diff --git a/CHANGELOG.md b/CHANGELOG.md index 670ccb375..98703d358 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,18 +16,23 @@ All notable changes to this project will be documented in this file. - The reconciler now applies resources and derives the cluster status in discrete apply and update_status steps for the `trino_controller` ([#923]). - All product containers now run with `securityContext.runAsNonRoot` set to `true` to improve security ([#925]). +- Internal operator refactoring: the Trino version is no longer passed to the catalog configuration, + as no catalog uses it for version-dependent behaviour anymore ([#928]). ### Fixed - Fix a longstanding problem of including empty `categories`, `shortNames` and `additionalPrinterColumns` in the CRDs, which could cause problems with GitOps tools (e.g. ArgoCD) reporting a diff in the custom resources. See [our internal issue](https://github.com/stackabletech/hdfs-operator/issues/626) and [the fix](https://github.com/kube-rs/kube/pull/2042) for details ([#925]). +- `S3Connection`s without a `tls` section are accepted again and configured as `s3.endpoint=http://...`. + Trino's native S3 file system takes the transport from the endpoint scheme, so requiring TLS was never necessary ([#928]). [#909]: https://github.com/stackabletech/trino-operator/pull/909 [#913]: https://github.com/stackabletech/trino-operator/pull/913 [#918]: https://github.com/stackabletech/trino-operator/pull/918 [#923]: https://github.com/stackabletech/trino-operator/pull/923 [#925]: https://github.com/stackabletech/trino-operator/pull/925 +[#928]: https://github.com/stackabletech/trino-operator/pull/928 ## [26.7.0] - 2026-07-21 diff --git a/docs/modules/trino/pages/usage-guide/catalogs/delta-lake.adoc b/docs/modules/trino/pages/usage-guide/catalogs/delta-lake.adoc index e2441e091..ea1a0cf4e 100644 --- a/docs/modules/trino/pages/usage-guide/catalogs/delta-lake.adoc +++ b/docs/modules/trino/pages/usage-guide/catalogs/delta-lake.adoc @@ -27,7 +27,7 @@ spec: accessStyle: Path credentials: secretClass: minio-credentials - # TLS is required for S3 connections, see the note below + # TLS is recommended for S3 connections, see the note below tls: verification: server: @@ -35,7 +35,7 @@ spec: secretClass: minio-tls-certificates ---- -IMPORTANT: The `tls` section is required, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3]. +NOTE: The `tls` section is optional but recommended, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3]. == Connect to S3 store or HDFS diff --git a/docs/modules/trino/pages/usage-guide/catalogs/hive.adoc b/docs/modules/trino/pages/usage-guide/catalogs/hive.adoc index f671d8f3d..4581b2112 100644 --- a/docs/modules/trino/pages/usage-guide/catalogs/hive.adoc +++ b/docs/modules/trino/pages/usage-guide/catalogs/hive.adoc @@ -37,7 +37,7 @@ spec: <1> The name of the catalog as it will appear in Trino <2> TrinoCluster can use these labels to select which catalogs to include <3> The name of your Hive Stacklet -<4> TLS is required for S3 connections, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3] +<4> TLS is recommended for S3 connections, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3] <5> Use `configOverrides` to add arbitrary properties to the Trino catalog configuration == Connect to S3 store @@ -66,7 +66,7 @@ spec: reference: my-minio ---- -IMPORTANT: The `tls` section is required, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3]. +NOTE: The `tls` section is optional but recommended, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3]. See xref:concepts:s3.adoc[] for details about S3 connections. diff --git a/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc b/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc index a37c35440..4152f2fb8 100644 --- a/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc +++ b/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc @@ -36,7 +36,7 @@ spec: ---- <1> The name of the catalog as it will appear in Trino <2> This is the name of your Hive Stacklet -<3> TLS is required for S3 connections, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3] +<3> TLS is recommended for S3 connections, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3] == Connect to S3 store or HDFS The Iceberg connector can connect to S3 or HDFS in the same way the xref:usage-guide/catalogs/hive.adoc[] connector does. diff --git a/docs/modules/trino/pages/usage-guide/s3.adoc b/docs/modules/trino/pages/usage-guide/s3.adoc index b9ef07516..0649309ef 100644 --- a/docs/modules/trino/pages/usage-guide/s3.adoc +++ b/docs/modules/trino/pages/usage-guide/s3.adoc @@ -4,8 +4,9 @@ You can specify S3 connection details directly inside the TrinoCatalog specification or by referring to an external S3Connection custom resource. This mechanism is used across the whole Stackable Data Platform, read the xref:concepts:s3.adoc[S3 concepts page] to learn more. -[#tls-required] -IMPORTANT: Every S3 connection must contain a `tls` section, because Trino uses the native S3 client, which requires TLS. +[#tls] +NOTE: Add a `tls` section to encrypt the traffic to the object store. +Without it, Trino connects over plaintext HTTP, which should be reserved for object stores that do not support TLS. == Inline @@ -34,7 +35,7 @@ s3: # <1> <5> Name of the SecretClass providing the credentials. The Secret behind it is expected to contain the following keys: `accessKey` and `secretKey` <6> TLS settings for encrypted traffic. The `secretClass` can be provided by the Secret Operator or yourself. - This section is required, see <>. + This section is optional but recommended, see <>. A self provided S3 TLS secret can be specified like this: diff --git a/rust/operator-binary/src/catalog/black_hole.rs b/rust/operator-binary/src/catalog/black_hole.rs index 12cb44afd..4c5af0e43 100644 --- a/rust/operator-binary/src/catalog/black_hole.rs +++ b/rust/operator-binary/src/catalog/black_hole.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for BlackHoleConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { // No additional properties needed Ok(CatalogConfig::new(catalog_name, CONNECTOR_NAME)) diff --git a/rust/operator-binary/src/catalog/commons.rs b/rust/operator-binary/src/catalog/commons.rs index 9078014e6..da6dbfee8 100644 --- a/rust/operator-binary/src/catalog/commons.rs +++ b/rust/operator-binary/src/catalog/commons.rs @@ -1,5 +1,5 @@ use async_trait::async_trait; -use snafu::{OptionExt, ResultExt, ensure}; +use snafu::{OptionExt, ResultExt}; use stackable_operator::{ builder::pod::volume::{VolumeBuilder, VolumeMountBuilder}, client::Client, @@ -15,7 +15,7 @@ use crate::{ from_trino_catalog_error::{ ConfigureS3Snafu, FailedToGetDiscoveryConfigMapDataKeySnafu, FailedToGetDiscoveryConfigMapDataSnafu, FailedToGetDiscoveryConfigMapSnafu, - S3TlsNoVerificationNotSupportedSnafu, S3TlsRequiredSnafu, + S3TlsNoVerificationNotSupportedSnafu, }, }, config, @@ -36,7 +36,6 @@ impl ExtendCatalogConfig for MetastoreConnection { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - _trino_version: u16, ) -> Result<(), FromTrinoCatalogError> { let hive_cm: ConfigMap = client .get(self.config_map.as_ref(), catalog_namespace.as_ref()) @@ -78,7 +77,6 @@ impl ExtendCatalogConfig for s3::v1alpha1::InlineConnectionOrReference { _catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - _trino_version: u16, ) -> Result<(), FromTrinoCatalogError> { let s3 = self .clone() @@ -103,9 +101,6 @@ impl ExtendCatalogConfig for s3::v1alpha1::InlineConnectionOrReference { catalog_config.add_env_property_from_file("s3.aws-secret-key", secret_key); } - // TLS is required when using native S3 implementation. - ensure!(s3.tls.uses_tls(), S3TlsRequiredSnafu); - catalog_config.init_container_extra_start_commands.extend( config::s3::s3_tls_truststore_commands(&s3.tls) .map_err(|_| S3TlsNoVerificationNotSupportedSnafu.build())?, @@ -123,7 +118,6 @@ impl ExtendCatalogConfig for HdfsConnection { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result<(), FromTrinoCatalogError> { // Since Trino 458, fs.hadoop.enabled defaults to false. catalog_config.add_property("fs.hadoop.enabled", "true"); diff --git a/rust/operator-binary/src/catalog/config.rs b/rust/operator-binary/src/catalog/config.rs index 34e0ecd5c..851620a3a 100644 --- a/rust/operator-binary/src/catalog/config.rs +++ b/rust/operator-binary/src/catalog/config.rs @@ -110,7 +110,6 @@ impl CatalogConfig { catalog: &v1alpha1::TrinoCatalog, client: &Client, catalog_namespace: &NamespaceName, - trino_version: u16, ) -> Result { let to_catalog_config: &dyn ToCatalogConfig = match &catalog.spec.connector { TrinoCatalogConnector::BlackHole(black_hole_connector) => black_hole_connector, @@ -124,7 +123,7 @@ impl CatalogConfig { TrinoCatalogConnector::Tpch(tpch_connector) => tpch_connector, }; let mut catalog_config = to_catalog_config - .to_catalog_config(catalog_name, catalog_namespace, client, trino_version) + .to_catalog_config(catalog_name, catalog_namespace, client) .await?; catalog_config diff --git a/rust/operator-binary/src/catalog/delta_lake.rs b/rust/operator-binary/src/catalog/delta_lake.rs index 11f65ab56..7e31ed182 100644 --- a/rust/operator-binary/src/catalog/delta_lake.rs +++ b/rust/operator-binary/src/catalog/delta_lake.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for DeltaLakeConnector { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - trino_version: u16, ) -> Result { let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME); @@ -27,35 +26,17 @@ impl ToCatalogConfig for DeltaLakeConnector { config.add_property("delta.security", "allow-all"); self.metastore - .extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) + .extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) .await?; if let Some(ref s3) = self.s3 { - s3.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + s3.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } if let Some(ref hdfs) = self.hdfs { - hdfs.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + hdfs.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } Ok(config) diff --git a/rust/operator-binary/src/catalog/generic.rs b/rust/operator-binary/src/catalog/generic.rs index a91ca5785..d6eb5eb2c 100644 --- a/rust/operator-binary/src/catalog/generic.rs +++ b/rust/operator-binary/src/catalog/generic.rs @@ -16,7 +16,6 @@ impl ToCatalogConfig for GenericConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { let connector_name = &self.connector_name; let mut config = CatalogConfig::new(catalog_name, connector_name); diff --git a/rust/operator-binary/src/catalog/google_sheet.rs b/rust/operator-binary/src/catalog/google_sheet.rs index f8c14c314..6f3acf6e0 100644 --- a/rust/operator-binary/src/catalog/google_sheet.rs +++ b/rust/operator-binary/src/catalog/google_sheet.rs @@ -22,7 +22,6 @@ impl ToCatalogConfig for GoogleSheetConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME); diff --git a/rust/operator-binary/src/catalog/hive.rs b/rust/operator-binary/src/catalog/hive.rs index 79357a396..7b88f668f 100644 --- a/rust/operator-binary/src/catalog/hive.rs +++ b/rust/operator-binary/src/catalog/hive.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for HiveConnector { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - trino_version: u16, ) -> Result { let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME); @@ -27,35 +26,17 @@ impl ToCatalogConfig for HiveConnector { config.add_property("hive.security", "allow-all"); self.metastore - .extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) + .extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) .await?; if let Some(ref s3) = self.s3 { - s3.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + s3.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } if let Some(ref hdfs) = self.hdfs { - hdfs.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + hdfs.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } Ok(config) diff --git a/rust/operator-binary/src/catalog/iceberg.rs b/rust/operator-binary/src/catalog/iceberg.rs index 694fcca0e..2b18826dc 100644 --- a/rust/operator-binary/src/catalog/iceberg.rs +++ b/rust/operator-binary/src/catalog/iceberg.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for IcebergConnector { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - trino_version: u16, ) -> Result { let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME); @@ -28,36 +27,18 @@ impl ToCatalogConfig for IcebergConnector { if let Some(metastore) = &self.metastore { metastore - .extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) + .extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) .await?; } if let Some(ref s3) = self.s3 { - s3.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + s3.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } if let Some(ref hdfs) = self.hdfs { - hdfs.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + hdfs.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } Ok(config) diff --git a/rust/operator-binary/src/catalog/mod.rs b/rust/operator-binary/src/catalog/mod.rs index 1ee1d3e42..06567539a 100644 --- a/rust/operator-binary/src/catalog/mod.rs +++ b/rust/operator-binary/src/catalog/mod.rs @@ -28,9 +28,6 @@ pub enum FromTrinoCatalogError { #[snafu(display("trino does not support disabling the TLS verification of S3 servers"))] S3TlsNoVerificationNotSupported, - #[snafu(display("trino 469 and greater require TLS for S3"))] - S3TlsRequired, - #[snafu(display("trino catalog has no name set"))] InvalidCatalogSpec, @@ -66,7 +63,6 @@ pub trait ToCatalogConfig { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - trino_version: u16, ) -> Result; } @@ -78,6 +74,5 @@ pub trait ExtendCatalogConfig { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - trino_version: u16, ) -> Result<(), FromTrinoCatalogError>; } diff --git a/rust/operator-binary/src/catalog/postgresql.rs b/rust/operator-binary/src/catalog/postgresql.rs index 9d0e8abb3..a25c9fc51 100644 --- a/rust/operator-binary/src/catalog/postgresql.rs +++ b/rust/operator-binary/src/catalog/postgresql.rs @@ -22,7 +22,6 @@ impl ToCatalogConfig for PostgresqlConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME); // SAFETY: `unique_database_name` must only contain uppercase ASCII letters and underscores. diff --git a/rust/operator-binary/src/catalog/tpcds.rs b/rust/operator-binary/src/catalog/tpcds.rs index 791f3676b..44b639e6c 100644 --- a/rust/operator-binary/src/catalog/tpcds.rs +++ b/rust/operator-binary/src/catalog/tpcds.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for TpcdsConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { // No additional properties needed Ok(CatalogConfig::new(catalog_name, CONNECTOR_NAME)) diff --git a/rust/operator-binary/src/catalog/tpch.rs b/rust/operator-binary/src/catalog/tpch.rs index 1ff5bc413..29ee90a0e 100644 --- a/rust/operator-binary/src/catalog/tpch.rs +++ b/rust/operator-binary/src/catalog/tpch.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for TpchConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { // No additional properties needed Ok(CatalogConfig::new(catalog_name, CONNECTOR_NAME)) diff --git a/rust/operator-binary/src/controller/dereference.rs b/rust/operator-binary/src/controller/dereference.rs index 93a8d0502..fe7af645e 100644 --- a/rust/operator-binary/src/controller/dereference.rs +++ b/rust/operator-binary/src/controller/dereference.rs @@ -3,7 +3,7 @@ //! Fetches all Kubernetes objects referenced by the TrinoCluster spec and returns them in //! [`DereferencedObjects`]. -use std::{num::ParseIntError, str::FromStr}; +use std::str::FromStr; use snafu::{OptionExt, ResultExt, Snafu}; use stackable_operator::{ @@ -52,12 +52,6 @@ pub enum Error { catalog: ObjectRef, }, - #[snafu(display("unable to parse Trino version: {product_version:?}"))] - ParseTrinoVersion { - source: ParseIntError, - product_version: String, - }, - #[snafu(display("failed to configure fault tolerant execution"))] FaultTolerantExecution { source: fault_tolerant_execution::Error, @@ -110,11 +104,6 @@ pub async fn dereference( .await .context(GetCatalogsSnafu)?; - let raw_product_version = trino.spec.image.product_version(); - let product_version = u16::from_str(raw_product_version).context(ParseTrinoVersionSnafu { - product_version: raw_product_version, - })?; - let mut catalogs = Vec::with_capacity(catalog_definitions.len()); for catalog in &catalog_definitions { let catalog_ref = ObjectRef::from_obj(catalog); @@ -122,17 +111,12 @@ pub async fn dereference( &catalog.spec.name, &catalog.name().context(ObjectHasNoNameSnafu)?, )?; - let catalog_config = CatalogConfig::from_catalog( - &catalog_name, - catalog, - client, - &namespace, - product_version, - ) - .await - .context(ParseCatalogSnafu { - catalog: catalog_ref, - })?; + let catalog_config = + CatalogConfig::from_catalog(&catalog_name, catalog, client, &namespace) + .await + .context(ParseCatalogSnafu { + catalog: catalog_ref, + })?; catalogs.push(catalog_config); } diff --git a/tests/templates/kuttl/delta/00-secrets.yaml.j2 b/tests/templates/kuttl/delta/00-secrets.yaml.j2 index 72fe2f493..1b87ac805 100644 --- a/tests/templates/kuttl/delta/00-secrets.yaml.j2 +++ b/tests/templates/kuttl/delta/00-secrets.yaml.j2 @@ -60,6 +60,8 @@ data: tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR5RENDQXJDZ0F3SUJBZ0lVQ0kyUE5OcnR6cDZRbDdHa3VhRnhtRGE2VUJvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2V6RUxNQWtHQTFVRUJoTUNSRVV4R3pBWkJnTlZCQWdNRWxOamFHeGxjM2RwWnkxSWIyeHpkR1ZwYmpFTwpNQXdHQTFVRUJ3d0ZWMlZrWld3eEtEQW1CZ05WQkFvTUgxTjBZV05yWVdKc1pTQlRhV2R1YVc1bklFRjFkR2h2CmNtbDBlU0JKYm1NeEZUQVRCZ05WQkFNTURITjBZV05yWVdKc1pTNWtaVEFnRncweU16QTJNVFl4TWpVeE1ESmEKR0E4eU1USXpNRFV5TXpFeU5URXdNbG93WGpFTE1Ba0dBMVVFQmhNQ1JFVXhHekFaQmdOVkJBZ01FbE5qYUd4bApjM2RwWnkxSWIyeHpkR1ZwYmpFT01Bd0dBMVVFQnd3RlYyVmtaV3d4RWpBUUJnTlZCQW9NQ1ZOMFlXTnJZV0pzClpURU9NQXdHQTFVRUF3d0ZiV2x1YVc4d2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUIKQVFDanluVnorWEhCOE9DWTRwc0VFWW1qb2JwZHpUbG93d2NTUU4rWURQQ2tCZW9yMFRiODdFZ0x6SksrSllidQpwb1hCbE5JSlBRYW93SkVvL1N6U2s4ZnUyWFNNeXZBWlk0RldHeEp5Mnl4SXh2UC9pYk9HT1l1aVBHWEsyNHQ2ClpjR1RVVmhhdWlaR1Nna1dyZWpXV2g3TWpGUytjMXZhWVpxQitRMXpQczVQRk1sYzhsNVYvK2I4WjdqTUppODQKbU9mSVB4amt2SXlKcjVVa2VGM1VmTHFKUzV5NExGNHR5NEZ0MmlBZDdiYmZIYW5mdlltdjZVb0RWdE1YdFdvMQpvUVBmdjNzaFdybVJMenc2ZXVJQXRiWGM1Q2pCeUlha0NiaURuQVU4cktnK0IxSjRtdlFnckx3bzNxUHJ5Smd4ClNkaWRtWjJtRVI3RXorYzVCMG0vTGlJaEFnTUJBQUdqWHpCZE1Cc0dBMVVkRVFRVU1CS0NCVzFwYm1sdmdnbHMKYjJOaGJHaHZjM1F3SFFZRFZSME9CQllFRkpRMGdENWtFdFFyK3REcERTWjdrd1o4SDVoR01COEdBMVVkSXdRWQpNQmFBRkVJM1JNTWl5aUJqeVExUlM4bmxPUkpWZDFwQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQmNkaGQrClI0Sm9HdnFMQms1OWRxSVVlY2N0dUZzcmRQeHNCaU9GaFlOZ1pxZWRMTTBVTDVEenlmQUhmVk8wTGZTRURkZFgKUkpMOXlMNytrTVUwVDc2Y3ZkQzlYVkFJRTZIVXdUbzlHWXNQcXN1eVpvVmpOcEVESkN3WTNDdm9ubEpWZTRkcQovZ0FiSk1ZQitUU21ZNXlEUHovSkZZL1haellhUGI3T2RlR3VqYlZUNUl4cDk3QXBTOFlJaXY3M0Mwd1ViYzZSCmgwcmNmUmJ5a1NRVWg5dmdWZFhSU1I4RFQzV0NmZHFOek5CWVh2OW1xZlc1ejRzYkdqK2wzd1VsL0kzRi9tSXcKZnlPNEN0aTRha2lHVkhsZmZFeTB3a3pWYUJ4aGNYajJJM0JVVGhCNFpxamxzc2llVmFGa3d2WG1teVJUMG9FVwo1SCtOUEhjcXVTMXpQc2NsCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ2p5blZ6K1hIQjhPQ1kKNHBzRUVZbWpvYnBkelRsb3d3Y1NRTitZRFBDa0Jlb3IwVGI4N0VnTHpKSytKWWJ1cG9YQmxOSUpQUWFvd0pFbwovU3pTazhmdTJYU015dkFaWTRGV0d4SnkyeXhJeHZQL2liT0dPWXVpUEdYSzI0dDZaY0dUVVZoYXVpWkdTZ2tXCnJlaldXaDdNakZTK2MxdmFZWnFCK1ExelBzNVBGTWxjOGw1Vi8rYjhaN2pNSmk4NG1PZklQeGprdkl5SnI1VWsKZUYzVWZMcUpTNXk0TEY0dHk0RnQyaUFkN2JiZkhhbmZ2WW12NlVvRFZ0TVh0V28xb1FQZnYzc2hXcm1STHp3NgpldUlBdGJYYzVDakJ5SWFrQ2JpRG5BVThyS2crQjFKNG12UWdyTHdvM3FQcnlKZ3hTZGlkbVoybUVSN0V6K2M1CkIwbS9MaUloQWdNQkFBRUNnZ0VBQWQzdDVzdUNFMjdXY0llc3NxZ3NoSFAwZHRzKyswVzF6K3h6WC8xTnhPRFkKWVhWNkJmbi9mRHJ4dFQ4aVFaZ2VVQzJORTFQaHZveXJXdWMvMm9xYXJjdEd1OUFZV29HNjJLdG9VMnpTSFdZLwpJN3VERTFXV2xOdlJZVFdOYW5DOGV4eGpRRzE4d0RKWjFpdFhTeEl0NWJEM3lrL3dUUlh0dCt1SnpyVjVqb2N1CmNoeERMd293aXUxQWo2ZFJDWk5CejlUSnh5TnI1ME5ZVzJVWEJhVC84N1hyRkZkSndNVFZUMEI3SE9uRzdSQlYKUWxLdzhtcVZiYU5lbmhjdk1qUjI5c3hUekhSK2p4SU8zQndPNk9Hai9PRmhGQllVN1RMWGVsZDFxb2UwdmIyRwpiOGhQcEd1cHRyNUF0OWx3MXc1d1EzSWdpdXRQTkg1cXlEeUNwRWw2RVFLQmdRRGNkYnNsT2ZLSmo3TzJMQXlZCkZ0a1RwaWxFMFYzajBxbVE5M0lqclY0K0RSbUxNRUIyOTk0MDdCVVlRUWoxL0RJYlFjb1oyRUVjVUI1cGRlSHMKN0RNRUQ2WExIYjJKVTEyK2E3c1d5Q05kS2VjZStUNy9JYmxJOFR0MzQwVWxIUTZ6U01TRGNqdmZjRkhWZ3YwcwpDYWpoRng3TmtMRVhUWnI4ZlQzWUloajR2UUtCZ1FDK01nWjFVbW9KdzlJQVFqMnVJVTVDeTl4aldlWURUQU8vCllhWEl6d2xnZTQzOE1jYmI0Y04yU2FOU0dEZ1Y3bnU1a3FpaWhwalBZV0lpaU9CcDlrVFJIWE9kUFc0N3N5ZUkKdDNrd3JwMnpWbFVnbGNNWlo2bW1WM1FWYUFOWmdqVTRSU3Y0ZS9WeFVMamJaYWZqUHRaUnNqWkdwSzBZVTFvdApWajhJZVE3Zk5RS0JnQ1ArWk11ekpsSW5VQ1FTRlF4UHpxbFNtN0pNckpPaHRXV2h3TlRxWFZTc050dHV5VmVqCktIaGpneDR1b0JQcFZSVDJMTlVEWmI0RnByRjVPYVhBK3FOVEdyS0s3SU1iUlZidHArSVVVeEhHNGFGQStIUVgKUVhVVFRhNUpRT1RLVmJnWHpWM1lyTVhTUk1valZNcDMyVWJHeTVTc1p2MXpBamJ2QzhYWjYxSFJBb0dBZEJjUQp2aGU1eFpBUzVEbUtjSGkvemlHa3ViZXJuNk9NUGdxYUtJSEdsVytVOExScFR0ajBkNFRtL1Rydk1PUEovVEU1CllVcUtoenBIcmhDaCtjdHBvY0k2U1dXdm5SenpLbzNpbVFaY0Y1VEFqUTBjY3F0RmI5UzlkRHR5bi9YTUNqYWUKYWlNdll5VUVVRll5TFpDelBGWnNycDNoVVpHKzN5RmZoQXB3TzJrQ2dZQkh3WWFQSWRXNld3NytCMmhpbjBvdwpqYTNjZXN2QTRqYU1Qd1NMVDhPTnRVMUdCU01md2N6TWJuUEhMclJ2Qjg3bjlnUGFSMndRR1VtckZFTzNMUFgvCmtSY09HcFlCSHBEWEVqRGhLa1dkUnVMT0ZnNEhMWmRWOEFOWmxRMFZTY0U4dTNkRERVTzg5cEdEbjA4cVRBcmwKeDlreHN1ZEVWcmtlclpiNVV4RlZxUT09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K --- +# With `s3-use-tls` set to false this connection has no `tls` section, so Trino must talk +# plaintext HTTP to MinIO, which is then installed without TLS as well. apiVersion: s3.stackable.tech/v1alpha1 kind: S3Connection metadata: @@ -70,8 +72,10 @@ spec: accessStyle: Path credentials: secretClass: s3-credentials-class +{% if test_scenario['values']['s3-use-tls'] == 'true' %} tls: verification: server: caCert: secretClass: minio-tls-certificates +{% endif %} diff --git a/tests/templates/kuttl/delta/02-assert.yaml b/tests/templates/kuttl/delta/02-assert.yaml new file mode 100644 index 000000000..92cff570c --- /dev/null +++ b/tests/templates/kuttl/delta/02-assert.yaml @@ -0,0 +1,25 @@ +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestAssert +timeout: 600 +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: minio +status: + readyReplicas: 1 + replicas: 1 +--- +apiVersion: v1 +kind: Service +metadata: + name: minio +--- +# The provisioning Job creates the `trino` bucket that 04-prepare-bucket.yaml.j2 uploads into. +apiVersion: batch/v1 +kind: Job +metadata: + name: minio-provisioning +status: + succeeded: 1 diff --git a/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 b/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 index ff7126800..c2d0ab984 100644 --- a/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 +++ b/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 @@ -2,8 +2,6 @@ apiVersion: kuttl.dev/v1beta1 kind: TestStep commands: - # give minio enough time to start - - command: sleep 5 - script: | POD=$(kubectl -n $NAMESPACE get pod -l app.kubernetes.io/instance=minio -o name | head -n1 | sed 's#pod/##') kubectl -n $NAMESPACE cp delta-table "$POD:/tmp/delta-table" diff --git a/tests/templates/kuttl/delta/helm-bitnami-minio-values.yaml.j2 b/tests/templates/kuttl/delta/helm-bitnami-minio-values.yaml.j2 index 3436e86b3..c5d371d40 100644 --- a/tests/templates/kuttl/delta/helm-bitnami-minio-values.yaml.j2 +++ b/tests/templates/kuttl/delta/helm-bitnami-minio-values.yaml.j2 @@ -72,5 +72,7 @@ service: type: NodePort tls: - enabled: true + enabled: {{ test_scenario['values']['s3-use-tls'] }} +{% if test_scenario['values']['s3-use-tls'] == 'true' %} existingSecret: minio-tls-certificates +{% endif %} diff --git a/tests/test-definition.yaml b/tests/test-definition.yaml index c765a62d8..6cbb0bcb7 100644 --- a/tests/test-definition.yaml +++ b/tests/test-definition.yaml @@ -4,8 +4,7 @@ # However, the Bitnami chart for MinIO which cannot use self-signed TLS # certificates due to a bug in libminioclient.sh. # -# Therefore, testing S3 access with TLS on OpenShift is currently broken due to -# the Native S3 implementation in Trino requiring S3 connections to use TLS. +# Therefore, testing S3 access with TLS on OpenShift is currently broken. # # libminioclient.sh hard-codes localhost in the certificate: # https://github.com/bitnami/containers/blob/7b976016fb6e926c91881bc4d824dd9e1c8e045f/bitnami/minio/2025/debian-12/rootfs/opt/bitnami/scripts/libminioclient.sh#L108 @@ -60,6 +59,10 @@ dimensions: values: - "true" - "false" + - name: s3-use-tls + values: + - "true" + - "false" - name: use-internal-tls values: - "true" @@ -135,6 +138,7 @@ tests: dimensions: - trino-delta - hive-latest + - s3-use-tls - openshift suites: - name: nightly @@ -155,7 +159,7 @@ suites: - dimensions: - expr: last - name: openshift - # Run with the openshift and all tls dimensions set to true + # Run with the openshift and all tls dimensions set to true (except S3) patch: - dimensions: - expr: last @@ -166,3 +170,6 @@ suites: expr: "true" - name: use-internal-tls expr: "true" + # S3 with TLS doesn't work on OpenShift (see comment at the top of the file) + - name: s3-use-tls + expr: "false"