Skip to content

Commit 88ed5d7

Browse files
morazowmorazow
committed
[helm] Enable SASL authentication configurations
1 parent ec43289 commit 88ed5d7

File tree

6 files changed

+186
-4
lines changed

6 files changed

+186
-4
lines changed

‎helm/templates/_helpers.tpl‎

Lines changed: 51 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,4 +63,54 @@ Selector labels
6363
{{- define "fluss.selectorLabels" -}}
6464
app.kubernetes.io/name: {{ include "fluss.name" . }}
6565
app.kubernetes.io/instance: {{ .Release.Name }}
66-
{{- end }}
66+
{{- end }}
67+
68+
{{/*
69+
Generate JAAS configuration for SASL
70+
*/}}
71+
{{- define "fluss.sasl.jaasConfig" -}}
72+
{{- if .Values.sasl.jaasConfig }}
73+
{{- .Values.sasl.jaasConfig -}}
74+
{{- else }}
75+
FlussServer {
76+
org.apache.fluss.security.auth.sasl.plain.PlainLoginModule required
77+
{{- range .Values.sasl.users }}
78+
user_{{ .username }}="{{ .password }}"
79+
{{- end }};
80+
};
81+
{{- end }}
82+
{{- end }}
83+
84+
{{/*
85+
Return true if SASL is configured in any of the listener protocols
86+
*/}}
87+
{{- define "fluss.isSaslEnabled" -}}
88+
{{- $ctx := . -}}
89+
{{- $res := "" -}}
90+
{{- $keys := keys .Values.listeners | sortAlpha -}}
91+
{{- range $keys }}
92+
{{- $id := . -}}
93+
{{- $l := index $ctx.Values.listeners $id -}}
94+
{{- if regexFind "SASL" (upper $l.protocol) -}}
95+
{{- $res = "true" -}}
96+
{{- end -}}
97+
{{- end -}}
98+
{{- if $res -}}
99+
{{- true -}}
100+
{{- end -}}
101+
{{- end -}}
102+
103+
{{/*
104+
Generate ID:SECURITY list for listener protocols
105+
*/}}
106+
{{- define "fluss.listeners.protocolMap" -}}
107+
{{- $ctx := . -}}
108+
{{- $parts := list -}}
109+
{{- $keys := keys .Values.listeners | sortAlpha -}}
110+
{{- range $keys }}
111+
{{- $id := . -}}
112+
{{- $l := index $ctx.Values.listeners $id -}}
113+
{{- $parts = append $parts (printf "%s:%s" (upper $id) (upper $l.protocol)) -}}
114+
{{- end -}}
115+
{{- join "," $parts -}}
116+
{{- end }}

‎helm/templates/secret-sasl.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing, software
13+
# distributed under the License is distributed on an "AS IS" BASIS,
14+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
# See the License for the specific language governing permissions and
16+
# limitations under the License.
17+
#
18+
19+
{{- if (include "fluss.isSaslEnabled" .) }}
20+
{{- if not .Values.sasl.existingSecret -}}
21+
apiVersion: v1
22+
kind: Secret
23+
metadata:
24+
name: {{ include "fluss.fullname" . }}-sasl-jaas-config
25+
labels:
26+
{{- include "fluss.labels" . | nindent 4 }}
27+
type: Opaque
28+
data:
29+
jaas.conf: {{ include "fluss.sasl.jaasConfig" . | b64enc | quote }}
30+
{{- end -}}
31+
{{- end -}}

‎helm/templates/sts-coordinator.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,21 @@ spec:
7777
echo "" >> $FLUSS_HOME/conf/server.yaml && \
7878
echo "bind.listeners: ${BIND_LISTENERS}" >> $FLUSS_HOME/conf/server.yaml && \
7979
echo "advertised.listeners: ${ADVERTISED_LISTENERS}" >> $FLUSS_HOME/conf/server.yaml && \
80+
echo "security.protocol.map: {{ include "fluss.listeners.protocolMap" . }}" >> $FLUSS_HOME/conf/server.yaml && \
81+
82+
{{- if (include "fluss.isSaslEnabled" .) }}
83+
{{- $jaasUsers := list -}}
84+
{{- range .Values.sasl.users }}
85+
{{- $jaasUsers = append $jaasUsers (printf "user_%s=\\\"%s\\\"" .username .password) -}}
86+
{{- end }}
87+
echo "security.sasl.enabled.mechanisms: {{ .Values.sasl.mechanism }}" >> $FLUSS_HOME/conf/server.yaml && \
88+
echo "security.sasl.plain.jaas.config: org.apache.fluss.security.auth.sasl.plain.PlainLoginModule required {{ join " " $jaasUsers }};" >> $FLUSS_HOME/conf/server.yaml && \
89+
90+
echo "client.security.protocol: SASL" >> $FLUSS_HOME/conf/server.yaml && \
91+
echo "client.security.sasl.mechanism: {{ .Values.sasl.mechanism }}" >> $FLUSS_HOME/conf/server.yaml && \
92+
echo "client.security.sasl.username: {{ (first .Values.sasl.users).username }}" >> $FLUSS_HOME/conf/server.yaml && \
93+
echo "client.security.sasl.password: {{ (first .Values.sasl.users).password }}" >> $FLUSS_HOME/conf/server.yaml && \
94+
{{- end }}
8095
8196
bin/coordinator-server.sh start-foreground
8297
livenessProbe:
@@ -100,6 +115,11 @@ spec:
100115
mountPath: /opt/conf
101116
- name: data
102117
mountPath: /tmp/fluss/data
118+
{{- if (include "fluss.isSaslEnabled" .) }}
119+
- name: sasl-config
120+
mountPath: /etc/fluss/conf
121+
readOnly: true
122+
{{- end }}
103123
volumes:
104124
- name: fluss-conf
105125
configMap:
@@ -108,6 +128,11 @@ spec:
108128
- name: data
109129
emptyDir: {}
110130
{{- end }}
131+
{{- if (include "fluss.isSaslEnabled" .) }}
132+
- name: sasl-config
133+
secret:
134+
secretName: {{ if .Values.sasl.existingSecret }}{{ .Values.sasl.existingSecret }}{{ else }}{{ include "fluss.fullname" . }}-sasl-jaas-config{{ end }}
135+
{{- end }}
111136
{{- if .Values.coordinator.storage.enabled }}
112137
volumeClaimTemplates:
113138
- metadata:

‎helm/templates/sts-tablet.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,21 @@ spec:
7474
echo "tablet-server.id: ${FLUSS_SERVER_ID}" >> $FLUSS_HOME/conf/server.yaml && \
7575
echo "bind.listeners: ${BIND_LISTENERS}" >> $FLUSS_HOME/conf/server.yaml && \
7676
echo "advertised.listeners: ${ADVERTISED_LISTENERS}" >> $FLUSS_HOME/conf/server.yaml && \
77+
echo "security.protocol.map: {{ include "fluss.listeners.protocolMap" . }}" >> $FLUSS_HOME/conf/server.yaml && \
78+
79+
{{- if (include "fluss.isSaslEnabled" .) }}
80+
{{- $jaasUsers := list -}}
81+
{{- range .Values.sasl.users }}
82+
{{- $jaasUsers = append $jaasUsers (printf "user_%s=\\\"%s\\\"" .username .password) -}}
83+
{{- end }}
84+
echo "security.sasl.enabled.mechanisms: {{ .Values.sasl.mechanism }}" >> $FLUSS_HOME/conf/server.yaml && \
85+
echo "security.sasl.plain.jaas.config: org.apache.fluss.security.auth.sasl.plain.PlainLoginModule required {{ join " " $jaasUsers }};" >> $FLUSS_HOME/conf/server.yaml && \
86+
87+
echo "client.security.protocol: SASL" >> $FLUSS_HOME/conf/server.yaml && \
88+
echo "client.security.sasl.mechanism: {{ .Values.sasl.mechanism }}" >> $FLUSS_HOME/conf/server.yaml && \
89+
echo "client.security.sasl.username: {{ (first .Values.sasl.users).username }}" >> $FLUSS_HOME/conf/server.yaml && \
90+
echo "client.security.sasl.password: {{ (first .Values.sasl.users).password }}" >> $FLUSS_HOME/conf/server.yaml && \
91+
{{- end }}
7792
7893
bin/tablet-server.sh start-foreground
7994
livenessProbe:
@@ -97,6 +112,11 @@ spec:
97112
mountPath: /opt/conf
98113
- name: data
99114
mountPath: /tmp/fluss/data
115+
{{- if (include "fluss.isSaslEnabled" .) }}
116+
- name: sasl-config
117+
mountPath: /etc/fluss/conf
118+
readOnly: true
119+
{{- end }}
100120
volumes:
101121
- name: fluss-conf
102122
configMap:
@@ -105,6 +125,11 @@ spec:
105125
- name: data
106126
emptyDir: {}
107127
{{- end }}
128+
{{- if (include "fluss.isSaslEnabled" .) }}
129+
- name: sasl-config
130+
secret:
131+
secretName: {{ if .Values.sasl.existingSecret }}{{ .Values.sasl.existingSecret }}{{ else }}{{ include "fluss.fullname" . }}-sasl-jaas-config{{ end }}
132+
{{- end }}
108133
{{- if .Values.tablet.storage.enabled }}
109134
volumeClaimTemplates:
110135
- metadata:

‎helm/values.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,10 @@ coordinator:
5454
# Fluss listener configurations
5555
listeners:
5656
internal:
57+
protocol: PLAINTEXT
5758
port: 9123
5859
client:
60+
protocol: PLAINTEXT
5961
port: 9124
6062

6163
resources: {}
@@ -85,3 +87,14 @@ serviceAccount:
8587
# Additional annotations to apply to the ServiceAccount.
8688
# These can be useful, for example, to support integrations like workload identity.
8789
annotations: {}
90+
91+
## Fluss SASL configurations for authentication.
92+
## These are required if SASL listeners are configured.
93+
sasl:
94+
mechanism: PLAIN
95+
# List of client users for authentication
96+
users:
97+
- username: admin
98+
password: password
99+
# If specified, the existing secret must contain a key `jaas.conf` with the JAAS configuration
100+
existingSecret: ""

‎website/docs/install-deploy/deploying-with-helm.md‎

Lines changed: 41 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ the installation documentation provides instructions for deploying one using Bit
3636

3737
### Running Fluss locally with Minikube
3838

39-
For local testing and development, you can deploy Fluss on Minikube. This is ideal for development, testing, and learning purposes.
39+
For local testing and development, you can deploy Fluss on Minikube. This is ideal for development, testing and learning purposes.
4040

4141
#### Prerequisites
4242

@@ -157,7 +157,7 @@ kubectl logs -l app.kubernetes.io/component=tablet
157157

158158
## Configuration Parameters
159159

160-
The following table lists the configurable parameters of the Fluss chart and their default values.
160+
The following table lists the configurable parameters of the Fluss chart, and their default values.
161161

162162
### Global Parameters
163163

@@ -225,6 +225,13 @@ The following table lists the configurable parameters of the Fluss chart and the
225225
| `resources.tabletServer.limits.cpu` | CPU limits for tablet servers | Not set |
226226
| `resources.tabletServer.limits.memory` | Memory limits for tablet servers | Not set |
227227

228+
### SASL Parameters
229+
230+
| Parameter | Description | Default |
231+
|-----------|-------------|---------|
232+
| `sasl.mechanism` | SASL mechanism | `PLAIN` |
233+
| `sasl.users` | User list for PLAIN authentication | `[{username: admin, password: password}]` |
234+
| `sasl.existingSecret` | Use existing secret containing `jaas.conf` | `""` |
228235

229236
## Advanced Configuration
230237

@@ -245,16 +252,47 @@ The chart automatically configures listeners for internal cluster communication
245252
- **Internal Port (9123)**: Used for internal communication within the cluster
246253
- **Client Port (9124)**: Used for client connections
247254
248-
Custom listener configuration:
255+
Default listeners configuration:
249256
250257
```yaml
251258
listeners:
252259
internal:
260+
protocol: PLAINTEXT
253261
port: 9123
254262
client:
263+
protocol: PLAINTEXT
255264
port: 9124
256265
```
257266
267+
To enable SASL based authentication, set any of the protocols to `SASL`.
268+
269+
### Enabling Secure Connection
270+
271+
With the helm deployment, you can specify authentication protocols when connecting to the Fluss cluster.
272+
273+
The following table shows the supported protocols and security they provide:
274+
275+
| Method | Authentication | TLS Encryption |
276+
|-------------|:--------------:|:------------------:|
277+
| `PLAINTEXT` | No | No |
278+
| `SASL` | Yes | No |
279+
280+
By default, the `PLAINTEXT` protocol is used.
281+
282+
The SASL authentication will be enabled if any of the listener protocols is using `SASL`.
283+
284+
Set these values for additional configurations:
285+
286+
```yaml
287+
sasl:
288+
mechanism: PLAIN
289+
users:
290+
- username: admin
291+
password: password
292+
```
293+
294+
The `users` defines comma-separated list of usernames and passwords for client communications when SASL is enabled.
295+
258296
### Storage Configuration
259297

260298
Configure different storage volumes for coordinator or tablet pods:

0 commit comments

Comments
 (0)