trino-operator/examples/simple-trino-cluster-authentication-opa-authorization-s3.yaml at d35c6e76de1bbbea0bda1020994238e684ef5a2c · stackabletech/trino-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
---
apiVersion: trino.stackable.tech/v1alpha1
kind: TrinoCluster
metadata:
  name: simple-trino
spec:
  image:
    productVersion: "477"
  clusterConfig:
    authentication:
      - authenticationClass: simple-trino-users
    authorization:
      opa:
        enableColumnMasking: false
        configMapName: simple-opa
        package: trino
    catalogLabelSelector:
      matchLabels:
        trino: simple-trino
  coordinators:
    roleGroups:
      default:
        replicas: 1
  workers:
    roleGroups:
      default:
        replicas: 1
---
apiVersion: authentication.stackable.tech/v1alpha1
kind: AuthenticationClass
metadata:
  name: simple-trino-users
spec:
  provider:
    static:
      userCredentialsSecret:
        name: simple-trino-users-secret
---
apiVersion: v1
kind: Secret
metadata:
  name: simple-trino-users-secret
type: kubernetes.io/opaque
stringData:
  admin: admin
  alice: alice
  bob: bob
---
apiVersion: opa.stackable.tech/v1alpha1
kind: OpaCluster
metadata:
  name: simple-opa
spec:
  image:
    productVersion: 1.12.2
  servers:
    roleGroups:
      default: {}
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: simple-trino-opa-bundle
  labels:
    opa.stackable.tech/bundle: "trino"
data:
  trino.rego: |
    package trino

    default allow = false

    # Allow non-batched access
    allow_if {
      is_admin
    }
    # Allow batched access
    batch contains i if {
      some i
      input.action.filterResources[i]
      is_admin
    }
    # Corner case: filtering columns is done with a single table item, and many columns inside
    batch contains i if {
      some i
      input.action.operation == "FilterColumns"
      count(input.action.filterResources) == 1
      input.action.filterResources[0].table.columns[i]
      is_admin
    }

    # Special rules for bob
    allow if {
      input.action.operation in ["ExecuteQuery", "AccessCatalog"]
      is_bob
    }
    batch contains i if {
      input.action.operation in ["FilterCatalogs"]
      some i
      input.action.filterResources[i]
      is_bob
    }

    is_admin() if {
      input.context.identity.user == "admin"
    }

    is_bob() if {
      input.context.identity.user == "bob"
    }
---
apiVersion: trino.stackable.tech/v1alpha1
kind: TrinoCatalog
metadata:
  name: hive
  labels:
    trino: simple-trino
spec:
  connector:
    hive:
      metastore:
        configMap: simple-hive-derby
---
apiVersion: v1
kind: Secret
metadata:
  name: hive-credentials
type: Opaque
stringData:
  username: APP
  password: mine
---
apiVersion: hive.stackable.tech/v1alpha1
kind: HiveCluster
metadata:
  name: simple-hive-derby
spec:
  image:
    productVersion: 4.2.0
  clusterConfig:
    database:
      connString: jdbc:derby:;databaseName=/tmp/metastore_db;create=true
      credentialsSecret: hive-credentials
      dbType: derby
  metastore:
    roleGroups:
      default:
        replicas: 1