Skip to content

Commit 5a1c80d

Browse files
sbernauersbernauer
committed
Add some options
1 parent 14128de commit 5a1c80d

File tree

1 file changed

+153
-34
lines changed

1 file changed

+153
-34
lines changed

‎modules/contributor/pages/adr/ADR028-discovery-revision.adoc

Lines changed: 153 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
= ADR028: Discovery revision
2-
Razvan Mihai <razvan.mihai@stackable.tech>
2+
Sebastian Bernauer <sebastian.bernauer@stackable.tech>
33
v0.1, 2023-03-30
44
:status: draft
55

@@ -8,7 +8,6 @@ v0.1, 2023-03-30
88
** Felix Hennig
99
** Malte Sander
1010
** Natalie Klestrup Röijezon
11-
** Razvan Mihai
1211
** Sebastian Bernauer
1312
* Date: 2023-02-28
1413
@@ -33,10 +32,11 @@ We have some common use-cases that we need to express via the discovery mechanis
3332
**** protocol (http/https)
3433
**** host
3534
**** port
36-
** What Secretclass must be used to authenticate
35+
*** In case of https: The SecretClass that provided the cert for the *server*
36+
** What AuthenticationClass must be used to authenticate
3737
*** null (no SecretClass): Means no authentication at all
3838
*** (future) static: One of these plain credentials
39-
*** tls: provides ca.crt that needs to have signed the client
39+
*** tls: provides ca.crt that needs to have signed the *client* certificate
4040
*** ldap: <whatever>
4141
*** (future) kerberos: kdc where you can get a ticket from (together with the realm)
4242
*** (future) oauth: <whatever>
@@ -47,50 +47,169 @@ We have some common use-cases that we need to express via the discovery mechanis
4747
* We need at least
4848
** hdfs-site
4949
** core-site
50-
** What Secretclass must be used to authenticate
50+
** What AuthenticationClass must be used to authenticate
5151
*** (future) kerberos: kdc where you can get a ticket from (together with the realm)
52-
** The information about rpc encryption is already in the core-site, so not needed explicitly
53-
** The information about data encryption is already in the hdfs-site, so not needed explicitly
52+
** The information about rpc encryption is already in the core-site, so need to expose it explicitly
53+
** The information about data encryption is already in the hdfs-site, so need to expose it explicitly
5454

5555
== Considered Options
5656

57-
=== Option 1
57+
=== TLS: Discovery config contains SecretClass
58+
The discovery includes the SecretClass used to obtain the *server* certificate
59+
60+
Trino discovery:
61+
[source,yaml]
62+
----
63+
metadata:
64+
name: my-trino
65+
coordinatorEndpoint:
66+
host: trino-coordinator.ns.svc.cluster.local
67+
port: 8443
68+
protocol:
69+
http: {}
70+
# OR
71+
https:
72+
caCertSecretClass: tls
73+
---
74+
# superset config
75+
security:
76+
tls:
77+
secretClassName: tls
78+
kerberos:
79+
secretClassName: kerberos
80+
backends: # Don't look at the Superset CRD structure, we are only interested in the tls stuff here
81+
- name: my-trino
82+
trino:
83+
discoveryConfigName: my-trino
84+
----
85+
86+
==== Pros
87+
88+
==== Cons
89+
90+
=== TLS: Client needs to specify SecretClass
91+
---
92+
The discovery does *not* include the SecretClass used to obtain the *server* certificate.
93+
Instead the client must specify which SecretClass should be used to verify the *server* certificate.
94+
For usability reasons it can be omitted and defaults to the SecretClass the client uses for itself.
95+
96+
Trino discovery:
97+
[source,yaml]
98+
----
99+
metadata:
100+
name: my-trino
101+
coordinatorEndpoint: https://trino-coordinator.ns.svc.cluster.local:8443
102+
---
103+
# superset config
104+
security:
105+
tls:
106+
secretClassName: tls
107+
kerberos:
108+
secretClassName: kerberos
109+
backends: # Don't look at the Superset CRD structure, we are only interested in the tls stuff here
110+
- name: my-trino
111+
trino:
112+
discoveryConfigName: my-trino
113+
# override tls from the global config, OPTIONALLY
114+
tlsSecretClass: my-second-pki
115+
----
116+
117+
==== Pros
118+
119+
* Operator does not need to read/look at the DiscoveryConfig (as we can statically set up the secret-op tls secretClass volumes rather than retrieving them from the DiscoveryConfig).
120+
* Some clients only support a single pki, in that case we could not give the ability to overwrite the secretClass coming from the product itself.
121+
122+
==== Cons
123+
124+
* The client has to know what pki/secretClass the server is using.
125+
126+
=== TLS: Include caCert in Discovery config
127+
128+
Trino discovery:
129+
[source,yaml]
130+
----
131+
metadata:
132+
name: my-trino
133+
endpoint:
134+
host: trino-coordinator.ns.svc.cluster.local
135+
port: 8443
136+
protocol:
137+
http: {}
138+
# OR
139+
https:
140+
caBundle: | # Containing a PEM certificate
141+
=== BEGIN CERTIFICATE ===
142+
XXX
143+
=== END CERTIFICATE ===
144+
----
58145

59146
==== Pros
60147

148+
* Assuming DiscoveryConfig is located within a CM, the operator can simply mount the discovery CM to get the ca.crt. Operator does not need to read/look at the DiscoveryConfig.
149+
* Easier for external clients to use as they don't need to know the concept of SecretClasses and don't even need to run withing k8s.
150+
* The client has to *not* know what pki/secretClass the server is using.
61151

62152
==== Cons
63153

154+
* BIG QUESTION: How should the product operator get the ca cert from the SecretClass it uses to get the *server* cert from?
155+
** The secret-op could e.g. offer an HTTP api to fetch the ca.crt of a given SecretClass or e.g. write the ca.crt into the status of a SecretClass
156+
157+
158+
=== Authentication: Add AuthenticationClass to Discovery Config
159+
160+
Trino discovery:
161+
[source,yaml]
162+
----
163+
metadata:
164+
name: my-trino
165+
authentication:
166+
authenticationClass: my-class
167+
----
168+
169+
==== Cons
170+
171+
* Operator has to read the AuthenticationClass to determine its type (pw/tls/keytab) and set up the needed volumes and commands.
172+
* The AuthenticationClass is meant to describe "how should a server verify connecting clients" and re-purpose it to mean "how a client should authenticate itself".
173+
174+
175+
=== Authentication: Add SecretClass to Discovery Config
176+
177+
Trino discovery:
64178
[source,yaml]
65179
----
66-
status:
67-
conditions:
68-
- type: Available
69-
status: "True"
70-
lastProbeTime: 2023-02-28T14:02:00Z
71-
lastTransitionTime: 2023-02-28T12:00:00Z
72-
message: "UI and Postgres DB running"
73-
- type: Degraded
74-
status: "True"
75-
lastProbeTime: 2023-02-28T14:02:00Z
76-
lastTransitionTime: 2023-02-28T12:00:00Z
77-
reason: "DruidConnection failed. <Optional: Druid degraded message>"
78-
- type: Progressing
79-
status: "True"
80-
lastProbeTime: 2023-02-28T14:02:00Z
81-
lastTransitionTime: 2023-02-28T12:00:00Z
82-
message: "New replicas starting."
83-
- type: Upgradable
84-
status: "Unknown"
85-
lastProbeTime: 2023-02-28T14:02:00Z
86-
lastTransitionTime: 2023-02-28T12:00:00Z
87-
- type: Paused
88-
status: "True"
89-
lastProbeTime: 2023-02-28T14:02:00Z
90-
lastTransitionTime: 2023-02-28T12:00:00Z
91-
message: "User requested reconcile pause."
180+
metadata:
181+
name: my-trino
182+
authentication:
183+
secretClass: client-tls # Use this SecretClass to obtain your credentials (regardless of type of SecretClass)
92184
----
93185

186+
==== Cons
187+
188+
* Operator has to read the SecretClass to determine its type (pw/tls/keytab) and set up the needed volumes and commands.
189+
190+
191+
=== Authentication: Add needed details
192+
193+
Trino discovery:
194+
[source,yaml]
195+
----
196+
metadata:
197+
name: my-trino
198+
authentication:
199+
none: {}
200+
password: {}
201+
tls:
202+
secretClass: client-tls # Use this SecretClass to obtain a *client* cert
203+
kerberos:
204+
secretClass: client-tls # Use this SecretClass to obtain a keytab
205+
oauth:
206+
secretClass: client-tls # Use this SecretClass to obtain whatever it needs
207+
----
208+
209+
==== Pros
210+
211+
* Operator has *not* to read the SecretClass to determine its type (pw/tls/keytab), as the type is already encoded in the Discovery config.
212+
94213
== Decision Outcome
95214

96215
TODO

0 commit comments

Comments
 (0)