diff --git a/CHANGELOG.md b/CHANGELOG.md index 6f7b07d8..13191ac4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -13,7 +13,7 @@ All notable changes to this project will be documented in this file. - Coordinators now have a default affinity to the OPA Pods when OPA authorization is configured ([#924]). - Add support for 483 ([#956]). - Support configuring an Iceberg REST catalog in the Iceberg connector, optionally authenticated - using OAuth2 client credentials or a bearer token ([#950]). + using OAuth2 client credentials or a bearer token ([#950], [#972]). ### Changed @@ -99,6 +99,7 @@ All notable changes to this project will be documented in this file. [#961]: https://github.com/stackabletech/trino-operator/pull/961 [#963]: https://github.com/stackabletech/trino-operator/pull/963 [#966]: https://github.com/stackabletech/trino-operator/pull/966 +[#972]: https://github.com/stackabletech/trino-operator/pull/972 ## [26.7.0] - 2026-07-21 diff --git a/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc b/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc index 41c6e357..c6dba4be 100644 --- a/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc +++ b/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc @@ -37,6 +37,11 @@ spec: server: # <7> hostname: idp.example.com path: /oauth2/token + tls: + verification: + server: + caCert: + webPki: {} clientCredentials: # <8> secretName: trino-iceberg-client # <9> scopes: # <10> @@ -62,11 +67,12 @@ stringData: <3> Optional, defaults to 443 if TLS is used and to 80 otherwise <4> Optional, defaults to `/` <5> Optional, uses the same TLS configuration as xref:usage-guide/s3.adoc#tls[S3 connections]. - If not specified, TLS is used and the server certificate is verified against the web PKI (`webPki`). - Set `tls: null` to connect without TLS. Disabling the TLS verification (`verification.none`) is not supported. + If not specified, Trino connects over plaintext HTTP. + Disabling the TLS verification (`verification.none`) is not supported. <6> Optional, defaults to no authentication <7> The token endpoint of the OAuth2 server, see <>. - It takes the same `hostname`, `port`, `path` and `tls` fields as the REST catalog, so it uses TLS with `webPki` verification by default. + It takes the same `hostname`, `port`, `path` and `tls` fields as the REST catalog, so it connects over plaintext HTTP unless `tls` is set. + TLS is strongly recommended here, as client credentials and tokens are sent to this endpoint. <8> The client credentials are exchanged for a token using the OAuth2 client credentials flow. Alternatively, use `token.secretName` to pass a Secret containing a static bearer token in the `token` key. <9> Name of a Secret containing the `clientId` and `clientSecret` keys diff --git a/extra/crds.yaml b/extra/crds.yaml index a17a0450..19ac8bd2 100644 --- a/extra/crds.yaml +++ b/extra/crds.yaml @@ -4315,12 +4315,7 @@ spec: nullable: true type: integer tls: - default: - verification: - server: - caCert: - webPki: {} - description: Configure a TLS connection. If not specified it will default to webPki validation. + description: Use a TLS connection. If not specified no TLS will be used. nullable: true properties: verification: @@ -4406,12 +4401,7 @@ spec: nullable: true type: integer tls: - default: - verification: - server: - caCert: - webPki: {} - description: Configure a TLS connection. If not specified it will default to webPki validation. + description: Use a TLS connection. If not specified no TLS will be used. nullable: true properties: verification: diff --git a/rust/operator-binary/src/catalog/iceberg.rs b/rust/operator-binary/src/catalog/iceberg.rs index 87d9f05a..25636b39 100644 --- a/rust/operator-binary/src/catalog/iceberg.rs +++ b/rust/operator-binary/src/catalog/iceberg.rs @@ -304,11 +304,11 @@ mod tests { let mut expected_properties = BTreeMap::from([ ("connector.name", "iceberg"), ("iceberg.catalog.type", "rest"), - ("iceberg.rest-catalog.uri", "https://rest-catalog/"), + ("iceberg.rest-catalog.uri", "http://rest-catalog/"), ("iceberg.rest-catalog.security", "OAUTH2"), ( "iceberg.rest-catalog.oauth2.server-uri", - "https://idp.example.com/oauth2/token", + "http://idp.example.com/oauth2/token", ), ( "iceberg.rest-catalog.oauth2.credential", @@ -347,11 +347,11 @@ mod tests { BTreeMap::from([ ("connector.name", "iceberg"), ("iceberg.catalog.type", "rest"), - ("iceberg.rest-catalog.uri", "https://rest-catalog/"), + ("iceberg.rest-catalog.uri", "http://rest-catalog/"), ("iceberg.rest-catalog.security", "OAUTH2"), ( "iceberg.rest-catalog.oauth2.server-uri", - "https://idp.example.com/oauth2/token", + "http://idp.example.com/oauth2/token", ), ( "iceberg.rest-catalog.oauth2.token", diff --git a/rust/operator-binary/src/crd/catalog/iceberg.rs b/rust/operator-binary/src/crd/catalog/iceberg.rs index ad67e2d9..6582a999 100644 --- a/rust/operator-binary/src/crd/catalog/iceberg.rs +++ b/rust/operator-binary/src/crd/catalog/iceberg.rs @@ -1,7 +1,7 @@ use serde::{Deserialize, Serialize}; use snafu::{ResultExt, Snafu}; use stackable_operator::{ - commons::{networking::HostName, tls_verification::TlsClientDetailsWithSecureDefaults}, + commons::{networking::HostName, tls_verification::TlsClientDetails}, schemars::{self, JsonSchema}, v2::types::kubernetes::SecretName, }; @@ -123,10 +123,9 @@ pub struct HttpEndpoint { #[serde(default = "HttpEndpoint::default_path")] pub path: String, - /// Configure a TLS connection. If not specified, it defaults to webPki verification. - /// Set it to `null` to not use TLS. - #[serde(flatten)] - pub tls: TlsClientDetailsWithSecureDefaults, + /// Configure a TLS connection. If not specified, no TLS is used. + #[serde(flatten, default)] + pub tls: TlsClientDetails, } impl HttpEndpoint { @@ -164,7 +163,7 @@ mod tests { use super::*; #[rstest] - #[case::defaults("hostname: rest-catalog", "https://rest-catalog/")] + #[case::defaults("hostname: rest-catalog", "http://rest-catalog/")] #[case::without_tls("{hostname: rest-catalog, tls: null}", "http://rest-catalog/")] #[case::explicit_web_pki( "{hostname: rest-catalog, tls: {verification: {server: {caCert: {webPki: {}}}}}}", @@ -180,9 +179,9 @@ mod tests { )] #[case::trailing_slashes( "{hostname: idp.example.com, path: /realms/test/protocol/openid-connect/token//}", - "https://idp.example.com/realms/test/protocol/openid-connect/token" + "http://idp.example.com/realms/test/protocol/openid-connect/token" )] - #[case::ipv6("{hostname: '::1', port: 9001}", "https://[::1]:9001/")] + #[case::ipv6("{hostname: '::1', port: 9001}", "http://[::1]:9001/")] fn http_endpoint_url(#[case] input: &str, #[case] expected: &str) { let endpoint: HttpEndpoint = stackable_operator::utils::yaml_from_str_singleton_map(input).unwrap();