[sbernauer]

Description

Part of #849
Fixup of #950

In nifi-op tests (see PR) I noticed that the following YAML suprisingly used https:

apiVersion: trino.stackable.tech/v1alpha2
kind: TrinoCatalog
metadata:
  name: lakehouse
  labels:
    trino: trino
spec:
  connector:
    iceberg:
      catalog:
        rest:
          hostname: hive-metastore-default-headless
          port: 9001
          tls: null # FIXME: Doesn't work, uses webPki instead
          path: /iceberg

To be able to set this null, one has to use a patch like
kubectl -n kuttl-precious-caiman-xjgn patch trinocatalog lakehouse --type=json -p '[{"op": "add", "path": "/spec/connector/iceberg/catalog/rest/tls", "value": null}]'.
As our (future) Hive REST catalog doesn't offer https, likely many customers will run into this and will rais support issues.
So we use the "SDP typicalical" default of null here as well.

stackabletech/issues#535 will take care of secure by default later.

Release notes

Not needed, incorporated into #950

Definition of Done Checklist

• Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
• Please make sure all these things are done and tick the boxes

Author

• Changes are OpenShift compatible
• CRD changes approved
• CRD documentation for all fields, following the style guide.
• Helm chart can be installed and deployed operator works
• Integration tests passed (for non trivial changes)
• Changes need to be "offline" compatible
• Links to generated (nightly) docs added
• Release note snippet added

Reviewer

• Code contains useful comments
• Code contains useful logging statements
• (Integration-)Test cases added
• Documentation added or updated. Follows the style guide.
• Changelog updated
• Cargo.toml only contains references to git tags (not specific commits or branches)

Acceptance

• Feature Tracker has been updated
• Proper release label has been added
• Links to generated (nightly) docs added
• Release note snippet added
• Add type/deprecation label & add to the deprecation schedule
• Add type/experimental label & add to the experimental features tracker

[NickLarsenNZ]

I'm a little confused.

As our (future) Hive REST catalog doesn't offer https

Why won't it support HTTPS? I feel like we should be defaulting to HTTPS rather than letting credentials be leaked unknowingly due to a default.

[Maleware]

Thanks for being so fast. LGTM!

[sbernauer]

Why won't it support HTTPS?

I'd say time and prioritization. We have many tools where we only support HTTP (Superset, Airflow etc.). https://github.com/stackabletech/internal-issues/issues/156 intentionally is an MVP to get something out of the door quick, before we even figured out what the best REST catalog to support even is.

But this is just one of the arguments, to me it just feels wrong to put tls: null in the kuttl test and it still using https. I did not find a way to turn it off using "only YAML", only using the mentioned patch commands, which sucks for infrastructure as code IMHO. So this is more of a "let's get this working, we will change the default later anyway"

[sbernauer]

I chatted with @NickLarsenNZ offline and we are ok-ish with merging. We hope we get to stackabletech/issues#535 soon