feat: added ability to use custom accessControl (eg. OPA)

trinodb · Aug 16, 2024 · 2b67df6 · 2b67df6
1 parent 3454e3f
commit 2b67df6
Show file tree

Hide file tree

Showing 4 changed files with 69 additions and 43 deletions.
diff --git a/charts/trino/README.md b/charts/trino/README.md
@@ -85,7 +85,14 @@ Fast distributed SQL query engine for big data analytics that helps you explore
   ```
 * `accessControl` - object, default: `{}`  
 
-  [System access control](https://trino.io/docs/current/security/built-in-system-access-control.html) configuration.
+  [System access control](https://trino.io/docs/current/security/built-in-system-access-control.html) configuration.<br> `type: configmap | custom`<br> Custom Values Example:
+  ```yaml
+  type: custom
+  customValues: |
+      access-control.name=custom-access-control
+      access-control.custom_key=custom_value
+  ```
+  ConfigMap Values
   Example:
   ```yaml
    type: configmap

diff --git a/charts/trino/templates/configmap-coordinator.yaml b/charts/trino/templates/configmap-coordinator.yaml
@@ -80,14 +80,20 @@ data:
     {{- .Values.server.coordinatorExtraConfig | nindent 4 }}
     {{- end }}
 
-{{- if .Values.accessControl }}{{- if eq .Values.accessControl.type "configmap" }}
+{{- if .Values.accessControl }}
+  {{- if eq .Values.accessControl.type "configmap" }}
   access-control.properties: |
     access-control.name=file
     {{- if .Values.accessControl.refreshPeriod }}
     security.refresh-period={{ .Values.accessControl.refreshPeriod }}
     {{- end }}
     security.config-file={{ .Values.server.config.path }}/access-control/{{ .Values.accessControl.configFile | default "rules.json" }}
-{{- end }}{{- end }}
+  {{- end }}
+  {{- if eq .Values.accessControl.type "custom" }}
+  access-control.properties: |
+    {{- .Values.accessControl.customValues | nindent 4 }}
+  {{- end }}
+{{- end }}
 
 {{- if .Values.resourceGroups }}
   resource-groups.properties: |

diff --git a/charts/trino/values.yaml b/charts/trino/values.yaml
@@ -90,8 +90,18 @@ server:
 accessControl: {}
 # accessControl -- [System access
 # control](https://trino.io/docs/current/security/built-in-system-access-control.html)
-# configuration.
+# configuration.<br>
+# `type: configmap | custom`<br>
+# Custom Values
+# Example:
 # @raw
+# ```yaml
+# type: custom
+# customValues: |
+#     access-control.name=custom-access-control
+#     access-control.custom_key=custom_value
+# ```
+# ConfigMap Values
 # Example:
 # ```yaml
 #  type: configmap

diff --git a/test-values.yaml b/test-values.yaml
@@ -103,45 +103,48 @@ initContainers:
           mountPath: "/etc/trino/generated"
 
 accessControl:
-  type: configmap
-  refreshPeriod: 60s
-  configFile: "rules.json"
-  rules:
-    rules.json: |-
-      {
-        "catalogs": [
-          {
-            "user": "admin",
-            "catalog": "(tpch|system)",
-            "allow": "all"
-          },
-          {
-            "group": "group1",
-            "catalog": "tpch",
-            "allow": true
-          },
-          {
-            "user": "alice",
-            "catalog": "jmx",
-            "allow": "read-only"
-          },
-          {
-            "catalog": "system",
-            "allow": "none"
-          }
-        ],
-        "schemas": [
-          {
-            "user": "admin",
-            "schema": ".*",
-            "owner": true
-          },
-          {
-            "user": "alice",
-            "owner": false
-          }
-        ]
-      }
+  type: custom
+  customValues: |
+    access-control.name=read-only
+  # type: configmap
+  # refreshPeriod: 60s
+  # configFile: "rules.json"
+  # rules:
+  #   rules.json: |-
+  #     {
+  #       "catalogs": [
+  #         {
+  #           "user": "admin",
+  #           "catalog": "(tpch|system)",
+  #           "allow": "all"
+  #         },
+  #         {
+  #           "group": "group1",
+  #           "catalog": "tpch",
+  #           "allow": true
+  #         },
+  #         {
+  #           "user": "alice",
+  #           "catalog": "jmx",
+  #           "allow": "read-only"
+  #         },
+  #         {
+  #           "catalog": "system",
+  #           "allow": "none"
+  #         }
+  #       ],
+  #       "schemas": [
+  #         {
+  #           "user": "admin",
+  #           "schema": ".*",
+  #           "owner": true
+  #         },
+  #         {
+  #           "user": "alice",
+  #           "owner": false
+  #         }
+  #       ]
+  #     }
 
 jmx:
   enabled: true