(impala) branch master updated: IMPALA-15016: Add OAuth Helm auth options

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/impala.git


The following commit(s) were added to refs/heads/master by this push:
     new 05ffd62a7 IMPALA-15016: Add OAuth Helm auth options
05ffd62a7 is described below

commit 05ffd62a742a7bc21990b0777962b29cfce0fdb3
Author: Anubhav Jindal <an...@gmail.com>
AuthorDate: Tue May 26 16:11:48 2026 -0700

    IMPALA-15016: Add OAuth Helm auth options
    
    Add typed auth.oauth Helm values and wire them into impalad startup
    args so OAuth token authentication can be configured without raw
    extraArgs overrides.
    
    Validate OAuth JWKS configuration so signature verification requires
    exactly one of auth.oauth.jwksUrl or auth.oauth.jwksFilePath.
    
    Document Helm and operator override usage for OAuth settings in the
    Kubernetes deployment guide and chart example values.
    
    Testing:
    - helm lint helm/impala
    - helm template impala-no-oauth helm/impala -f helm/impala/values-example.yaml
    - helm template impala-oauth helm/impala -f helm/impala/values-example.yaml \
      --set auth.oauth.enabled=true \
      --set auth.oauth.jwksUrl=https://idp.example.org/.well-known/jwks.json \
      --set auth.oauth.jwtCustomClaimUsername=sub
    - helm template impala15016-oauth-valid-file helm/impala \
      --set auth.oauth.enabled=true --set auth.oauth.jwtValidateSignature=true \
      --set auth.oauth.jwksFilePath=/etc/impala/jwks.json
    - helm template impala15016-oauth-invalid-none helm/impala \
      --set auth.oauth.enabled=true --set auth.oauth.jwtValidateSignature=true
      (fails as expected)
    - helm template impala15016-oauth-invalid-both helm/impala \
      --set auth.oauth.enabled=true --set auth.oauth.jwtValidateSignature=true \
      --set auth.oauth.jwksUrl=https://idp.example.org/jwks \
      --set auth.oauth.jwksFilePath=/etc/impala/jwks.json (fails as expected)
    - Deployed on a Kubernetes test cluster using KUBECONFIG.
    - Verified impalad includes OAuth startup flags when enabled.
    - Ran impala-shell smoke queries: select version(); select 1;
    
    Change-Id: Ibf9d305dd37f1d173b0d2339c7a7d5098718e2fd
    Assisted-by: GPT-5.3 (Cursor)
    Reviewed-on: http://gerrit.cloudera.org:8080/24366
    Reviewed-by: Jason Fehr <jf...@cloudera.com>
    Tested-by: Jason Fehr <jf...@cloudera.com>
---
 helm/impala/README.md                         | 34 +++++++++++++++++++++++++++
 helm/impala/templates/impalad-deployment.yaml | 24 +++++++++++++++++++
 helm/impala/templates/oauth-validation.yaml   | 29 +++++++++++++++++++++++
 helm/impala/values-example.yaml               |  5 ++++
 helm/impala/values.yaml                       | 16 +++++++++++++
 5 files changed, 108 insertions(+)

diff --git a/helm/impala/README.md b/helm/impala/README.md
index 0a0180ddb..31a5b3647 100644
--- a/helm/impala/README.md
+++ b/helm/impala/README.md
@@ -153,6 +153,26 @@ For custom bind patterns, use `--set-string auth.ldap.bindPattern='cn=#UID\,dc=e
 When using `--set` for LDAP bind patterns, escape commas (`\,`) so Helm does
 not split the value into multiple assignments.
 
+### Enable OAuth token authentication
+
+```bash
+helm upgrade impala ./helm/impala -n impala \
+  -f ./helm/impala/values-example.yaml \
+  --set auth.oauth.enabled=true \
+  --set auth.oauth.jwksUrl="https://idp.example.org/.well-known/jwks.json" \
+  --set auth.oauth.jwtCustomClaimUsername="sub"
+```
+
+For non-TLS development environments only:
+
+```bash
+helm upgrade impala ./helm/impala -n impala \
+  -f ./helm/impala/values-example.yaml \
+  --set auth.oauth.enabled=true \
+  --set auth.oauth.jwtValidateSignature=false \
+  --set auth.oauth.allowWithoutTls=true
+```
+
 ## Run Impala shell from laptop (tunnel)
 
 Port-forward HS2:
@@ -263,6 +283,20 @@ kubectl patch impalacluster impala-demo -n impala --type merge -p '{
 For `ImpalaCluster.spec.ldapBindPattern`, provide raw DN syntax (no comma escaping).
 The operator handles Helm `--set-string` escaping internally.
 
+Enable OAuth via advanced `spec.set` overrides:
+
+```bash
+kubectl patch impalacluster impala-demo -n impala --type merge -p '{
+  "spec": {
+    "set": {
+      "auth.oauth.enabled": "true",
+      "auth.oauth.jwksUrl": "https://idp.example.org/.well-known/jwks.json",
+      "auth.oauth.jwtCustomClaimUsername": "sub"
+    }
+  }
+}'
+```
+
 ## Troubleshooting
 
 If HMS fails creating directories on the storage volume, set HMS pod user/group:
diff --git a/helm/impala/templates/impalad-deployment.yaml b/helm/impala/templates/impalad-deployment.yaml
index 12d440544..ccc06be23 100644
--- a/helm/impala/templates/impalad-deployment.yaml
+++ b/helm/impala/templates/impalad-deployment.yaml
@@ -70,6 +70,30 @@ spec:
             - -ldap_passwords_in_clear_ok
 {{- end }}
 {{- end }}
+{{- if .Values.auth.oauth.enabled }}
+            - -oauth_token_auth=true
+            - -oauth_jwt_custom_claim_username={{ .Values.auth.oauth.jwtCustomClaimUsername }}
+{{- if .Values.auth.oauth.allowWithoutTls }}
+            - -oauth_allow_without_tls=true
+{{- end }}
+{{- if .Values.auth.oauth.jwtValidateSignature }}
+            - -oauth_jwt_validate_signature=true
+{{- if .Values.auth.oauth.jwksFilePath }}
+            - -oauth_jwks_file_path={{ .Values.auth.oauth.jwksFilePath }}
+{{- end }}
+{{- if .Values.auth.oauth.jwksUrl }}
+            - -oauth_jwks_url={{ .Values.auth.oauth.jwksUrl }}
+            - -oauth_jwks_verify_server_certificate={{ .Values.auth.oauth.jwksVerifyServerCertificate }}
+            - -oauth_jwks_update_frequency_s={{ .Values.auth.oauth.jwksUpdateFrequencyS }}
+            - -oauth_jwks_pulling_timeout_s={{ .Values.auth.oauth.jwksPullingTimeoutS }}
+{{- if .Values.auth.oauth.jwksCaCertificate }}
+            - -oauth_jwks_ca_certificate={{ .Values.auth.oauth.jwksCaCertificate }}
+{{- end }}
+{{- end }}
+{{- else }}
+            - -oauth_jwt_validate_signature=false
+{{- end }}
+{{- end }}
 {{- if .Values.auth.ranger.enabled }}
             - -authorization_provider=ranger
             - -ranger_service_type={{ .Values.auth.ranger.serviceType }}
diff --git a/helm/impala/templates/oauth-validation.yaml b/helm/impala/templates/oauth-validation.yaml
new file mode 100644
index 000000000..98699a9cd
--- /dev/null
+++ b/helm/impala/templates/oauth-validation.yaml
@@ -0,0 +1,29 @@
+{{/*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+*/}}
+
+{{- if and .Values.auth.oauth.enabled .Values.auth.oauth.jwtValidateSignature -}}
+{{- $hasJwksFile := ne (.Values.auth.oauth.jwksFilePath | default "") "" -}}
+{{- $hasJwksUrl := ne (.Values.auth.oauth.jwksUrl | default "") "" -}}
+{{- if and $hasJwksFile $hasJwksUrl -}}
+{{- fail "Set exactly one of auth.oauth.jwksFilePath or auth.oauth.jwksUrl when auth.oauth.jwtValidateSignature=true" -}}
+{{- end -}}
+{{- if and (not $hasJwksFile) (not $hasJwksUrl) -}}
+{{- fail "Set exactly one of auth.oauth.jwksFilePath or auth.oauth.jwksUrl when auth.oauth.jwtValidateSignature=true" -}}
+{{- end -}}
+{{- end -}}
diff --git a/helm/impala/values-example.yaml b/helm/impala/values-example.yaml
index 56fd7f06a..1010c04a1 100644
--- a/helm/impala/values-example.yaml
+++ b/helm/impala/values-example.yaml
@@ -45,3 +45,8 @@ auth:
     enabled: false
   ranger:
     enabled: false
+  oauth:
+    enabled: false
+    # Example OAuth settings:
+    # jwksUrl: "https://idp.example.org/.well-known/jwks.json"
+    # jwtCustomClaimUsername: "sub"
diff --git a/helm/impala/values.yaml b/helm/impala/values.yaml
index 99c7faa0e..a0cec5967 100644
--- a/helm/impala/values.yaml
+++ b/helm/impala/values.yaml
@@ -67,6 +67,22 @@ auth:
     uri: ""
     bindPattern: ""
     passwordsInClearOk: false
+  oauth:
+    enabled: false
+    # Validate OAuth token signatures using JWKS data.
+    jwtValidateSignature: true
+    # Exactly one of jwksFilePath or jwksUrl should be set when signature
+    # validation is enabled.
+    jwksFilePath: ""
+    jwksUrl: ""
+    jwksVerifyServerCertificate: true
+    jwksCaCertificate: ""
+    jwksUpdateFrequencyS: 60
+    jwksPullingTimeoutS: 10
+    # Token claim used as the authenticated username.
+    jwtCustomClaimUsername: "username"
+    # For development only. Keep false in production.
+    allowWithoutTls: false
   ranger:
     enabled: false
     serviceType: "hive"