Upgrading to trino-operator(442)+opa-operator 0.61.0 version

[adwiza]

Hello, after I have been upgraded trino-operator(442)+opa-operator from https://github.com/stackabletech/opa-operator/releases/tag/23.11.0 (0.57.0) to version 24.3.0 (0.61.0) I have faced up with issue in "show catalogs" command displays nothing and I haven't seen any other errors in log files excluding this. B But I suppose I don't have a some permissions, could you please help to dig up this issue.

2024-04-10T11:05:14.162Z    DEBUG    http-worker-176    io.trino.server.ui.OAuth2WebUiAuthenticationFilter    Exception occurred during token pair deserialization
java.lang.RuntimeException: com.nimbusds.jose.JOSEException: AES/GCM/NoPadding decryption failed: Tag mismatch
    at io.trino.server.security.oauth2.JweTokenSerializer$JweEncryptedSerializer.deserialize(JweTokenSerializer.java:203)
    at io.trino.server.security.oauth2.JweTokenSerializer.deserialize(JweTokenSerializer.java:99)
    at java.base/java.util.Optional.map(Optional.java:260)
    at io.trino.server.ui.OAuth2WebUiAuthenticationFilter.getTokenPair(OAuth2WebUiAuthenticationFilter.java:127)
    at io.trino.server.ui.OAuth2WebUiAuthenticationFilter.filter(OAuth2WebUiAuthenticationFilter.java:95)
    at org.glassfish.jersey.server.ContainerFilteringStage.apply(ContainerFilteringStage.java:108)
    at org.glassfish.jersey.server.ContainerFilteringStage.apply(ContainerFilteringStage.java:44)
    at org.glassfish.jersey.process.internal.Stages.process(Stages.java:173)
    at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:253)
    at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248)
    at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244)
    at org.glassfish.jersey.internal.Errors.process(Errors.java:292)
    at org.glassfish.jersey.internal.Errors.process(Errors.java:274)
    at org.glassfish.jersey.internal.Errors.process(Errors.java:244)
    at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265)
    at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:240)
    at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:697)
    at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:394)
    at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:346)
    at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:357)
    at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:311)
    at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:205)
    at org.eclipse.jetty.ee10.servlet.ServletHolder.handle(ServletHolder.java:736)
    at org.eclipse.jetty.ee10.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1614)
    at io.airlift.http.server.TraceTokenFilter.doFilter(TraceTokenFilter.java:62)

[maltesander]

Hi @adwiza,

the OPA authorizer in Trino changed quite a bit the last releases. Could you please try to adapt your regos for the batched/extended mode (thats what you need for e.g. SHOW CATALOGS as described here https://docs.stackable.tech/home/stable/trino/usage-guide/security#_rego_for_trino_version_442).

Kind regards,
Malte

[adwiza]

It was helpful, extended[i] -> batch[i] has solved the issue. Thanks.

[sbernauer]

Glad it helped! Just FYI, as we are now using the official Trino OPA integration, things should settle down and less breaking changes should occur.