Skip to content

Commit f71e4db

Browse files
sbernauermaltesander
sbernauer
and
maltesander
authored
fix: Actually propagate OPA package name (#881)
* fix: Actually propagate OPA package name * changelog * Update CHANGELOG.md Co-authored-by: Malte Sander <[email protected]> --------- Co-authored-by: Malte Sander <[email protected]>
1 parent f9f187f commit f71e4db

File tree

5 files changed

+50
-45
lines changed

5 files changed

+50
-45
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,10 @@ All notable changes to this project will be documented in this file.
77
### Fixed
88

99
- Also listen on the loopback interface so that k8s port-forwards work ([#870]).
10+
- The operator now utilizes the `.spec.clusterConfig.authorization.opa.package` property instead of hard-coding the package name to `nifi` ([#881]).
1011

1112
[#870]: https://github.com/stackabletech/nifi-operator/pull/870
13+
[#881]: https://github.com/stackabletech/nifi-operator/pull/881
1214

1315
## [25.11.0] - 2025-11-07
1416

‎rust/operator-binary/src/controller.rs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -452,7 +452,7 @@ pub async fn reconcile_nifi(
452452
}
453453

454454
let authorization_config = NifiAuthorizationConfig::from(
455-
&nifi.spec.cluster_config.authorization,
455+
nifi.spec.cluster_config.authorization.as_ref(),
456456
client,
457457
nifi.metadata
458458
.namespace
@@ -716,7 +716,7 @@ async fn build_node_rolegroup_config_map(
716716
nifi: &v1alpha1::NifiCluster,
717717
resolved_product_image: &ResolvedProductImage,
718718
authentication_config: &NifiAuthenticationConfig,
719-
authorization_config: &NifiAuthorizationConfig,
719+
authorization_config: &NifiAuthorizationConfig<'_>,
720720
role: &Role<NifiConfigFragment, NifiNodeRoleConfig, JavaCommonConfig>,
721721
rolegroup: &RoleGroupRef<v1alpha1::NifiCluster>,
722722
rolegroup_config: &HashMap<PropertyNameKind, BTreeMap<String, String>>,
@@ -731,7 +731,7 @@ async fn build_node_rolegroup_config_map(
731731
.context(InvalidNifiAuthenticationConfigSnafu)?;
732732

733733
let authorizers_xml = authorization_config
734-
.get_authorizers_config(authentication_config)
734+
.get_authorizers_config(nifi, authentication_config)
735735
.context(InvalidNifiAuthorizationConfigSnafu)?;
736736

737737
let jvm_sec_props: BTreeMap<String, Option<String>> = rolegroup_config
@@ -845,7 +845,7 @@ async fn build_node_rolegroup_statefulset(
845845
rolegroup_config: &HashMap<PropertyNameKind, BTreeMap<String, String>>,
846846
merged_config: &NifiConfig,
847847
authentication_config: &NifiAuthenticationConfig,
848-
authorization_config: &NifiAuthorizationConfig,
848+
authorization_config: &NifiAuthorizationConfig<'_>,
849849
rolling_update_supported: bool,
850850
replicas: Option<i32>,
851851
service_account_name: &str,

‎rust/operator-binary/src/security/authorization.rs‎

Lines changed: 41 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,14 @@ use indoc::{formatdoc, indoc};
22
use snafu::{OptionExt, ResultExt, Snafu};
33
use stackable_operator::{
44
client::Client,
5+
commons::opa::OpaConfig,
56
crd::authentication::ldap,
67
k8s_openapi::api::core::v1::{ConfigMap, ConfigMapKeySelector, EnvVar, EnvVarSource},
8+
kube::ResourceExt,
79
};
810

911
use super::authentication::NifiAuthenticationConfig;
10-
use crate::crd::NifiAuthorization;
12+
use crate::crd::{NifiAuthorization, v1alpha1};
1113

1214
pub const OPA_TLS_VOLUME_NAME: &str = "opa-tls";
1315
pub const OPA_TLS_MOUNT_PATH: &str = "/stackable/opa_tls";
@@ -27,58 +29,51 @@ pub enum Error {
2729
},
2830
}
2931

30-
pub enum NifiAuthorizationConfig {
32+
pub enum NifiAuthorizationConfig<'a> {
3133
Opa {
32-
configmap_name: String,
34+
config: &'a OpaConfig,
3335
cache_entry_time_to_live_secs: u64,
3436
cache_max_entries: u32,
3537
secret_class: Option<String>,
3638
},
3739
Default,
3840
}
3941

40-
impl NifiAuthorizationConfig {
42+
impl<'a> NifiAuthorizationConfig<'a> {
4143
pub async fn from(
42-
nifi_authorization: &Option<NifiAuthorization>,
44+
nifi_authorization: Option<&'a NifiAuthorization>,
4345
client: &Client,
4446
namespace: &str,
4547
) -> Result<Self, Error> {
46-
let config = match nifi_authorization {
47-
Some(authorization_config) => match authorization_config.opa.clone() {
48-
Some(opa_config) => {
49-
let configmap_name = opa_config.opa.config_map_name.clone();
50-
51-
// Resolve the secret class from the ConfigMap
52-
let secret_class = client
53-
.get::<ConfigMap>(&configmap_name, namespace)
54-
.await
55-
.with_context(|_| FetchOpaConfigMapSnafu {
56-
configmap_name: configmap_name.clone(),
57-
namespace: namespace.to_string(),
58-
})?
59-
.data
60-
.and_then(|mut data| data.remove("OPA_SECRET_CLASS"));
61-
62-
NifiAuthorizationConfig::Opa {
63-
configmap_name,
64-
cache_entry_time_to_live_secs: opa_config
65-
.cache
66-
.entry_time_to_live
67-
.as_secs(),
68-
cache_max_entries: opa_config.cache.max_entries,
69-
secret_class,
70-
}
71-
}
72-
None => NifiAuthorizationConfig::Default,
73-
},
74-
None => NifiAuthorizationConfig::Default,
48+
let Some(NifiAuthorization {
49+
opa: Some(opa_config),
50+
}) = nifi_authorization
51+
else {
52+
return Ok(NifiAuthorizationConfig::Default);
7553
};
7654

77-
Ok(config)
55+
// Resolve the secret class from the ConfigMap
56+
let secret_class = client
57+
.get::<ConfigMap>(&opa_config.opa.config_map_name, namespace)
58+
.await
59+
.with_context(|_| FetchOpaConfigMapSnafu {
60+
configmap_name: &opa_config.opa.config_map_name,
61+
namespace,
62+
})?
63+
.data
64+
.and_then(|mut data| data.remove("OPA_SECRET_CLASS"));
65+
66+
Ok(NifiAuthorizationConfig::Opa {
67+
config: &opa_config.opa,
68+
cache_entry_time_to_live_secs: opa_config.cache.entry_time_to_live.as_secs(),
69+
cache_max_entries: opa_config.cache.max_entries,
70+
secret_class,
71+
})
7872
}
7973

8074
pub fn get_authorizers_config(
8175
&self,
76+
nifi_cluster: &v1alpha1::NifiCluster,
8277
authentication_config: &NifiAuthenticationConfig,
8378
) -> Result<String, Error> {
8479
let mut authorizers_xml = indoc! {r#"
@@ -91,16 +86,19 @@ impl NifiAuthorizationConfig {
9186
NifiAuthorizationConfig::Opa {
9287
cache_entry_time_to_live_secs,
9388
cache_max_entries,
89+
config: OpaConfig { package, .. },
9490
..
9591
} => {
92+
// According to [`OpaConfig::document_url`] we default the stacklet name
93+
let package = package.clone().unwrap_or_else(|| nifi_cluster.name_any());
9694
authorizers_xml.push_str(&formatdoc! {r#"
9795
<authorizer>
9896
<identifier>authorizer</identifier>
9997
<class>org.nifiopa.nifiopa.OpaAuthorizer</class>
10098
<property name="CACHE_TIME_SECS">{cache_entry_time_to_live_secs}</property>
10199
<property name="CACHE_MAX_ENTRY_COUNT">{cache_max_entries}</property>
102100
<property name="OPA_URI">${{env:OPA_BASE_URL}}</property>
103-
<property name="OPA_RULE_HEAD">nifi/allow</property>
101+
<property name="OPA_RULE_HEAD">{package}/allow</property>
104102
</authorizer>
105103
"#});
106104
}
@@ -172,13 +170,18 @@ impl NifiAuthorizationConfig {
172170

173171
pub fn get_env_vars(&self) -> Vec<EnvVar> {
174172
match self {
175-
NifiAuthorizationConfig::Opa { configmap_name, .. } => {
173+
NifiAuthorizationConfig::Opa {
174+
config: OpaConfig {
175+
config_map_name, ..
176+
},
177+
..
178+
} => {
176179
vec![EnvVar {
177180
name: "OPA_BASE_URL".to_owned(),
178181
value_from: Some(EnvVarSource {
179182
config_map_key_ref: Some(ConfigMapKeySelector {
180183
key: "OPA".to_owned(),
181-
name: configmap_name.to_owned(),
184+
name: config_map_name.to_owned(),
182185
..Default::default()
183186
}),
184187
..Default::default()

‎tests/templates/kuttl/oidc-opa/25-opa-rego.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ metadata:
66
labels:
77
opa.stackable.tech/bundle: "true"
88
data:
9-
nifi.rego: |
10-
package nifi
9+
my_nifi_package.rego: |
10+
package my_nifi_package
1111
1212
nifi_node_proxy := "CN=generated certificate for pod"
1313
nifi_reporting_task_user := "admin"

‎tests/templates/kuttl/oidc-opa/30_nifi.yaml.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ spec:
2727
authorization:
2828
opa:
2929
configMapName: opa
30-
package: nifi
30+
package: my_nifi_package
3131
cache:
3232
entryTimeToLive: 5s
3333
maxEntries: 10

0 commit comments

Comments
 (0)