Skip to content

Commit f753aeb

Browse files
maltesandermaltesander
committed
refactor: cleanup duplication, use helpers
1 parent 6e203e9 commit f753aeb

6 files changed

Lines changed: 245 additions & 458 deletions

File tree

‎rust/operator-binary/src/authentication/ldap.rs‎

Lines changed: 8 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,10 @@ use stackable_operator::{
99
use super::{
1010
AddLdapVolumesSnafu, ConstructLdapEndpointUrlSnafu, Error, MissingLdapBindCredentialsSnafu,
1111
};
12-
use crate::crd::security::{STACKABLE_TLS_DIR, TLS_STORE_PASSWORD, add_cert_to_trust_store_cmd};
12+
use crate::crd::{
13+
file_reference,
14+
security::{STACKABLE_TLS_DIR, TLS_STORE_PASSWORD, add_cert_to_trust_store_cmd},
15+
};
1316

1417
fn add_authenticator_config(
1518
provider: &ldap::v1alpha1::AuthenticationProvider,
@@ -40,11 +43,11 @@ fn add_authenticator_config(
4043
{
4144
config.insert(
4245
"druid.auth.authenticator.Ldap.credentialsValidator.bindUser".to_string(),
43-
format!("${{file:UTF-8:{ldap_bind_user_path}}}").to_string(),
46+
file_reference(ldap_bind_user_path),
4447
);
4548
config.insert(
4649
"druid.auth.authenticator.Ldap.credentialsValidator.bindPassword".to_string(),
47-
format!("${{file:UTF-8:{ldap_bind_password_path}}}").to_string(),
50+
file_reference(ldap_bind_password_path),
4851
);
4952
}
5053

@@ -64,31 +67,17 @@ fn add_authenticator_config(
6467
"druid.auth.authenticator.Ldap.authorizerName".to_string(),
6568
"LdapAuthorizer".to_string(),
6669
);
67-
config.insert(
68-
"druid.auth.authenticatorChain".to_string(),
69-
r#"["DruidSystemAuthenticator", "Ldap"]"#.to_string(),
70-
);
70+
super::set_authenticator_chain(config, &["Ldap"]);
7171

7272
Ok(())
7373
}
7474

75-
fn add_authorizer_config(config: &mut BTreeMap<String, String>) {
76-
config.insert(
77-
"druid.auth.authorizers".to_string(),
78-
r#"["LdapAuthorizer", "DruidSystemAuthorizer"]"#.to_string(),
79-
);
80-
config.insert(
81-
"druid.auth.authorizer.LdapAuthorizer.type".to_string(),
82-
r#"allowAll"#.to_string(),
83-
);
84-
}
85-
8675
pub(super) fn generate_runtime_properties_config(
8776
provider: &ldap::v1alpha1::AuthenticationProvider,
8877
config: &mut BTreeMap<String, String>,
8978
) -> Result<(), Error> {
9079
add_authenticator_config(provider, config)?;
91-
add_authorizer_config(config);
80+
super::add_authorizer_config(config, "LdapAuthorizer");
9281

9382
Ok(())
9483
}

‎rust/operator-binary/src/authentication/mod.rs‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ use crate::{
1111
crd::{
1212
DruidRole,
1313
authentication::{AuthenticationClassResolved, AuthenticationClassesResolved},
14+
env_var_reference,
1415
security::INTERNAL_INITIAL_CLIENT_PASSWORD_ENV,
1516
v1alpha1,
1617
},
@@ -23,6 +24,35 @@ pub mod oidc;
2324
// It seems this needs to be the same password for Druid to work, so we re-use the existing env variable.
2425
const ESCALATOR_INTERNAL_CLIENT_PASSWORD_ENV: &str = INTERNAL_INITIAL_CLIENT_PASSWORD_ENV;
2526

27+
/// Configures the given provider authorizer (e.g. `"LdapAuthorizer"`) alongside the Druid system
28+
/// authorizer, both with the `allowAll` authorizer type. Shared by the LDAP and OIDC providers.
29+
fn add_authorizer_config(config: &mut BTreeMap<String, String>, authorizer_name: &str) {
30+
config.insert(
31+
"druid.auth.authorizers".to_string(),
32+
format!(r#"["{authorizer_name}", "DruidSystemAuthorizer"]"#),
33+
);
34+
config.insert(
35+
format!("druid.auth.authorizer.{authorizer_name}.type"),
36+
"allowAll".to_string(),
37+
);
38+
}
39+
40+
/// Sets `druid.auth.authenticatorChain` to the Druid system authenticator followed by the given
41+
/// provider authenticators (e.g. `["Ldap"]`). Shared by the LDAP and OIDC providers.
42+
fn set_authenticator_chain(
43+
config: &mut BTreeMap<String, String>,
44+
provider_authenticators: &[&str],
45+
) {
46+
let authenticators: Vec<String> = std::iter::once("DruidSystemAuthenticator")
47+
.chain(provider_authenticators.iter().copied())
48+
.map(|name| format!("\"{name}\""))
49+
.collect();
50+
config.insert(
51+
"druid.auth.authenticatorChain".to_string(),
52+
format!("[{}]", authenticators.join(", ")),
53+
);
54+
}
55+
2656
type Result<T, E = Error> = std::result::Result<T, E>;
2757

2858
#[derive(Snafu, Debug)]
@@ -190,7 +220,7 @@ impl DruidAuthenticationConfig {
190220
config.insert(
191221
"druid.auth.authenticator.DruidSystemAuthenticator.initialInternalClientPassword"
192222
.to_string(),
193-
format!("${{env:{INTERNAL_INITIAL_CLIENT_PASSWORD_ENV}}}").to_string(),
223+
env_var_reference(INTERNAL_INITIAL_CLIENT_PASSWORD_ENV),
194224
);
195225
config.insert(
196226
"druid.auth.authenticator.DruidSystemAuthenticator.authorizerName".to_string(),
@@ -212,7 +242,7 @@ impl DruidAuthenticationConfig {
212242
);
213243
config.insert(
214244
"druid.escalator.internalClientPassword".to_string(),
215-
format!("${{env:{ESCALATOR_INTERNAL_CLIENT_PASSWORD_ENV}}}").to_string(),
245+
env_var_reference(ESCALATOR_INTERNAL_CLIENT_PASSWORD_ENV),
216246
);
217247
config.insert(
218248
"druid.escalator.authorizerName".to_string(),

‎rust/operator-binary/src/authentication/oidc.rs‎

Lines changed: 10 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,10 @@ use stackable_operator::{
99

1010
use super::{AddOidcVolumesSnafu, ConstructOidcWellKnownUrlSnafu, Error};
1111
use crate::{
12-
crd::{COOKIE_PASSPHRASE_ENV, DruidRole, security::add_cert_to_jvm_trust_store_cmd},
12+
crd::{
13+
COOKIE_PASSPHRASE_ENV, DruidRole, env_var_reference,
14+
security::add_cert_to_jvm_trust_store_cmd,
15+
},
1316
internal_secret::env_var_from_secret,
1417
};
1518

@@ -46,15 +49,15 @@ fn add_authenticator_config(
4649
);
4750
config.insert(
4851
"druid.auth.pac4j.cookiePassphrase".to_string(),
49-
format!("${{env:{COOKIE_PASSPHRASE_ENV}}}").to_string(),
52+
env_var_reference(COOKIE_PASSPHRASE_ENV),
5053
);
5154
config.insert(
5255
"druid.auth.pac4j.oidc.clientID".to_string(),
53-
format!("${{env:{oidc_client_id_env}}}").to_string(),
56+
env_var_reference(oidc_client_id_env),
5457
);
5558
config.insert(
5659
"druid.auth.pac4j.oidc.clientSecret".to_string(),
57-
format!("${{env:{oidc_client_secret_env}}}").to_string(),
60+
env_var_reference(oidc_client_secret_env),
5861
);
5962
config.insert(
6063
"druid.auth.pac4j.oidc.discoveryURI".to_string(),
@@ -75,25 +78,11 @@ fn add_authenticator_config(
7578
method_string.to_string(),
7679
);
7780

78-
config.insert(
79-
"druid.auth.authenticatorChain".to_string(),
80-
r#"["DruidSystemAuthenticator", "Oidc"]"#.to_string(),
81-
);
81+
super::set_authenticator_chain(config, &["Oidc"]);
8282

8383
Ok(())
8484
}
8585

86-
fn add_authorizer_config(config: &mut BTreeMap<String, String>) {
87-
config.insert(
88-
"druid.auth.authorizers".to_string(),
89-
r#"["OidcAuthorizer", "DruidSystemAuthorizer"]"#.to_string(),
90-
);
91-
config.insert(
92-
"druid.auth.authorizer.OidcAuthorizer.type".to_string(),
93-
r#"allowAll"#.to_string(),
94-
);
95-
}
96-
9786
/// Creates the OIDC parts of the runtime.properties config file.
9887
/// OIDC authentication is not configured on middlemanagers, because end users don't interact with them directly using the web console and
9988
/// turning on OIDC will lead to problems with the communication with coordinators during data ingest.
@@ -105,14 +94,11 @@ pub(super) fn generate_runtime_properties_config(
10594
) -> Result<(), Error> {
10695
match role {
10796
DruidRole::MiddleManager => {
108-
config.insert(
109-
"druid.auth.authenticatorChain".to_string(),
110-
r#"["DruidSystemAuthenticator"]"#.to_string(),
111-
);
97+
super::set_authenticator_chain(config, &[]);
11298
}
11399
_ => {
114100
add_authenticator_config(provider, oidc, config)?;
115-
add_authorizer_config(config)
101+
super::add_authorizer_config(config, "OidcAuthorizer");
116102
}
117103
}
118104
Ok(())

‎rust/operator-binary/src/controller/build/config_map.rs‎

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,10 @@ use crate::{
3434
},
3535
validate::{DruidRoleGroupConfig, ValidatedCluster},
3636
},
37-
crd::{DruidRole, build_recommended_labels, build_string_list, v1alpha1},
37+
crd::{
38+
DruidRole, build_recommended_labels, build_string_list, env_var_reference, file_reference,
39+
v1alpha1,
40+
},
3841
};
3942

4043
// Druid `runtime.properties` config-property keys assembled into the rolegroup ConfigMap here.
@@ -154,7 +157,7 @@ pub fn build_rolegroup_config_map(
154157
{
155158
conf.insert(
156159
crate::crd::database::METADATA_STORAGE_USER.to_string(),
157-
format!("${{env:{username_env_name}}}",),
160+
env_var_reference(username_env_name),
158161
);
159162
}
160163

@@ -165,7 +168,7 @@ pub fn build_rolegroup_config_map(
165168
{
166169
conf.insert(
167170
crate::crd::database::METADATA_STORAGE_PASSWORD.to_string(),
168-
format!("${{env:{password_env_name}}}",),
171+
env_var_reference(password_env_name),
169172
);
170173
}
171174

@@ -187,14 +190,8 @@ pub fn build_rolegroup_config_map(
187190
);
188191

189192
if let Some((access_key_file, secret_key_file)) = s3.credentials_mount_paths() {
190-
conf.insert(
191-
S3_ACCESS_KEY.to_string(),
192-
format!("${{file:UTF-8:{access_key_file}}}"),
193-
);
194-
conf.insert(
195-
S3_SECRET_KEY.to_string(),
196-
format!("${{file:UTF-8:{secret_key_file}}}"),
197-
);
193+
conf.insert(S3_ACCESS_KEY.to_string(), file_reference(access_key_file));
194+
conf.insert(S3_SECRET_KEY.to_string(), file_reference(secret_key_file));
198195
}
199196

200197
conf.insert(

0 commit comments

Comments
 (0)