improve comments

Author: maltesander

stacks/end-to-end-security/hive-metastore-regorules.yaml

@@ -21,28 +21,34 @@ data:
     default partition_allow = false
     default user_allow = false
 
+    ### SPARK ###
+    # These rules are tailored for the create-spark-report job.
+
+    # Allow the spark user access to the 'customer_analytics_db'
     database_allow if {
       input.identity.username == spark_user
       input.resources.database.name == customer_analytics_db
     }
 
-    # Allow 'SELECT * FROM lakehouse.customer_analytics.customer'
+    # Allow the 'SELECT * FROM lakehouse.customer_analytics.customer' query in create-spark-report
     table_allow if {
       input.identity.username == spark_user
       input.resources.table.dbName == customer_analytics_db
       input.resources.table.tableName == "customer"
       input.privileges.readRequiredPriv[0].priv == "SELECT"
     }
 
-    # Allow: 'CREATE TABLE IF NOT EXISTS lakehouse.customer_analytics.spark_report AS SELECT c_birth_country, count(*) FROM ..'
+    # Allow the 'CREATE TABLE IF NOT EXISTS lakehouse.customer_analytics.spark_report AS SELECT c_birth_country, count(*) FROM ..'
+    # query in create-spark-report
     table_allow if {
       input.identity.username == spark_user
       input.resources.table.dbName == customer_analytics_db
       input.resources.table.tableName == "spark_report"
       input.privileges.writeRequiredPriv[0].priv == "CREATE"
     }
 
-    # Trino
+    ### TRINO ###
+    # We allow everything here for the technical trino user in order to still do data exploration
     database_allow if {
       input.identity.username == trino_user
     }

stacks/stacks-v2.yaml

@@ -584,12 +584,12 @@ stacks:
       - helmChart: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/_templates/postgresql-superset.yaml
       - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/krb5.yaml
       - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/kerberos-secretclass.yaml
-      - plainYaml: stacks/end-to-end-security/opa.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/opa.yaml
       - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/zookeeper.yaml # TODO: Add authentication
       - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/hdfs.yaml
       - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/hdfs-regorules.yaml
-      - plainYaml: stacks/end-to-end-security/hive-metastore.yaml
-      - plainYaml: stacks/end-to-end-security/hive-metastore-regorules.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/hive-metastore.yaml
+      - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/hive-metastore-regorules.yaml
       - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/trino.yaml
       - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/trino-regorules.yaml
       - plainYaml: https://raw.githubusercontent.com/stackabletech/demos/main/stacks/end-to-end-security/trino-policies.yaml