You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@fluss.apache.org by "fresh-borzoni (via GitHub)" <gi...@apache.org> on 2026/04/23 05:46:14 UTC
[PR] [helm] Add existingSecret support for SASL credentials [fluss]
fresh-borzoni opened a new pull request, #3171:
URL: https://github.com/apache/fluss/pull/3171
(no comment)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [helm] Add existingSecret support for SASL credentials [fluss]
Posted by "fresh-borzoni (via GitHub)" <gi...@apache.org>.
fresh-borzoni commented on PR #3171:
URL: https://github.com/apache/fluss/pull/3171#issuecomment-4302023492
@affo @morazow @polyzos PTAL 🙏
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [helm] Add existingSecret support for SASL credentials [fluss]
Posted by "polyzos (via GitHub)" <gi...@apache.org>.
polyzos merged PR #3171:
URL: https://github.com/apache/fluss/pull/3171
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [helm] Add existingSecret support for SASL credentials [fluss]
Posted by "affo (via GitHub)" <gi...@apache.org>.
affo commented on code in PR #3171:
URL: https://github.com/apache/fluss/pull/3171#discussion_r3130418956
##########
website/docs/install-deploy/deploying-with-helm.md:
##########
@@ -210,6 +211,135 @@ It is recommended to set these explicitly in production.
| `security.zookeeper.sasl.plain.username` | ZooKeeper SASL username | `""` |
| `security.zookeeper.sasl.plain.password` | ZooKeeper SASL password | `""` |
| `security.zookeeper.sasl.plain.loginModuleClass` | JAAS login module class for ZooKeeper | `org.apache.fluss.shaded.zookeeper3.org.apache.zookeeper.server.auth.DigestLoginModule` |
+| `security.zookeeper.sasl.plain.existingSecret` | Reference to a pre-existing Secret for ZooKeeper SASL credentials | `{}` |
+
+#### Sourcing SASL Credentials from a Pre-existing Secret
+
+To keep SASL passwords out of `values.yaml` and the Helm release storage, reference a Secret managed separately — e.g., via External Secrets Operator, Sealed Secrets, or a CI pipeline.
+
+For internal and ZooKeeper listeners, set `existingSecret` on the listener:
+
+```yaml
+security:
+ internal:
+ sasl:
+ mechanism: plain
+ plain:
+ existingSecret:
+ name: fluss-internal-sasl # required
+ usernameKey: username # optional, defaults to "username"
+ passwordKey: password # optional, defaults to "password"
+ zookeeper:
+ sasl:
+ mechanism: plain
+ plain:
+ existingSecret:
+ name: fluss-zk-sasl
+```
+
+For client listener users, each user entry can carry either a literal `password` or a `passwordSecretRef` pointing at a specific Secret key:
+
+```yaml
+security:
+ client:
+ sasl:
+ mechanism: plain
+ plain:
+ users:
+ - username: alice
+ password: alice-literal-password # literal — visible in values.yaml
+ - username: bob
+ passwordSecretRef: # or resolved at pod startup
+ name: fluss-client-sasl
+ key: bob-password
Review Comment:
Question: why a separate pattern for this case?
Wouldn't it be more coherent to stick with the `internal` case for consistency?
E.g.:
```yaml
security:
client:
sasl:
mechanism: plain
plain:
users:
- username: alice
password: alice-literal-password # literal — visible in values.yaml
- existingSecret:
name: fluss-client-sasl-bob # required
usernameKey: username # optional, defaults to "username"
passwordKey: password # optional, defaults to "password"
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [helm] Add existingSecret support for SASL credentials [fluss]
Posted by "affo (via GitHub)" <gi...@apache.org>.
affo commented on code in PR #3171:
URL: https://github.com/apache/fluss/pull/3171#discussion_r3130623023
##########
website/docs/install-deploy/deploying-with-helm.md:
##########
@@ -210,6 +211,135 @@ It is recommended to set these explicitly in production.
| `security.zookeeper.sasl.plain.username` | ZooKeeper SASL username | `""` |
| `security.zookeeper.sasl.plain.password` | ZooKeeper SASL password | `""` |
| `security.zookeeper.sasl.plain.loginModuleClass` | JAAS login module class for ZooKeeper | `org.apache.fluss.shaded.zookeeper3.org.apache.zookeeper.server.auth.DigestLoginModule` |
+| `security.zookeeper.sasl.plain.existingSecret` | Reference to a pre-existing Secret for ZooKeeper SASL credentials | `{}` |
+
+#### Sourcing SASL Credentials from a Pre-existing Secret
+
+To keep SASL passwords out of `values.yaml` and the Helm release storage, reference a Secret managed separately — e.g., via External Secrets Operator, Sealed Secrets, or a CI pipeline.
+
+For internal and ZooKeeper listeners, set `existingSecret` on the listener:
+
+```yaml
+security:
+ internal:
+ sasl:
+ mechanism: plain
+ plain:
+ existingSecret:
+ name: fluss-internal-sasl # required
+ usernameKey: username # optional, defaults to "username"
+ passwordKey: password # optional, defaults to "password"
+ zookeeper:
+ sasl:
+ mechanism: plain
+ plain:
+ existingSecret:
+ name: fluss-zk-sasl
+```
+
+For client listener users, each user entry can carry either a literal `password` or a `passwordSecretRef` pointing at a specific Secret key:
+
+```yaml
+security:
+ client:
+ sasl:
+ mechanism: plain
+ plain:
+ users:
+ - username: alice
+ password: alice-literal-password # literal — visible in values.yaml
+ - username: bob
+ passwordSecretRef: # or resolved at pod startup
+ name: fluss-client-sasl
+ key: bob-password
Review Comment:
resolved
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [helm] Add existingSecret support for SASL credentials [fluss]
Posted by "fresh-borzoni (via GitHub)" <gi...@apache.org>.
fresh-borzoni commented on PR #3171:
URL: https://github.com/apache/fluss/pull/3171#issuecomment-4303927446
@affo Thank for very good suggestion, I really liked the idea with envsubst.
Redesigned the approach and removed existing duplication, PTAL 🙏
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [helm] Add existingSecret support for SASL credentials [fluss]
Posted by "affo (via GitHub)" <gi...@apache.org>.
affo commented on code in PR #3171:
URL: https://github.com/apache/fluss/pull/3171#discussion_r3130396802
##########
helm/templates/_jaas.tpl:
##########
@@ -0,0 +1,136 @@
+{{/*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{/*
+Renders the env entries for the JAAS init container: secretKeyRef for each
+Secret-sourced credential, literal `value:` for each values-sourced one.
+Usage:
+ include "fluss.security.jaas.initContainer.env" .
+*/}}
+{{- define "fluss.security.jaas.initContainer.env" -}}
+{{- $internalMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "internal") -}}
+{{- $clientMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "client") -}}
+{{- $zkEnabled := include "fluss.security.zookeeper.sasl.enabled" . -}}
+{{- /* internal */ -}}
+{{- if and (include "fluss.security.sasl.plain.enabled" .) (eq $internalMechanism "plain") }}
+- name: {{ include "fluss.security.sasl.plain.internal.envVarName" "username" }}
+{{- $ref := .Values.security.internal.sasl.plain.existingSecret | default (dict) }}
+{{- if $ref.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $ref.name }}
+ key: {{ $ref.usernameKey | default "username" }}
+{{- else }}
+ value: {{ include "fluss.security.sasl.plain.internal.username" . | quote }}
+{{- end }}
+- name: {{ include "fluss.security.sasl.plain.internal.envVarName" "password" }}
+{{- if $ref.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $ref.name }}
+ key: {{ $ref.passwordKey | default "password" }}
+{{- else }}
+ value: {{ include "fluss.security.sasl.plain.internal.password" . | quote }}
+{{- end }}
+{{- end }}
+{{- /* client */ -}}
+{{- if and (include "fluss.security.sasl.plain.enabled" .) (eq $clientMechanism "plain") }}
+{{- range $idx, $user := .Values.security.client.sasl.plain.users | default (list) }}
+- name: {{ include "fluss.security.sasl.plain.client.envVarName" $idx }}
+{{- $userRef := $user.passwordSecretRef | default (dict) }}
+{{- if and $userRef.name $userRef.key }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $userRef.name }}
+ key: {{ $userRef.key }}
+{{- else }}
+ value: {{ $user.password | quote }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- /* zookeeper */ -}}
+{{- if $zkEnabled }}
+- name: {{ include "fluss.security.sasl.plain.zookeeper.envVarName" "username" }}
+{{- $zkRef := .Values.security.zookeeper.sasl.plain.existingSecret | default (dict) }}
+{{- if $zkRef.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $zkRef.name }}
+ key: {{ $zkRef.usernameKey | default "username" }}
+{{- else }}
+ value: {{ .Values.security.zookeeper.sasl.plain.username | quote }}
+{{- end }}
+- name: {{ include "fluss.security.sasl.plain.zookeeper.envVarName" "password" }}
+{{- if $zkRef.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $zkRef.name }}
+ key: {{ $zkRef.passwordKey | default "password" }}
+{{- else }}
+ value: {{ .Values.security.zookeeper.sasl.plain.password | quote }}
+{{- end }}
+{{- end }}
+{{- end -}}
+
+{{/*
+Init container spec: mounts the rendered JAAS template ConfigMap at /tmpl,
+resolves credential placeholders via envsubst, writes the result to the
+shared emptyDir at /jaas, and chmods it 0400.
+Usage:
+ include "fluss.security.jaas.initContainer" .
+*/}}
+{{- define "fluss.security.jaas.initContainer" -}}
+- name: render-jaas-config
+ image: {{ include "fluss.image" . }}
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ env:
+ {{- include "fluss.security.jaas.initContainer.env" . | nindent 4 }}
+ command:
+ - /bin/sh
+ - -ec
+ - |
+ umask 077
+ envsubst < /tmpl/jaas.conf > /jaas/jaas.conf
Review Comment:
❤️
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [helm] Add existingSecret support for SASL credentials [fluss]
Posted by "affo (via GitHub)" <gi...@apache.org>.
affo commented on code in PR #3171:
URL: https://github.com/apache/fluss/pull/3171#discussion_r3129584226
##########
helm/templates/_jaas.tpl:
##########
@@ -0,0 +1,190 @@
+{{/*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{/*
+Renders the env entries for the JAAS init container: secretKeyRef per
+Secret-sourced credential, literal value per values-sourced credential.
+Usage:
+ include "fluss.security.jaas.initContainer.env" .
+*/}}
+{{- define "fluss.security.jaas.initContainer.env" -}}
+{{- $internalMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "internal") -}}
+{{- $clientMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "client") -}}
+{{- $zkEnabled := include "fluss.security.zookeeper.sasl.enabled" . -}}
+{{- if and (include "fluss.security.sasl.plain.enabled" .) (eq $internalMechanism "plain") }}
Review Comment:
nit: split this block with comment: "internal" for readability
##########
helm/templates/_jaas.tpl:
##########
@@ -0,0 +1,190 @@
+{{/*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{/*
+Renders the env entries for the JAAS init container: secretKeyRef per
+Secret-sourced credential, literal value per values-sourced credential.
+Usage:
+ include "fluss.security.jaas.initContainer.env" .
+*/}}
+{{- define "fluss.security.jaas.initContainer.env" -}}
+{{- $internalMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "internal") -}}
+{{- $clientMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "client") -}}
+{{- $zkEnabled := include "fluss.security.zookeeper.sasl.enabled" . -}}
+{{- if and (include "fluss.security.sasl.plain.enabled" .) (eq $internalMechanism "plain") }}
+- name: {{ include "fluss.security.sasl.plain.internal.envVarName" "username" }}
+{{- $ref := .Values.security.internal.sasl.plain.existingSecret | default (dict) }}
+{{- if $ref.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $ref.name }}
+ key: {{ $ref.usernameKey | default "username" }}
+{{- else }}
+ value: {{ include "fluss.security.sasl.plain.internal.username" . | quote }}
+{{- end }}
+- name: {{ include "fluss.security.sasl.plain.internal.envVarName" "password" }}
+{{- if $ref.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $ref.name }}
+ key: {{ $ref.passwordKey | default "password" }}
+{{- else }}
+ value: {{ include "fluss.security.sasl.plain.internal.password" . | quote }}
+{{- end }}
+{{- end }}
+{{- if and (include "fluss.security.sasl.plain.enabled" .) (eq $clientMechanism "plain") }}
Review Comment:
nit: split this block with comment: "client" for readability
##########
helm/templates/_jaas.tpl:
##########
@@ -0,0 +1,190 @@
+{{/*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{/*
+Renders the env entries for the JAAS init container: secretKeyRef per
+Secret-sourced credential, literal value per values-sourced credential.
+Usage:
+ include "fluss.security.jaas.initContainer.env" .
+*/}}
+{{- define "fluss.security.jaas.initContainer.env" -}}
+{{- $internalMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "internal") -}}
+{{- $clientMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "client") -}}
+{{- $zkEnabled := include "fluss.security.zookeeper.sasl.enabled" . -}}
+{{- if and (include "fluss.security.sasl.plain.enabled" .) (eq $internalMechanism "plain") }}
+- name: {{ include "fluss.security.sasl.plain.internal.envVarName" "username" }}
+{{- $ref := .Values.security.internal.sasl.plain.existingSecret | default (dict) }}
+{{- if $ref.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $ref.name }}
+ key: {{ $ref.usernameKey | default "username" }}
+{{- else }}
+ value: {{ include "fluss.security.sasl.plain.internal.username" . | quote }}
+{{- end }}
+- name: {{ include "fluss.security.sasl.plain.internal.envVarName" "password" }}
+{{- if $ref.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $ref.name }}
+ key: {{ $ref.passwordKey | default "password" }}
+{{- else }}
+ value: {{ include "fluss.security.sasl.plain.internal.password" . | quote }}
+{{- end }}
+{{- end }}
+{{- if and (include "fluss.security.sasl.plain.enabled" .) (eq $clientMechanism "plain") }}
+{{- range $idx, $user := .Values.security.client.sasl.plain.users | default (list) }}
+- name: {{ include "fluss.security.sasl.plain.client.envVarName" $idx }}
+{{- $userRef := $user.passwordSecretRef | default (dict) }}
+{{- if and $userRef.name $userRef.key }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $userRef.name }}
+ key: {{ $userRef.key }}
+{{- else }}
+ value: {{ $user.password | quote }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if $zkEnabled }}
+- name: {{ include "fluss.security.sasl.plain.zookeeper.envVarName" "username" }}
+{{- $zkRef := .Values.security.zookeeper.sasl.plain.existingSecret | default (dict) }}
+{{- if $zkRef.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $zkRef.name }}
+ key: {{ $zkRef.usernameKey | default "username" }}
+{{- else }}
+ value: {{ .Values.security.zookeeper.sasl.plain.username | quote }}
+{{- end }}
+- name: {{ include "fluss.security.sasl.plain.zookeeper.envVarName" "password" }}
+{{- if $zkRef.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $zkRef.name }}
+ key: {{ $zkRef.passwordKey | default "password" }}
+{{- else }}
+ value: {{ .Values.security.zookeeper.sasl.plain.password | quote }}
+{{- end }}
+{{- end }}
+{{- end -}}
+
+{{/*
+Shell script rendering /etc/fluss/conf/jaas.conf from env vars. printf %s is
+used for credentials so shell metacharacters in passwords pass through as-is.
+Usage:
+ include "fluss.security.jaas.initContainer.script" .
+*/}}
+{{- define "fluss.security.jaas.initContainer.script" -}}
+{{- $internalMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "internal") -}}
+{{- $clientMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "client") -}}
+{{- $zkEnabled := include "fluss.security.zookeeper.sasl.enabled" . -}}
+set -eu
+umask 077
+out=/jaas/jaas.conf
+rm -f "$out"
+{
+{{- if and (include "fluss.security.sasl.plain.enabled" .) (eq $internalMechanism "plain") }}
+ echo 'internal.FlussServer {'
+ echo ' org.apache.fluss.security.auth.sasl.plain.PlainLoginModule required'
+ printf ' user_%s="%s";\n' "${{ "{" }}{{ include "fluss.security.sasl.plain.internal.envVarName" "username" }}{{ "}" }}" "${{ "{" }}{{ include "fluss.security.sasl.plain.internal.envVarName" "password" }}{{ "}" }}"
+ echo '};'
+ echo 'FlussClient {'
+ echo ' org.apache.fluss.security.auth.sasl.plain.PlainLoginModule required'
+ printf ' username="%s"\n' "${{ "{" }}{{ include "fluss.security.sasl.plain.internal.envVarName" "username" }}{{ "}" }}"
+ printf ' password="%s";\n' "${{ "{" }}{{ include "fluss.security.sasl.plain.internal.envVarName" "password" }}{{ "}" }}"
+ echo '};'
+{{- end }}
+{{- if and (include "fluss.security.sasl.plain.enabled" .) (eq $clientMechanism "plain") }}
+ echo 'client.FlussServer {'
+ echo ' org.apache.fluss.security.auth.sasl.plain.PlainLoginModule required'
+{{- $users := .Values.security.client.sasl.plain.users | default (list) -}}
+{{- $last := sub (len $users) 1 }}
+{{- range $idx, $user := $users }}
+{{- $terminator := ternary ";" "" (eq $idx $last) }}
+ printf ' user_{{ $user.username }}="%s"{{ $terminator }}\n' "${{ "{" }}{{ include "fluss.security.sasl.plain.client.envVarName" $idx }}{{ "}" }}"
+{{- end }}
+ echo '};'
+{{- end }}
+{{- if $zkEnabled }}
+ echo 'ZookeeperClient {'
+ echo ' {{ .Values.security.zookeeper.sasl.plain.loginModuleClass }} required'
+ printf ' username="%s"\n' "${{ "{" }}{{ include "fluss.security.sasl.plain.zookeeper.envVarName" "username" }}{{ "}" }}"
+ printf ' password="%s";\n' "${{ "{" }}{{ include "fluss.security.sasl.plain.zookeeper.envVarName" "password" }}{{ "}" }}"
+ echo '};'
+{{- end }}
+} > "$out"
+{{- if $zkEnabled }}
+{
+ echo 'zookeeper.sasl.clientconfig=ZookeeperClient'
+} > /jaas/zookeeper-client.properties
+{{- end }}
+chmod 0400 "$out"
+{{- if $zkEnabled }}
+chmod 0400 /jaas/zookeeper-client.properties
+{{- end }}
+{{- end -}}
+
+{{/*
+Init container spec that renders jaas.conf at pod startup.
+Usage:
+ include "fluss.security.jaas.initContainer" .
+*/}}
+{{- define "fluss.security.jaas.initContainer" -}}
+{{- $img := .Values.security.jaas.initContainer.image | default (dict) -}}
+- name: render-jaas-config
+ {{- if and $img.repository $img.tag }}
+ image: "{{ $img.repository }}:{{ $img.tag }}"
Review Comment:
Another minor:
I find this a bit weird that we let the user decide this 🤔
As the user does not know what the script does, hence it would be difficult to actually pick an image 🤔
Would it make sense to use `busybox`? I also understand that we can use the Fluss image resulting in 0 overhead given that it is required in any case to run Fluss itself.
Probably just irrelevant.
##########
helm/templates/_jaas.tpl:
##########
@@ -0,0 +1,190 @@
+{{/*
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{/*
+Renders the env entries for the JAAS init container: secretKeyRef per
+Secret-sourced credential, literal value per values-sourced credential.
+Usage:
+ include "fluss.security.jaas.initContainer.env" .
+*/}}
+{{- define "fluss.security.jaas.initContainer.env" -}}
+{{- $internalMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "internal") -}}
+{{- $clientMechanism := include "fluss.security.listener.mechanism" (dict "context" .Values "listener" "client") -}}
+{{- $zkEnabled := include "fluss.security.zookeeper.sasl.enabled" . -}}
+{{- if and (include "fluss.security.sasl.plain.enabled" .) (eq $internalMechanism "plain") }}
+- name: {{ include "fluss.security.sasl.plain.internal.envVarName" "username" }}
+{{- $ref := .Values.security.internal.sasl.plain.existingSecret | default (dict) }}
+{{- if $ref.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $ref.name }}
+ key: {{ $ref.usernameKey | default "username" }}
+{{- else }}
+ value: {{ include "fluss.security.sasl.plain.internal.username" . | quote }}
+{{- end }}
+- name: {{ include "fluss.security.sasl.plain.internal.envVarName" "password" }}
+{{- if $ref.name }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $ref.name }}
+ key: {{ $ref.passwordKey | default "password" }}
+{{- else }}
+ value: {{ include "fluss.security.sasl.plain.internal.password" . | quote }}
+{{- end }}
+{{- end }}
+{{- if and (include "fluss.security.sasl.plain.enabled" .) (eq $clientMechanism "plain") }}
+{{- range $idx, $user := .Values.security.client.sasl.plain.users | default (list) }}
+- name: {{ include "fluss.security.sasl.plain.client.envVarName" $idx }}
+{{- $userRef := $user.passwordSecretRef | default (dict) }}
+{{- if and $userRef.name $userRef.key }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ $userRef.name }}
+ key: {{ $userRef.key }}
+{{- else }}
+ value: {{ $user.password | quote }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if $zkEnabled }}
Review Comment:
nit: split this block with comment: "zookeeper" for readability
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [helm] Add existingSecret support for SASL credentials [fluss]
Posted by "fresh-borzoni (via GitHub)" <gi...@apache.org>.
fresh-borzoni commented on code in PR #3171:
URL: https://github.com/apache/fluss/pull/3171#discussion_r3130609510
##########
website/docs/install-deploy/deploying-with-helm.md:
##########
@@ -210,6 +211,135 @@ It is recommended to set these explicitly in production.
| `security.zookeeper.sasl.plain.username` | ZooKeeper SASL username | `""` |
| `security.zookeeper.sasl.plain.password` | ZooKeeper SASL password | `""` |
| `security.zookeeper.sasl.plain.loginModuleClass` | JAAS login module class for ZooKeeper | `org.apache.fluss.shaded.zookeeper3.org.apache.zookeeper.server.auth.DigestLoginModule` |
+| `security.zookeeper.sasl.plain.existingSecret` | Reference to a pre-existing Secret for ZooKeeper SASL credentials | `{}` |
+
+#### Sourcing SASL Credentials from a Pre-existing Secret
+
+To keep SASL passwords out of `values.yaml` and the Helm release storage, reference a Secret managed separately — e.g., via External Secrets Operator, Sealed Secrets, or a CI pipeline.
+
+For internal and ZooKeeper listeners, set `existingSecret` on the listener:
+
+```yaml
+security:
+ internal:
+ sasl:
+ mechanism: plain
+ plain:
+ existingSecret:
+ name: fluss-internal-sasl # required
+ usernameKey: username # optional, defaults to "username"
+ passwordKey: password # optional, defaults to "password"
+ zookeeper:
+ sasl:
+ mechanism: plain
+ plain:
+ existingSecret:
+ name: fluss-zk-sasl
+```
+
+For client listener users, each user entry can carry either a literal `password` or a `passwordSecretRef` pointing at a specific Secret key:
+
+```yaml
+security:
+ client:
+ sasl:
+ mechanism: plain
+ plain:
+ users:
+ - username: alice
+ password: alice-literal-password # literal — visible in values.yaml
+ - username: bob
+ passwordSecretRef: # or resolved at pod startup
+ name: fluss-client-sasl
+ key: bob-password
Review Comment:
leftover from previous design with always literals for ux, fixing 👍
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org