Skip to content

Commit 11dafe1

Browse files
maltesandermaltesander
committed
oparized smoke test working
1 parent ca2c9d0 commit 11dafe1

5 files changed

Lines changed: 97 additions & 60 deletions

File tree

‎rust/operator-binary/src/config/opa.rs‎

Lines changed: 7 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -37,23 +37,8 @@ pub const OPA_TLS_VOLUME_NAME: &str = "opa-tls";
3737

3838
pub struct HiveOpaConfig {
3939
/// Endpoint for OPA, e.g.
40-
/// `http://localhost:8081/v1/data/hms/allow`
40+
/// `http://localhost:8081/v1/data/<package>`
4141
pub(crate) base_endpoint: String,
42-
/// Policy to check database authorization, e.g.
43-
/// `http://localhost:8081/v1/data/hms/database_allow`
44-
pub(crate) policy_url_database: String,
45-
/// Policy to check table authorization, e.g.
46-
/// `http://localhost:8081/v1/data/hms/table_allow`
47-
pub(crate) policy_url_table: String,
48-
/// Policy to check column authorization, e.g.
49-
/// `http://localhost:8081/v1/data/hms/column_allow`
50-
pub(crate) policy_url_column: String,
51-
/// Policy to check partition authorization, e.g.
52-
/// `http://localhost:8081/v1/data/hms/partition_allow`
53-
pub(crate) policy_url_partition: String,
54-
/// Policy to check user authorization, e.g.
55-
/// `http://localhost:8081/v1/data/hms/user_allow`
56-
pub(crate) policy_url_user: String,
5742
/// Optional TLS secret class for OPA communication.
5843
/// If set, the CA certificate from this secret class will be added
5944
/// to hive's truststore to make it trust OPA's TLS certificate.
@@ -67,40 +52,8 @@ impl HiveOpaConfig {
6752
opa_config: &OpaConfig,
6853
) -> Result<Self, stackable_operator::commons::opa::Error> {
6954
// See: https://github.com/boschglobal/hive-metastore-opa-authorizer?tab=readme-ov-file#configuration
70-
// TODO: get document root once (client call) and build the other strings
7155
let base_endpoint = opa_config
72-
.full_document_url_from_config_map(client, hive, Some("allow"), OpaApiVersion::V1)
73-
.await?;
74-
75-
let policy_url_database = opa_config
76-
.full_document_url_from_config_map(
77-
client,
78-
hive,
79-
Some("database_allow"),
80-
OpaApiVersion::V1,
81-
)
82-
.await?;
83-
let policy_url_table = opa_config
84-
.full_document_url_from_config_map(client, hive, Some("table_allow"), OpaApiVersion::V1)
85-
.await?;
86-
let policy_url_column = opa_config
87-
.full_document_url_from_config_map(
88-
client,
89-
hive,
90-
Some("column_allow"),
91-
OpaApiVersion::V1,
92-
)
93-
.await?;
94-
let policy_url_partition = opa_config
95-
.full_document_url_from_config_map(
96-
client,
97-
hive,
98-
Some("partition_allow"),
99-
OpaApiVersion::V1,
100-
)
101-
.await?;
102-
let policy_url_user = opa_config
103-
.full_document_url_from_config_map(client, hive, Some("user_allow"), OpaApiVersion::V1)
56+
.full_document_url_from_config_map(client, hive, None, OpaApiVersion::V1)
10457
.await?;
10558

10659
let tls_secret_class = client
@@ -115,11 +68,6 @@ impl HiveOpaConfig {
11568

11669
Ok(HiveOpaConfig {
11770
base_endpoint,
118-
policy_url_database,
119-
policy_url_table,
120-
policy_url_column,
121-
policy_url_partition,
122-
policy_url_user,
12371
tls_secret_class,
12472
})
12573
}
@@ -152,23 +100,23 @@ impl HiveOpaConfig {
152100
),
153101
(
154102
OPA_AUTHORIZATION_POLICY_URL_DATA_BASE.to_string(),
155-
self.policy_url_database.to_owned(),
103+
"database_allow".to_string(),
156104
),
157105
(
158106
OPA_AUTHORIZATION_POLICY_URL_TABLE.to_string(),
159-
self.policy_url_table.to_owned(),
107+
"table_allow".to_string(),
160108
),
161109
(
162110
OPA_AUTHORIZATION_POLICY_URL_COLUMN.to_string(),
163-
self.policy_url_column.to_owned(),
111+
"column_allow".to_string(),
164112
),
165113
(
166114
OPA_AUTHORIZATION_POLICY_URL_PARTITION.to_string(),
167-
self.policy_url_partition.to_owned(),
115+
"partition_allow".to_string(),
168116
),
169117
(
170118
OPA_AUTHORIZATION_POLICY_URL_USER.to_string(),
171-
self.policy_url_user.to_owned(),
119+
"user_allow".to_string(),
172120
),
173121
])
174122
}

‎tests/templates/kuttl/smoke/50-assert.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
apiVersion: kuttl.dev/v1beta1
3+
kind: TestAssert
4+
timeout: 600
5+
commands:
6+
- script: kubectl -n $NAMESPACE rollout status daemonset opa-server-default --timeout 600s
7+
---
8+
apiVersion: v1
9+
kind: ConfigMap
10+
metadata:
11+
name: hive-opa-bundle
12+
labels:
13+
opa.stackable.tech/bundle: "hms"

‎tests/templates/kuttl/smoke/50-install-opa.yaml.j2‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
apiVersion: opa.stackable.tech/v1alpha1
3+
kind: OpaCluster
4+
metadata:
5+
name: opa
6+
spec:
7+
image:
8+
{% if test_scenario['values']['opa-latest'].find(",") > 0 %}
9+
custom: "{{ test_scenario['values']['opa-latest'].split(',')[1] }}"
10+
productVersion: "{{ test_scenario['values']['opa-latest'].split(',')[0] }}"
11+
{% else %}
12+
productVersion: "{{ test_scenario['values']['opa-latest'] }}"
13+
{% endif %}
14+
pullPolicy: IfNotPresent
15+
clusterConfig:
16+
{% if lookup('env', 'VECTOR_AGGREGATOR') %}
17+
vectorAggregatorConfigMapName: vector-aggregator-discovery
18+
{% endif %}
19+
servers:
20+
config:
21+
logging:
22+
enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }}
23+
containers:
24+
opa:
25+
console:
26+
level: INFO
27+
file:
28+
level: INFO
29+
loggers:
30+
decision:
31+
level: INFO
32+
roleGroups:
33+
default: {}
34+
---
35+
apiVersion: v1
36+
kind: ConfigMap
37+
metadata:
38+
name: hive-opa-bundle
39+
labels:
40+
opa.stackable.tech/bundle: "hms"
41+
data:
42+
trino.rego: |
43+
package hms
44+
45+
default database_allow = false
46+
default table_allow = false
47+
default column_allow = false
48+
default partition_allow = false
49+
default user_allow = false
50+
51+
database_allow if {
52+
input.identity.username == "stackable"
53+
}
54+
55+
table_allow if {
56+
input.identity.username == "stackable"
57+
}
58+
59+
column_allow if {
60+
input.identity.username == "stackable"
61+
}
62+
63+
partition_allow if {
64+
input.identity.username == "stackable"
65+
}
66+
67+
user_allow if {
68+
input.identity.username == "stackable"
69+
}

‎tests/templates/kuttl/smoke/60-install-hive.yaml.j2‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ spec:
1313
{% endif %}
1414
pullPolicy: IfNotPresent
1515
clusterConfig:
16+
authorization:
17+
opa:
18+
configMapName: opa
19+
package: hms
1620
database:
1721
connString: jdbc:postgresql://postgresql:5432/hive
1822
credentialsSecret: hive-credentials

‎tests/test-definition.yaml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ dimensions:
1717
- name: hive
1818
values:
1919
- 3.1.3
20-
- 4.0.0
2120
- 4.0.1
2221
- 4.1.0
2322
# Alternatively, if you want to use a custom image, append a comma and the full image name to the product version
@@ -41,6 +40,9 @@ dimensions:
4140
- name: zookeeper-latest
4241
values:
4342
- 3.9.4
43+
- name: opa-latest
44+
values:
45+
- 1.8.0
4446
- name: krb5
4547
values:
4648
- 1.21.1
@@ -62,6 +64,7 @@ tests:
6264
dimensions:
6365
- postgres
6466
- hive
67+
- opa-latest
6568
- s3-use-tls
6669
- openshift
6770
- name: upgrade

0 commit comments

Comments
 (0)