You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@atlas.apache.org by "ASF subversion and git services (Jira)" <ji...@apache.org> on 2026/10/06 08:46:00 UTC
[jira] [Commented] (ATLAS-5409) Atlas Kafka clients authenticate with OAUTHBEARER using Kubernetes projected service-account tokens
[ https://issues.apache.org/jira/browse/ATLAS-5409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123666#comment-18123666 ]
ASF subversion and git services commented on ATLAS-5409:
--------------------------------------------------------
Commit 18fbc57ee2f4fc45ab791a60c55f0ea5e10accc2 in atlas's branch refs/heads/ATLAS-4796_u from Nixon Rodrigues
[ https://gitbox.apache.org/repos/asf?p=atlas.git;h=18fbc57ee ]
ATLAS-5409: Atlas Kafka clients authenticate with OAUTHBEARER using K… (#762)
* ATLAS-5409: Atlas Kafka clients authenticate with OAUTHBEARER using Kubernetes projected SA tokens
* ATLAS-5409 Rename of Handler Class to AtlasKafkaOAuthHandler
> Atlas Kafka clients authenticate with OAUTHBEARER using Kubernetes projected service-account tokens
> ---------------------------------------------------------------------------------------------------
>
> Key: ATLAS-5409
> URL: https://issues.apache.org/jira/browse/ATLAS-5409
> Project: Atlas
> Issue Type: Improvement
> Components: atlas-core
> Environment: Atlas , ( Kafka + OAUTHBEARER)
> Reporter: Nixon Rodrigues
> Assignee: Nixon Rodrigues
> Priority: Major
> Time Spent: 40m
> Remaining Estimate: 0h
>
> Atlas REST notification and hook consumers fail to publish to Kafka when the cluster uses SASL/OAUTHBEARER with Kubernetes projected service-account tokens ({{{}file:///var/run/secrets/kafka/kafka.<audience-id>{}}}).
> Symptoms:
> * HTTP 500 on {{POST .../v2/notification/topic/ATLAS_HOOK}} (often with no useful error body)
> * Spark–Atlas hook delivery blocked
> * Logs: {{{}scope value must be non-null{}}}, token file access errors, or stale token after SA rotation
> Root causes:
> # Stock {{OAuthBearerLoginCallbackHandler}} rejects K8s SA JWTs (no OAuth {{scope}} claim) and may fail {{File.canRead()}} on projected token files.
> # {{NotificationREST}} only catches {{{}NotificationException{}}}; {{KafkaException}} surfaces as silent HTTP 500.
> # Custom/patched handlers that cache the JWT break SA token refresh when kubelet rotates the file in place and Kafka {{ExpiringCredentialRefreshingLogin}} re-authenticates.
> ----
> h3. Proposed Solution
> h4. 1. {{KubernetesOAuthHandler}} (new)
> * Path: {{notification/src/main/java/org/apache/atlas/security/kafka/KubernetesOAuthHandler.java}}
> * Reads JWT via {{Files.readAllBytes()}} from {{file://}} URL ({{{}sasl.oauthbearer.token.endpoint.url{}}})
> * No OAuth2 scope validation; broker validates JWT (Strimzi/K8s OIDC in production)
> * Does not cache tokens — re-reads file on every OAuth {{handle()}} (login + refresh)
> * Re-parses {{exp}} / {{iat}} / {{sub}} each time for correct Kafka refresh scheduling
> * Retries read/parse during kubelet atomic file replace (5 attempts, 50ms)
> * Unit tests including token rotation ({{{}testHandleReloadsTokenAfterKubernetesRotation{}}})
--
This message was sent by Atlassian Jira
(v8.20.10#820010)