb5ConfigFileName }}
+{{- end }}
+{{- end }}
+{{- if .Values.security.tls.enabled }}
+ - -ssl_server_certificate={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.certFileName }}
+ - -ssl_private_key={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.keyFileName }}
+ - -webserver_certificate_file={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.certFileName }}
+ - -webserver_private_key_file={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.keyFileName }}
+{{- if .Values.security.tls.clientCaFileName }}
+ - -ssl_client_ca_certificate={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.clientCaFileName }}
+{{- end }}
+{{- end }}
{{- range .Values.catalogd.extraArgs }}
- {{ . | quote }}
{{- end }}
@@ -90,6 +118,23 @@ spec:
- name: conf
mountPath: /opt/impala/conf/ranger-hive-audit.xml
subPath: ranger-hive-audit.xml
+{{- end }}
+{{- if .Values.security.kerberos.enabled }}
+ - name: kerberos-keytab
+ mountPath: {{ printf "%s/%s" .Values.security.kerberos.keytabMountPath .Values.security.kerberos.keytabFileName }}
+ subPath: {{ .Values.security.kerberos.keytabFileName }}
+ readOnly: true
+{{- if .Values.security.kerberos.krb5ConfigMapName }}
+ - name: kerberos-krb5
+ mountPath: {{ printf "%s/%s" .Values.security.kerberos.krb5ConfigMountPath .Values.security.kerberos.krb5ConfigFileName }}
+ subPath: {{ .Values.security.kerberos.krb5ConfigFileName }}
+ readOnly: true
+{{- end }}
+{{- end }}
+{{- if .Values.security.tls.enabled }}
+ - name: tls-certs
+ mountPath: {{ .Values.security.tls.mountPath }}
+ readOnly: true
{{- end }}
volumes:
- name: conf
@@ -102,3 +147,18 @@ spec:
{{- else }}
emptyDir: {}
{{- end }}
+{{- if .Values.security.kerberos.enabled }}
+ - name: kerberos-keytab
+ secret:
+ secretName: {{ required "security.kerberos.keytabSecretName is required when security.kerberos.enabled=true" .Values.security.kerberos.keytabSecretName }}
+{{- if .Values.security.kerberos.krb5ConfigMapName }}
+ - name: kerberos-krb5
+ configMap:
+ name: {{ .Values.security.kerberos.krb5ConfigMapName }}
+{{- end }}
+{{- end }}
+{{- if .Values.security.tls.enabled }}
+ - name: tls-certs
+ secret:
+ secretName: {{ required "security.tls.secretName is required when security.tls.enabled=true" .Values.security.tls.secretName }}
+{{- end }}
diff --git a/helm/impala/templates/hms-deployment.yaml b/helm/impala/templates/hms-deployment.yaml
index 15d2947e8..67531d7fd 100644
--- a/helm/impala/templates/hms-deployment.yaml
+++ b/helm/impala/templates/hms-deployment.yaml
@@ -36,6 +36,15 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/name: {{ include "impala.name" . }}
app.kubernetes.io/component: hms
+{{- if or .Values.security.istio.enabled .Values.security.istio.podAnnotations }}
+ annotations:
+{{- if .Values.security.istio.enabled }}
+ sidecar.istio.io/inject: "true"
+{{- end }}
+{{- with .Values.security.istio.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- end }}
spec:
{{- with .Values.nodeSelector }}
nodeSelector:
diff --git a/helm/impala/templates/impalad-deployment.yaml b/helm/impala/templates/impalad-deployment.yaml
index ccc06be23..7368a1eef 100644
--- a/helm/impala/templates/impalad-deployment.yaml
+++ b/helm/impala/templates/impalad-deployment.yaml
@@ -36,6 +36,15 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/name: {{ include "impala.name" . }}
app.kubernetes.io/component: impalad
+{{- if or .Values.security.istio.enabled .Values.security.istio.podAnnotations }}
+ annotations:
+{{- if .Values.security.istio.enabled }}
+ sidecar.istio.io/inject: "true"
+{{- end }}
+{{- with .Values.security.istio.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- end }}
spec:
{{- with .Values.nodeSelector }}
nodeSelector:
@@ -99,6 +108,25 @@ spec:
- -ranger_service_type={{ .Values.auth.ranger.serviceType }}
- -ranger_app_id={{ .Values.auth.ranger.appId }}
- -server_name={{ .Values.auth.ranger.serverName }}
+{{- end }}
+{{- if .Values.security.kerberos.enabled }}
+ - -principal={{ required "security.kerberos.principal is required when security.kerberos.enabled=true" .Values.security.kerberos.principal }}
+{{- if .Values.security.kerberos.bePrincipal }}
+ - -be_principal={{ .Values.security.kerberos.bePrincipal }}
+{{- end }}
+ - -keytab_file={{ printf "%s/%s" .Values.security.kerberos.keytabMountPath .Values.security.kerberos.keytabFileName }}
+{{- if .Values.security.kerberos.krb5ConfigMapName }}
+ - -krb5_conf={{ printf "%s/%s" .Values.security.kerberos.krb5ConfigMountPath .Values.security.kerberos.krb5ConfigFileName }}
+{{- end }}
+{{- end }}
+{{- if .Values.security.tls.enabled }}
+ - -ssl_server_certificate={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.certFileName }}
+ - -ssl_private_key={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.keyFileName }}
+ - -webserver_certificate_file={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.certFileName }}
+ - -webserver_private_key_file={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.keyFileName }}
+{{- if .Values.security.tls.clientCaFileName }}
+ - -ssl_client_ca_certificate={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.clientCaFileName }}
+{{- end }}
{{- end }}
- -mt_dop_auto_fallback={{ .Values.impalad.mtDopAutoFallback }}
- -default_query_options={{ .Values.impalad.defaultQueryOptions }}
@@ -129,6 +157,23 @@ spec:
- name: conf
mountPath: /opt/impala/conf/ranger-hive-audit.xml
subPath: ranger-hive-audit.xml
+{{- end }}
+{{- if .Values.security.kerberos.enabled }}
+ - name: kerberos-keytab
+ mountPath: {{ printf "%s/%s" .Values.security.kerberos.keytabMountPath .Values.security.kerberos.keytabFileName }}
+ subPath: {{ .Values.security.kerberos.keytabFileName }}
+ readOnly: true
+{{- if .Values.security.kerberos.krb5ConfigMapName }}
+ - name: kerberos-krb5
+ mountPath: {{ printf "%s/%s" .Values.security.kerberos.krb5ConfigMountPath .Values.security.kerberos.krb5ConfigFileName }}
+ subPath: {{ .Values.security.kerberos.krb5ConfigFileName }}
+ readOnly: true
+{{- end }}
+{{- end }}
+{{- if .Values.security.tls.enabled }}
+ - name: tls-certs
+ mountPath: {{ .Values.security.tls.mountPath }}
+ readOnly: true
{{- end }}
volumes:
- name: conf
@@ -141,3 +186,18 @@ spec:
{{- else }}
emptyDir: {}
{{- end }}
+{{- if .Values.security.kerberos.enabled }}
+ - name: kerberos-keytab
+ secret:
+ secretName: {{ required "security.kerberos.keytabSecretName is required when security.kerberos.enabled=true" .Values.security.kerberos.keytabSecretName }}
+{{- if .Values.security.kerberos.krb5ConfigMapName }}
+ - name: kerberos-krb5
+ configMap:
+ name: {{ .Values.security.kerberos.krb5ConfigMapName }}
+{{- end }}
+{{- end }}
+{{- if .Values.security.tls.enabled }}
+ - name: tls-certs
+ secret:
+ secretName: {{ required "security.tls.secretName is required when security.tls.enabled=true" .Values.security.tls.secretName }}
+{{- end }}
diff --git a/helm/impala/templates/kudu-master-deployment.yaml b/helm/impala/templates/kudu-master-deployment.yaml
index fb08ee8a0..6dca521f9 100644
--- a/helm/impala/templates/kudu-master-deployment.yaml
+++ b/helm/impala/templates/kudu-master-deployment.yaml
@@ -39,6 +39,15 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/name: {{ include "impala.name" . }}
app.kubernetes.io/component: kudu-master
+{{- if or .Values.security.istio.enabled .Values.security.istio.podAnnotations }}
+ annotations:
+{{- if .Values.security.istio.enabled }}
+ sidecar.istio.io/inject: "true"
+{{- end }}
+{{- with .Values.security.istio.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- end }}
spec:
containers:
- name: kudu-master
diff --git a/helm/impala/templates/kudu-tserver-deployment.yaml b/helm/impala/templates/kudu-tserver-deployment.yaml
index 4d284a255..c24d19ddf 100644
--- a/helm/impala/templates/kudu-tserver-deployment.yaml
+++ b/helm/impala/templates/kudu-tserver-deployment.yaml
@@ -39,6 +39,15 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/name: {{ include "impala.name" . }}
app.kubernetes.io/component: kudu-tserver
+{{- if or .Values.security.istio.enabled .Values.security.istio.podAnnotations }}
+ annotations:
+{{- if .Values.security.istio.enabled }}
+ sidecar.istio.io/inject: "true"
+{{- end }}
+{{- with .Values.security.istio.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- end }}
spec:
containers:
- name: kudu-tserver
diff --git a/helm/impala/templates/ranger-deployment.yaml b/helm/impala/templates/ranger-deployment.yaml
index 6e0382e76..0f861a61e 100644
--- a/helm/impala/templates/ranger-deployment.yaml
+++ b/helm/impala/templates/ranger-deployment.yaml
@@ -37,6 +37,15 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/name: {{ include "impala.name" . }}
app.kubernetes.io/component: ranger
+{{- if or .Values.security.istio.enabled .Values.security.istio.podAnnotations }}
+ annotations:
+{{- if .Values.security.istio.enabled }}
+ sidecar.istio.io/inject: "true"
+{{- end }}
+{{- with .Values.security.istio.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- end }}
spec:
containers:
- name: ranger
diff --git a/helm/impala/templates/statestored-deployment.yaml b/helm/impala/templates/statestored-deployment.yaml
index 0eb4a48c9..cea04002f 100644
--- a/helm/impala/templates/statestored-deployment.yaml
+++ b/helm/impala/templates/statestored-deployment.yaml
@@ -36,6 +36,15 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/name: {{ include "impala.name" . }}
app.kubernetes.io/component: statestored
+{{- if or .Values.security.istio.enabled .Values.security.istio.podAnnotations }}
+ annotations:
+{{- if .Values.security.istio.enabled }}
+ sidecar.istio.io/inject: "true"
+{{- end }}
+{{- with .Values.security.istio.podAnnotations }}
+{{ toYaml . | indent 8 }}
+{{- end }}
+{{- end }}
spec:
{{- with .Values.nodeSelector }}
nodeSelector:
@@ -57,6 +66,25 @@ spec:
- -redirect_stdout_stderr=false
- -logtostderr
- -v={{ .Values.statestored.v }}
+{{- if .Values.security.kerberos.enabled }}
+ - -principal={{ required "security.kerberos.principal is required when security.kerberos.enabled=true" .Values.security.kerberos.principal }}
+{{- if .Values.security.kerberos.bePrincipal }}
+ - -be_principal={{ .Values.security.kerberos.bePrincipal }}
+{{- end }}
+ - -keytab_file={{ printf "%s/%s" .Values.security.kerberos.keytabMountPath .Values.security.kerberos.keytabFileName }}
+{{- if .Values.security.kerberos.krb5ConfigMapName }}
+ - -krb5_conf={{ printf "%s/%s" .Values.security.kerberos.krb5ConfigMountPath .Values.security.kerberos.krb5ConfigFileName }}
+{{- end }}
+{{- end }}
+{{- if .Values.security.tls.enabled }}
+ - -ssl_server_certificate={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.certFileName }}
+ - -ssl_private_key={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.keyFileName }}
+ - -webserver_certificate_file={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.certFileName }}
+ - -webserver_private_key_file={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.keyFileName }}
+{{- if .Values.security.tls.clientCaFileName }}
+ - -ssl_client_ca_certificate={{ printf "%s/%s" .Values.security.tls.mountPath .Values.security.tls.clientCaFileName }}
+{{- end }}
+{{- end }}
{{- range .Values.statestored.extraArgs }}
- {{ . | quote }}
{{- end }}
@@ -69,7 +97,39 @@ spec:
- name: conf
mountPath: /opt/impala/conf/hive-site.xml
subPath: hive-site.xml
+{{- if .Values.security.kerberos.enabled }}
+ - name: kerberos-keytab
+ mountPath: {{ printf "%s/%s" .Values.security.kerberos.keytabMountPath .Values.security.kerberos.keytabFileName }}
+ subPath: {{ .Values.security.kerberos.keytabFileName }}
+ readOnly: true
+{{- if .Values.security.kerberos.krb5ConfigMapName }}
+ - name: kerberos-krb5
+ mountPath: {{ printf "%s/%s" .Values.security.kerberos.krb5ConfigMountPath .Values.security.kerberos.krb5ConfigFileName }}
+ subPath: {{ .Values.security.kerberos.krb5ConfigFileName }}
+ readOnly: true
+{{- end }}
+{{- end }}
+{{- if .Values.security.tls.enabled }}
+ - name: tls-certs
+ mountPath: {{ .Values.security.tls.mountPath }}
+ readOnly: true
+{{- end }}
volumes:
- name: conf
configMap:
name: {{ include "impala.fullname" . }}-conf
+{{- if .Values.security.kerberos.enabled }}
+ - name: kerberos-keytab
+ secret:
+ secretName: {{ required "security.kerberos.keytabSecretName is required when security.kerberos.enabled=true" .Values.security.kerberos.keytabSecretName }}
+{{- if .Values.security.kerberos.krb5ConfigMapName }}
+ - name: kerberos-krb5
+ configMap:
+ name: {{ .Values.security.kerberos.krb5ConfigMapName }}
+{{- end }}
+{{- end }}
+{{- if .Values.security.tls.enabled }}
+ - name: tls-certs
+ secret:
+ secretName: {{ required "security.tls.secretName is required when security.tls.enabled=true" .Values.security.tls.secretName }}
+{{- end }}
diff --git a/helm/impala/values-example.yaml b/helm/impala/values-example.yaml
index 1010c04a1..fcfc3a124 100644
--- a/helm/impala/values-example.yaml
+++ b/helm/impala/values-example.yaml
@@ -50,3 +50,15 @@ auth:
# Example OAuth settings:
# jwksUrl: "https://idp.example.org/.well-known/jwks.json"
# jwtCustomClaimUsername: "sub"
+
+security:
+ istio:
+ enabled: false
+ kerberos:
+ enabled: false
+ principal: ""
+ bePrincipal: ""
+ keytabSecretName: ""
+ tls:
+ enabled: false
+ secretName: ""
diff --git a/helm/impala/values.yaml b/helm/impala/values.yaml
index a0cec5967..d2a853660 100644
--- a/helm/impala/values.yaml
+++ b/helm/impala/values.yaml
@@ -92,6 +92,32 @@ auth:
# http://<release>-ranger:<ranger.adminPort>.
adminUrl: ""
+security:
+ istio:
+ # When enabled, annotate pods for Istio sidecar injection.
+ enabled: false
+ # Optional extra pod annotations, for example:
+ # proxy.istio.io/config: '{ "holdApplicationUntilProxyStarts": true }'
+ podAnnotations: {}
+ kerberos:
+ enabled: false
+ principal: ""
+ bePrincipal: ""
+ keytabSecretName: ""
+ keytabFileName: "impala.keytab"
+ keytabMountPath: "/etc/impala/security"
+ # Optional krb5.conf injection for non-standard configurations.
+ krb5ConfigMapName: ""
+ krb5ConfigFileName: "krb5.conf"
+ krb5ConfigMountPath: "/etc/krb5"
+ tls:
+ enabled: false
+ secretName: ""
+ mountPath: "/etc/impala/tls"
+ certFileName: "tls.crt"
+ keyFileName: "tls.key"
+ clientCaFileName: "ca.crt"
+
kudu:
enabled: false
image: "apache/kudu:1.17"