Skip to content

Commit c4c5dc6

Browse files
adwk67adwk67
committed
use placeholders for initial admin and group UUIDs
1 parent 5f7a9e1 commit c4c5dc6

2 files changed

Lines changed: 41 additions & 29 deletions

File tree

‎examples/README-entra-example.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ stringData:
4343
client.secret: <CLIENT-SECRET>
4444
filter.prefix: <FILTER-PREFIX> # e.g. Nifi-Entra
4545
initial.admin: <INIT-ADMIN> # an existing EntraID user
46+
initial.admin.uuid: <ADMIN-UUID> # the Entra Admin user UUID
47+
initial.group.uuid: <GROUP-UUID> # the initial group UUID
4648
discovery.url: https://login.microsoftonline.com/<DIRECTORY-ID>/v2.0/.well-known/openid-configuration
4749
```
4850
@@ -80,15 +82,15 @@ The initial admin has immediate access as the static `authorizations.xml` file p
8082

8183
```xml
8284
<policy identifier="c8d5a9ba-0199-1000-0000-00003d66cc46" resource="/data/process-groups/root" action="W">
83-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
85+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
8486
</policy>
8587
```
8688

8789
and the `root` part of this has been updated with the actual root process group:
8890

8991
```xml
9092
<policy identifier="c8d5a9ba-0199-1000-0000-00003d66cc46" resource="/data/process-groups/ea060c65-019a-1000-766b-0854b414d37e" action="W">
91-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
93+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
9294
</policy>
9395
```
9496

‎examples/entra_nifi.yaml‎

Lines changed: 37 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -65,70 +65,67 @@ data:
6565
<authorizations>
6666
<policies>
6767
<policy identifier="f99bccd1-a30e-3e4a-98a2-dbc708edc67f" resource="/flow" action="R">
68-
<group identifier="2d95d093-0e24-482c-ad4c-03e71adadcf4"/>
69-
<group identifier="e76abc3f-ff10-4cf4-87a8-b3b6c7d0a369"/>
70-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
68+
<group identifier="${env:INITIAL_GROUP_UUID}"/>
69+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
7170
</policy>
7271
<policy identifier="b8775bd4-704a-34c6-987b-84f2daf7a515" resource="/restricted-components" action="W">
73-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
72+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
7473
</policy>
7574
<policy identifier="627410be-1717-35b4-a06f-e9362b89e0b7" resource="/tenants" action="R">
76-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
75+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
7776
</policy>
7877
<policy identifier="15e4e0bd-cb28-34fd-8587-f8d15162cba5" resource="/tenants" action="W">
79-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
78+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
8079
</policy>
8180
<policy identifier="ff96062a-fa99-36dc-9942-0f6442ae7212" resource="/policies" action="R">
82-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
81+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
8382
</policy>
8483
<policy identifier="ad99ea98-3af6-3561-ae27-5bf09e1d969d" resource="/policies" action="W">
85-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
84+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
8685
</policy>
8786
<policy identifier="2e1015cb-0fed-3005-8e0d-722311f21a03" resource="/controller" action="R">
88-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
87+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
8988
<user identifier="node-cert-user"/>
9089
</policy>
9190
<policy identifier="c6322e6c-4cc1-3bcc-91b3-2ed2111674cf" resource="/controller" action="W">
92-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
91+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
9392
<user identifier="node-cert-user"/>
9493
</policy>
9594
<policy identifier="287edf48-da72-359b-8f61-da5d4c45a270" resource="/proxy" action="W">
96-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
95+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
9796
<user identifier="node-cert-user"/>
9897
</policy>
9998
<policy identifier="becc4bd3-0199-1000-ffff-ffff9382e62a" resource="/system" action="R">
100-
<group identifier="2d95d093-0e24-482c-ad4c-03e71adadcf4"/>
101-
<user identifier="fc078c81-260b-444a-90c0-cf55b6177530"/>
102-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
99+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
103100
</policy>
104101
<policy identifier="c884e8e3-0199-1000-ffff-ffffa5b09c80" resource="/provenance" action="R">
105-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
102+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
106103
</policy>
107104
<policy identifier="c8856472-0199-1000-0000-00000b8c3534" resource="/site-to-site" action="R">
108-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
105+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
109106
</policy>
110107
<policy identifier="c885cf73-0199-1000-0000-00004b25a0fa" resource="/counters" action="R">
111-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
108+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
112109
</policy>
113110
<policy identifier="c885eb8c-0199-1000-ffff-ffffbf9dbc2f" resource="/counters" action="W">
114-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
111+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
115112
</policy>
116113
117114
<policy identifier="c8bd153a-0199-1000-0000-00005ed8e3a5" resource="/process-groups/root" action="W">
118-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
115+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
119116
</policy>
120117
<policy identifier="c8be51e3-0199-1000-0000-000004776c26" resource="/process-groups/root" action="R">
121-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
118+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
122119
</policy>
123120
<policy identifier="c8c842b2-0199-1000-0000-0000353663f9" resource="/data/process-groups/root" action="R">
124121
<user identifier="node-cert-user"/>
125-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
122+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
126123
</policy>
127124
<policy identifier="c8d27c6e-0199-1000-0000-00003862b506" resource="/operation/process-groups/root" action="W">
128-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
125+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
129126
</policy>
130127
<policy identifier="c8d5a9ba-0199-1000-0000-00003d66cc46" resource="/data/process-groups/root" action="W">
131-
<user identifier="6996a00e-bf7f-4ae2-8dc1-b668161e8ae0"/>
128+
<user identifier="${env:INITIAL_ADMIN_UUID}"/>
132129
</policy>
133130
134131
</policies>
@@ -165,6 +162,8 @@ stringData:
165162
# client.secret:
166163
# filter.prefix:
167164
# initial.admin:
165+
# initial.admin.uuid:
166+
# initial.group.uuid:
168167
# discovery.url:
169168

170169
---
@@ -174,7 +173,6 @@ metadata:
174173
name: test-nifi
175174
spec:
176175
image:
177-
custom: null
178176
productVersion: 2.6.0
179177
pullPolicy: IfNotPresent
180178
clusterConfig:
@@ -206,6 +204,7 @@ spec:
206204
nifi.security.user.oidc.additional.scopes: "profile"
207205
nifi.security.user.oidc.claim.identifying.user: "upn"
208206
nifi.process.group.root.placeholder: "root"
207+
nifi.cluster.flow.election.max.wait.time: "10 secs"
209208
podOverrides:
210209
spec:
211210
initContainers:
@@ -227,7 +226,7 @@ spec:
227226
name: oidc-secret
228227
key: discovery.url
229228
- name: prep-custom-authorizers
230-
image: oci.stackable.tech/sdp/nifi:2.4.0-stackable0.0.0-dev
229+
image: oci.stackable.tech/sdp/nifi:2.6.0-stackable0.0.0-dev
231230
env:
232231
- name: OIDC_AUTHORITY_ENDPOINT
233232
valueFrom:
@@ -259,6 +258,16 @@ spec:
259258
secretKeyRef:
260259
name: oidc-secret
261260
key: initial.admin
261+
- name: INITIAL_ADMIN_UUID
262+
valueFrom:
263+
secretKeyRef:
264+
name: oidc-secret
265+
key: initial.admin.uuid
266+
- name: INITIAL_GROUP_UUID
267+
valueFrom:
268+
secretKeyRef:
269+
name: oidc-secret
270+
key: initial.group.uuid
262271
- name: OIDC_DISCOVERY_URL
263272
valueFrom:
264273
secretKeyRef:
@@ -268,10 +277,11 @@ spec:
268277
- |
269278
echo Copying custom files...
270279
cp /tmp/custom-authorizer/authorizers.xml /stackable/nifi/custom-authorizer/
271-
echo Templating custom authorizer file...
272-
config-utils template /stackable/nifi/custom-authorizer/authorizers.xml
273280
cp /tmp/custom-authorizer/authorizations.xml /stackable/nifi/custom-authorizer/
274281
cp /tmp/custom-authorizer/users.xml /stackable/nifi/custom-authorizer/
282+
echo Template files...
283+
config-utils template /stackable/nifi/custom-authorizer/authorizers.xml
284+
config-utils template /stackable/nifi/custom-authorizer/authorizations.xml
275285
command:
276286
- /bin/bash
277287
- -c

0 commit comments

Comments
 (0)