healthcheck technical user with multiple authenticators
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- kubernetes, rust
- Domain
- authentication, infrastructure
Research direction
Start by reviewing the Kubernetes Probe API and the Druid authentication and authorization chain described in the issue, including basic auth and LDAP. Resolve whether probes support HTTPS and determine how a generated health-check user would authenticate. Done means authenticated health checks work when authorization is enabled and the open security questions have an answer.
Written by the indexing model from the issue text.
Description
Problem
The k8s healthcheck probes make HTTP requests which get blocked by Druid if Authorization is enabled.
Proposed solution
We need a technical user to make these probe requests, in case authentication and authorization are enabled. Otherwise the endpoints cannot be queried.
Druid supports an authentication and authorization chain, with multiple authenticators/authorizers. We can add a second mini-authenticator for just a single health-check user, or maybe reuse the existing one for basic auth, on top of LDAP. we can then use this user to do our health checks. The user should be created automatically, with generated credentials.
Open Questions
- The healthchecks are made from a k8s Probe: https://docs.rs/k8s-openapi/latest/k8s_openapi/api/core/v1/struct.Probe.html
- does the probe support HTTPS? without HTTPS, basic auth isn't safe.
- Dominant language
- Rust
- Stars
- 12
- Forks
- 1
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 10
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/druid-operator
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
stackabletech/druid-operator#692 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
stackabletech/druid-operator#647 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 30/100
stackabletech/druid-operator#646 ·
-
type/bug
Difficulty 5/5 Over a week Newbie friendliness 20/100
stackabletech/druid-operator#606 · 3 comments ·
-
Server failing to create PoolableConnectionFactory. Failing with SCRAM-based authentication error. Opentype/bug
Difficulty 4/5 3-5 days Newbie friendliness 25/100
stackabletech/druid-operator#605 ·
All issues in stackabletech/druid-operator
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·
-
bug triage:deciding
Difficulty 1/5 Under an hour Newbie friendliness 88/100
open-telemetry/otel-arrow#4132 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100