Skip to content

feat: Support OPA role mapping #582

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 78 commits into from
Feb 26, 2025
Merged

feat: Support OPA role mapping #582

merged 78 commits into from
Feb 26, 2025

Conversation

Maleware
Copy link
Member

@Maleware Maleware commented Dec 23, 2024 •
edited by razvan
Loading

Description

Contains:

relies on https://github.com/stackabletech/docker-images/tree/feature/superset-opa-integration

Definition of Done Checklist

  • Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
  • Please make sure all these things are done and tick the boxes

Author
Preview Give feedback

Reviewer
Preview Give feedback

Acceptance
Preview Give feedback

@Maleware Maleware self-assigned this Dec 23, 2024
Maleware and others added 27 commits December 23, 2024 14:53
@Maleware
Add SecurityManager dynamically
b3c3d0f
@Maleware
Better OPA_IMPORT
25f143a
@Maleware
Security manager own file in Docker-Images. Fixing python expression
a125456
@Maleware
making clippy happy for now
1e17009
@Maleware
Updating some approaches
e237a7a
@Maleware
Adding more rules, more sophisticated handling of stuff
8614577
@Maleware
Defaults are working
a4dda2a
@Maleware
Better interfering of package path
50050bc
@Maleware
Happy Clippy
cc35802
@labrenbe
update OpaSupersetSecurityManager import path
9ae3dca
@labrenbe
import new opa_authorizer module
40c5cd1
@Maleware
Removing some ToDo's. Better comments
a92dac5
@Maleware
Adding OpaRolesCache with 10 minutes default
a5c22ec
@Maleware
pre commit becomes happy
535e2ea
@Maleware
Merge branch 'main' into feature/opa-role-mapping
1a6bcbf
@labrenbe
create opa test basics
c215250
@labrenbe
rename test directory
06515ab
@labrenbe
fix test-definition
a53c784
@labrenbe
fix typo
5ea83bd
@labrenbe
fix opa test scaffold
748030f
@Maleware
Adding rule_name to be defined by the user. defaults to empty string
c77f0ba
@Maleware
Adding default to rule_name
e19a39c
@Maleware
StackableOpaRule to string as we interfere from CRDs
5e0c32e
@Maleware
Adding ttl to crds. Default to 10.
33d3f3a
@Maleware
cache_ttl now Duration type. Converted to seconds in superset_config.py
bd97146
@labrenbe
wip: integration tests
1d27837
@labrenbe
integrate feedback
4419843
sbernauer
sbernauer previously approved these changes Feb 26, 2025
View reviewed changes
Copy link
Member

@sbernauer sbernauer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Many thanks. LGTM when tests pass

@razvan @sbernauer
Update rust/operator-binary/src/authorization/opa.rs
bc9acf3 
Co-authored-by: Sebastian Bernauer <sebastian.bernauer@stackable.de>
@razvan @sbernauer
Update rust/operator-binary/src/superset_controller.rs
16eb8e5 
Co-authored-by: Sebastian Bernauer <sebastian.bernauer@stackable.de>
sbernauer
sbernauer previously approved these changes Feb 26, 2025
View reviewed changes
Copy link
Member

@sbernauer sbernauer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM when tests pass

@sbernauer sbernauer changed the title feat: Enable opa role mapping feat: Support OPA role mapping Feb 26, 2025
sbernauer
sbernauer previously approved these changes Feb 26, 2025
View reviewed changes
@razvan
Copy link
Member

razvan commented Feb 26, 2025

OpenShift test 🟢

--- PASS: kuttl (315.53s)
    --- PASS: kuttl/harness (0.00s)
        --- PASS: kuttl/harness/opa_superset-4.1.1_opa-latest-1.0.1_openshift-true (314.71s)
PASS

@razvan
Copy link
Member

razvan commented Feb 26, 2025

🟢 Integration tests: https://testing.stackable.tech/job/superset-operator-it-custom/13/

@razvan razvan enabled auto-merge February 26, 2025 18:21
@razvan razvan requested a review from sbernauer February 26, 2025 18:21
@razvan razvan added this pull request to the merge queue Feb 26, 2025
Merged via the queue into main with commit 9c8a7d5 Feb 26, 2025
17 checks passed
@razvan razvan deleted the feature/opa-role-mapping branch February 26, 2025 18:44
@lfrancke
Copy link
Member

Can you please link docs if we have any (sounds like we should) and add a release note snippet?

@sbernauer
Copy link
Member

Nightly docs: https://docs.stackable.tech/home/nightly/superset/usage-guide/security/#_opa_role_mapping

@adwk67 adwk67 mentioned this pull request Mar 27, 2025
Merged
@Techassi Techassi added the release-note Denotes a PR that will be considered when it comes time to generate release notes. label Mar 27, 2025
@lfrancke
Copy link
Member

@Techassi @labrenbe ping re: release notes please (even if they are already in the final ones)

@Techassi
Copy link
Member

The final release notes @NickLarsenNZ and I came up with are:

* Apache Superset: Support Open Policy Agent role mapping. See #582.

@lfrancke lfrancke moved this from Acceptance: In Progress to Done in Stackable Engineering Apr 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@razvan razvan razvan left review comments

@labrenbe labrenbe labrenbe left review comments

@sbernauer sbernauer sbernauer approved these changes

Assignees

@labrenbe labrenbe

@Maleware Maleware

Labels
release/25.3.0 release-note Denotes a PR that will be considered when it comes time to generate release notes.
Projects
Stackable Engineering
Status: Done
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@Maleware @razvan @lfrancke @sbernauer @Techassi @labrenbe