From bc3a4af7fbfcf7b2816aaa70c222ee8fc51d371e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Florian=20M=C3=BCller?= Date: Thu, 13 Aug 2026 11:17:21 +0200 Subject: [PATCH 1/3] feat: allow plain http connections to s3 --- CHANGELOG.md | 5 + .../usage-guide/catalogs/delta-lake.adoc | 4 +- .../pages/usage-guide/catalogs/hive.adoc | 4 +- .../pages/usage-guide/catalogs/iceberg.adoc | 2 +- docs/modules/trino/pages/usage-guide/s3.adoc | 7 +- .../operator-binary/src/catalog/black_hole.rs | 1 - rust/operator-binary/src/catalog/commons.rs | 10 +- rust/operator-binary/src/catalog/config.rs | 3 +- .../operator-binary/src/catalog/delta_lake.rs | 29 +--- rust/operator-binary/src/catalog/generic.rs | 1 - .../src/catalog/google_sheet.rs | 1 - rust/operator-binary/src/catalog/hive.rs | 29 +--- rust/operator-binary/src/catalog/iceberg.rs | 29 +--- rust/operator-binary/src/catalog/mod.rs | 5 - .../operator-binary/src/catalog/postgresql.rs | 1 - rust/operator-binary/src/catalog/tpcds.rs | 1 - rust/operator-binary/src/catalog/tpch.rs | 1 - .../src/controller/dereference.rs | 30 +--- .../kuttl/s3-no-tls/00-assert.yaml.j2 | 10 ++ ...tor-aggregator-discovery-configmap.yaml.j2 | 9 ++ .../kuttl/s3-no-tls/00-limit-range.yaml | 11 ++ .../kuttl/s3-no-tls/00-patch-ns.yaml.j2 | 9 ++ .../templates/kuttl/s3-no-tls/00-rbac.yaml.j2 | 29 ++++ .../kuttl/s3-no-tls/00-secrets.yaml.j2 | 38 ++++++ .../templates/kuttl/s3-no-tls/01-assert.yaml | 17 +++ .../kuttl/s3-no-tls/01-install-minio.yaml.j2 | 11 ++ .../templates/kuttl/s3-no-tls/02-assert.yaml | 12 ++ .../kuttl/s3-no-tls/02-install-postgres.yaml | 12 ++ .../templates/kuttl/s3-no-tls/03-assert.yaml | 12 ++ .../kuttl/s3-no-tls/03-install-hive.yaml.j2 | 36 +++++ .../templates/kuttl/s3-no-tls/04-assert.yaml | 22 +++ .../kuttl/s3-no-tls/04-install-trino.yaml.j2 | 102 ++++++++++++++ .../templates/kuttl/s3-no-tls/05-assert.yaml | 20 +++ .../templates/kuttl/s3-no-tls/06-assert.yaml | 11 ++ .../kuttl/s3-no-tls/06-run-queries.yaml | 129 ++++++++++++++++++ .../helm-bitnami-minio-values.yaml.j2 | 65 +++++++++ .../helm-bitnami-postgresql-values.yaml.j2 | 42 ++++++ tests/test-definition.yaml | 9 +- 38 files changed, 643 insertions(+), 126 deletions(-) create mode 100644 tests/templates/kuttl/s3-no-tls/00-assert.yaml.j2 create mode 100644 tests/templates/kuttl/s3-no-tls/00-install-vector-aggregator-discovery-configmap.yaml.j2 create mode 100644 tests/templates/kuttl/s3-no-tls/00-limit-range.yaml create mode 100644 tests/templates/kuttl/s3-no-tls/00-patch-ns.yaml.j2 create mode 100644 tests/templates/kuttl/s3-no-tls/00-rbac.yaml.j2 create mode 100644 tests/templates/kuttl/s3-no-tls/00-secrets.yaml.j2 create mode 100644 tests/templates/kuttl/s3-no-tls/01-assert.yaml create mode 100644 tests/templates/kuttl/s3-no-tls/01-install-minio.yaml.j2 create mode 100644 tests/templates/kuttl/s3-no-tls/02-assert.yaml create mode 100644 tests/templates/kuttl/s3-no-tls/02-install-postgres.yaml create mode 100644 tests/templates/kuttl/s3-no-tls/03-assert.yaml create mode 100644 tests/templates/kuttl/s3-no-tls/03-install-hive.yaml.j2 create mode 100644 tests/templates/kuttl/s3-no-tls/04-assert.yaml create mode 100644 tests/templates/kuttl/s3-no-tls/04-install-trino.yaml.j2 create mode 100644 tests/templates/kuttl/s3-no-tls/05-assert.yaml create mode 100644 tests/templates/kuttl/s3-no-tls/06-assert.yaml create mode 100644 tests/templates/kuttl/s3-no-tls/06-run-queries.yaml create mode 100644 tests/templates/kuttl/s3-no-tls/helm-bitnami-minio-values.yaml.j2 create mode 100644 tests/templates/kuttl/s3-no-tls/helm-bitnami-postgresql-values.yaml.j2 diff --git a/CHANGELOG.md b/CHANGELOG.md index 670ccb375..98703d358 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -16,18 +16,23 @@ All notable changes to this project will be documented in this file. - The reconciler now applies resources and derives the cluster status in discrete apply and update_status steps for the `trino_controller` ([#923]). - All product containers now run with `securityContext.runAsNonRoot` set to `true` to improve security ([#925]). +- Internal operator refactoring: the Trino version is no longer passed to the catalog configuration, + as no catalog uses it for version-dependent behaviour anymore ([#928]). ### Fixed - Fix a longstanding problem of including empty `categories`, `shortNames` and `additionalPrinterColumns` in the CRDs, which could cause problems with GitOps tools (e.g. ArgoCD) reporting a diff in the custom resources. See [our internal issue](https://github.com/stackabletech/hdfs-operator/issues/626) and [the fix](https://github.com/kube-rs/kube/pull/2042) for details ([#925]). +- `S3Connection`s without a `tls` section are accepted again and configured as `s3.endpoint=http://...`. + Trino's native S3 file system takes the transport from the endpoint scheme, so requiring TLS was never necessary ([#928]). [#909]: https://github.com/stackabletech/trino-operator/pull/909 [#913]: https://github.com/stackabletech/trino-operator/pull/913 [#918]: https://github.com/stackabletech/trino-operator/pull/918 [#923]: https://github.com/stackabletech/trino-operator/pull/923 [#925]: https://github.com/stackabletech/trino-operator/pull/925 +[#928]: https://github.com/stackabletech/trino-operator/pull/928 ## [26.7.0] - 2026-07-21 diff --git a/docs/modules/trino/pages/usage-guide/catalogs/delta-lake.adoc b/docs/modules/trino/pages/usage-guide/catalogs/delta-lake.adoc index e2441e091..ea1a0cf4e 100644 --- a/docs/modules/trino/pages/usage-guide/catalogs/delta-lake.adoc +++ b/docs/modules/trino/pages/usage-guide/catalogs/delta-lake.adoc @@ -27,7 +27,7 @@ spec: accessStyle: Path credentials: secretClass: minio-credentials - # TLS is required for S3 connections, see the note below + # TLS is recommended for S3 connections, see the note below tls: verification: server: @@ -35,7 +35,7 @@ spec: secretClass: minio-tls-certificates ---- -IMPORTANT: The `tls` section is required, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3]. +NOTE: The `tls` section is optional but recommended, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3]. == Connect to S3 store or HDFS diff --git a/docs/modules/trino/pages/usage-guide/catalogs/hive.adoc b/docs/modules/trino/pages/usage-guide/catalogs/hive.adoc index f671d8f3d..4581b2112 100644 --- a/docs/modules/trino/pages/usage-guide/catalogs/hive.adoc +++ b/docs/modules/trino/pages/usage-guide/catalogs/hive.adoc @@ -37,7 +37,7 @@ spec: <1> The name of the catalog as it will appear in Trino <2> TrinoCluster can use these labels to select which catalogs to include <3> The name of your Hive Stacklet -<4> TLS is required for S3 connections, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3] +<4> TLS is recommended for S3 connections, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3] <5> Use `configOverrides` to add arbitrary properties to the Trino catalog configuration == Connect to S3 store @@ -66,7 +66,7 @@ spec: reference: my-minio ---- -IMPORTANT: The `tls` section is required, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3]. +NOTE: The `tls` section is optional but recommended, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3]. See xref:concepts:s3.adoc[] for details about S3 connections. diff --git a/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc b/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc index a37c35440..4152f2fb8 100644 --- a/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc +++ b/docs/modules/trino/pages/usage-guide/catalogs/iceberg.adoc @@ -36,7 +36,7 @@ spec: ---- <1> The name of the catalog as it will appear in Trino <2> This is the name of your Hive Stacklet -<3> TLS is required for S3 connections, see xref:usage-guide/s3.adoc#tls-required[Connecting Trino to S3] +<3> TLS is recommended for S3 connections, see xref:usage-guide/s3.adoc#tls[Connecting Trino to S3] == Connect to S3 store or HDFS The Iceberg connector can connect to S3 or HDFS in the same way the xref:usage-guide/catalogs/hive.adoc[] connector does. diff --git a/docs/modules/trino/pages/usage-guide/s3.adoc b/docs/modules/trino/pages/usage-guide/s3.adoc index b9ef07516..0649309ef 100644 --- a/docs/modules/trino/pages/usage-guide/s3.adoc +++ b/docs/modules/trino/pages/usage-guide/s3.adoc @@ -4,8 +4,9 @@ You can specify S3 connection details directly inside the TrinoCatalog specification or by referring to an external S3Connection custom resource. This mechanism is used across the whole Stackable Data Platform, read the xref:concepts:s3.adoc[S3 concepts page] to learn more. -[#tls-required] -IMPORTANT: Every S3 connection must contain a `tls` section, because Trino uses the native S3 client, which requires TLS. +[#tls] +NOTE: Add a `tls` section to encrypt the traffic to the object store. +Without it, Trino connects over plaintext HTTP, which should be reserved for object stores that do not support TLS. == Inline @@ -34,7 +35,7 @@ s3: # <1> <5> Name of the SecretClass providing the credentials. The Secret behind it is expected to contain the following keys: `accessKey` and `secretKey` <6> TLS settings for encrypted traffic. The `secretClass` can be provided by the Secret Operator or yourself. - This section is required, see <>. + This section is optional but recommended, see <>. A self provided S3 TLS secret can be specified like this: diff --git a/rust/operator-binary/src/catalog/black_hole.rs b/rust/operator-binary/src/catalog/black_hole.rs index 12cb44afd..4c5af0e43 100644 --- a/rust/operator-binary/src/catalog/black_hole.rs +++ b/rust/operator-binary/src/catalog/black_hole.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for BlackHoleConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { // No additional properties needed Ok(CatalogConfig::new(catalog_name, CONNECTOR_NAME)) diff --git a/rust/operator-binary/src/catalog/commons.rs b/rust/operator-binary/src/catalog/commons.rs index 9078014e6..da6dbfee8 100644 --- a/rust/operator-binary/src/catalog/commons.rs +++ b/rust/operator-binary/src/catalog/commons.rs @@ -1,5 +1,5 @@ use async_trait::async_trait; -use snafu::{OptionExt, ResultExt, ensure}; +use snafu::{OptionExt, ResultExt}; use stackable_operator::{ builder::pod::volume::{VolumeBuilder, VolumeMountBuilder}, client::Client, @@ -15,7 +15,7 @@ use crate::{ from_trino_catalog_error::{ ConfigureS3Snafu, FailedToGetDiscoveryConfigMapDataKeySnafu, FailedToGetDiscoveryConfigMapDataSnafu, FailedToGetDiscoveryConfigMapSnafu, - S3TlsNoVerificationNotSupportedSnafu, S3TlsRequiredSnafu, + S3TlsNoVerificationNotSupportedSnafu, }, }, config, @@ -36,7 +36,6 @@ impl ExtendCatalogConfig for MetastoreConnection { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - _trino_version: u16, ) -> Result<(), FromTrinoCatalogError> { let hive_cm: ConfigMap = client .get(self.config_map.as_ref(), catalog_namespace.as_ref()) @@ -78,7 +77,6 @@ impl ExtendCatalogConfig for s3::v1alpha1::InlineConnectionOrReference { _catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - _trino_version: u16, ) -> Result<(), FromTrinoCatalogError> { let s3 = self .clone() @@ -103,9 +101,6 @@ impl ExtendCatalogConfig for s3::v1alpha1::InlineConnectionOrReference { catalog_config.add_env_property_from_file("s3.aws-secret-key", secret_key); } - // TLS is required when using native S3 implementation. - ensure!(s3.tls.uses_tls(), S3TlsRequiredSnafu); - catalog_config.init_container_extra_start_commands.extend( config::s3::s3_tls_truststore_commands(&s3.tls) .map_err(|_| S3TlsNoVerificationNotSupportedSnafu.build())?, @@ -123,7 +118,6 @@ impl ExtendCatalogConfig for HdfsConnection { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result<(), FromTrinoCatalogError> { // Since Trino 458, fs.hadoop.enabled defaults to false. catalog_config.add_property("fs.hadoop.enabled", "true"); diff --git a/rust/operator-binary/src/catalog/config.rs b/rust/operator-binary/src/catalog/config.rs index 34e0ecd5c..851620a3a 100644 --- a/rust/operator-binary/src/catalog/config.rs +++ b/rust/operator-binary/src/catalog/config.rs @@ -110,7 +110,6 @@ impl CatalogConfig { catalog: &v1alpha1::TrinoCatalog, client: &Client, catalog_namespace: &NamespaceName, - trino_version: u16, ) -> Result { let to_catalog_config: &dyn ToCatalogConfig = match &catalog.spec.connector { TrinoCatalogConnector::BlackHole(black_hole_connector) => black_hole_connector, @@ -124,7 +123,7 @@ impl CatalogConfig { TrinoCatalogConnector::Tpch(tpch_connector) => tpch_connector, }; let mut catalog_config = to_catalog_config - .to_catalog_config(catalog_name, catalog_namespace, client, trino_version) + .to_catalog_config(catalog_name, catalog_namespace, client) .await?; catalog_config diff --git a/rust/operator-binary/src/catalog/delta_lake.rs b/rust/operator-binary/src/catalog/delta_lake.rs index 11f65ab56..7e31ed182 100644 --- a/rust/operator-binary/src/catalog/delta_lake.rs +++ b/rust/operator-binary/src/catalog/delta_lake.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for DeltaLakeConnector { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - trino_version: u16, ) -> Result { let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME); @@ -27,35 +26,17 @@ impl ToCatalogConfig for DeltaLakeConnector { config.add_property("delta.security", "allow-all"); self.metastore - .extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) + .extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) .await?; if let Some(ref s3) = self.s3 { - s3.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + s3.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } if let Some(ref hdfs) = self.hdfs { - hdfs.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + hdfs.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } Ok(config) diff --git a/rust/operator-binary/src/catalog/generic.rs b/rust/operator-binary/src/catalog/generic.rs index a91ca5785..d6eb5eb2c 100644 --- a/rust/operator-binary/src/catalog/generic.rs +++ b/rust/operator-binary/src/catalog/generic.rs @@ -16,7 +16,6 @@ impl ToCatalogConfig for GenericConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { let connector_name = &self.connector_name; let mut config = CatalogConfig::new(catalog_name, connector_name); diff --git a/rust/operator-binary/src/catalog/google_sheet.rs b/rust/operator-binary/src/catalog/google_sheet.rs index f8c14c314..6f3acf6e0 100644 --- a/rust/operator-binary/src/catalog/google_sheet.rs +++ b/rust/operator-binary/src/catalog/google_sheet.rs @@ -22,7 +22,6 @@ impl ToCatalogConfig for GoogleSheetConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME); diff --git a/rust/operator-binary/src/catalog/hive.rs b/rust/operator-binary/src/catalog/hive.rs index 79357a396..7b88f668f 100644 --- a/rust/operator-binary/src/catalog/hive.rs +++ b/rust/operator-binary/src/catalog/hive.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for HiveConnector { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - trino_version: u16, ) -> Result { let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME); @@ -27,35 +26,17 @@ impl ToCatalogConfig for HiveConnector { config.add_property("hive.security", "allow-all"); self.metastore - .extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) + .extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) .await?; if let Some(ref s3) = self.s3 { - s3.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + s3.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } if let Some(ref hdfs) = self.hdfs { - hdfs.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + hdfs.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } Ok(config) diff --git a/rust/operator-binary/src/catalog/iceberg.rs b/rust/operator-binary/src/catalog/iceberg.rs index 694fcca0e..2b18826dc 100644 --- a/rust/operator-binary/src/catalog/iceberg.rs +++ b/rust/operator-binary/src/catalog/iceberg.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for IcebergConnector { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - trino_version: u16, ) -> Result { let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME); @@ -28,36 +27,18 @@ impl ToCatalogConfig for IcebergConnector { if let Some(metastore) = &self.metastore { metastore - .extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) + .extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) .await?; } if let Some(ref s3) = self.s3 { - s3.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + s3.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } if let Some(ref hdfs) = self.hdfs { - hdfs.extend_catalog_config( - &mut config, - catalog_name, - catalog_namespace, - client, - trino_version, - ) - .await?; + hdfs.extend_catalog_config(&mut config, catalog_name, catalog_namespace, client) + .await?; } Ok(config) diff --git a/rust/operator-binary/src/catalog/mod.rs b/rust/operator-binary/src/catalog/mod.rs index 1ee1d3e42..06567539a 100644 --- a/rust/operator-binary/src/catalog/mod.rs +++ b/rust/operator-binary/src/catalog/mod.rs @@ -28,9 +28,6 @@ pub enum FromTrinoCatalogError { #[snafu(display("trino does not support disabling the TLS verification of S3 servers"))] S3TlsNoVerificationNotSupported, - #[snafu(display("trino 469 and greater require TLS for S3"))] - S3TlsRequired, - #[snafu(display("trino catalog has no name set"))] InvalidCatalogSpec, @@ -66,7 +63,6 @@ pub trait ToCatalogConfig { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - trino_version: u16, ) -> Result; } @@ -78,6 +74,5 @@ pub trait ExtendCatalogConfig { catalog_name: &TrinoCatalogName, catalog_namespace: &NamespaceName, client: &Client, - trino_version: u16, ) -> Result<(), FromTrinoCatalogError>; } diff --git a/rust/operator-binary/src/catalog/postgresql.rs b/rust/operator-binary/src/catalog/postgresql.rs index 9d0e8abb3..a25c9fc51 100644 --- a/rust/operator-binary/src/catalog/postgresql.rs +++ b/rust/operator-binary/src/catalog/postgresql.rs @@ -22,7 +22,6 @@ impl ToCatalogConfig for PostgresqlConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { let mut config = CatalogConfig::new(catalog_name, CONNECTOR_NAME); // SAFETY: `unique_database_name` must only contain uppercase ASCII letters and underscores. diff --git a/rust/operator-binary/src/catalog/tpcds.rs b/rust/operator-binary/src/catalog/tpcds.rs index 791f3676b..44b639e6c 100644 --- a/rust/operator-binary/src/catalog/tpcds.rs +++ b/rust/operator-binary/src/catalog/tpcds.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for TpcdsConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { // No additional properties needed Ok(CatalogConfig::new(catalog_name, CONNECTOR_NAME)) diff --git a/rust/operator-binary/src/catalog/tpch.rs b/rust/operator-binary/src/catalog/tpch.rs index 1ff5bc413..29ee90a0e 100644 --- a/rust/operator-binary/src/catalog/tpch.rs +++ b/rust/operator-binary/src/catalog/tpch.rs @@ -15,7 +15,6 @@ impl ToCatalogConfig for TpchConnector { catalog_name: &TrinoCatalogName, _catalog_namespace: &NamespaceName, _client: &Client, - _trino_version: u16, ) -> Result { // No additional properties needed Ok(CatalogConfig::new(catalog_name, CONNECTOR_NAME)) diff --git a/rust/operator-binary/src/controller/dereference.rs b/rust/operator-binary/src/controller/dereference.rs index 93a8d0502..fe7af645e 100644 --- a/rust/operator-binary/src/controller/dereference.rs +++ b/rust/operator-binary/src/controller/dereference.rs @@ -3,7 +3,7 @@ //! Fetches all Kubernetes objects referenced by the TrinoCluster spec and returns them in //! [`DereferencedObjects`]. -use std::{num::ParseIntError, str::FromStr}; +use std::str::FromStr; use snafu::{OptionExt, ResultExt, Snafu}; use stackable_operator::{ @@ -52,12 +52,6 @@ pub enum Error { catalog: ObjectRef, }, - #[snafu(display("unable to parse Trino version: {product_version:?}"))] - ParseTrinoVersion { - source: ParseIntError, - product_version: String, - }, - #[snafu(display("failed to configure fault tolerant execution"))] FaultTolerantExecution { source: fault_tolerant_execution::Error, @@ -110,11 +104,6 @@ pub async fn dereference( .await .context(GetCatalogsSnafu)?; - let raw_product_version = trino.spec.image.product_version(); - let product_version = u16::from_str(raw_product_version).context(ParseTrinoVersionSnafu { - product_version: raw_product_version, - })?; - let mut catalogs = Vec::with_capacity(catalog_definitions.len()); for catalog in &catalog_definitions { let catalog_ref = ObjectRef::from_obj(catalog); @@ -122,17 +111,12 @@ pub async fn dereference( &catalog.spec.name, &catalog.name().context(ObjectHasNoNameSnafu)?, )?; - let catalog_config = CatalogConfig::from_catalog( - &catalog_name, - catalog, - client, - &namespace, - product_version, - ) - .await - .context(ParseCatalogSnafu { - catalog: catalog_ref, - })?; + let catalog_config = + CatalogConfig::from_catalog(&catalog_name, catalog, client, &namespace) + .await + .context(ParseCatalogSnafu { + catalog: catalog_ref, + })?; catalogs.push(catalog_config); } diff --git a/tests/templates/kuttl/s3-no-tls/00-assert.yaml.j2 b/tests/templates/kuttl/s3-no-tls/00-assert.yaml.j2 new file mode 100644 index 000000000..50b1d4c3d --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/00-assert.yaml.j2 @@ -0,0 +1,10 @@ +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestAssert +{% if lookup('env', 'VECTOR_AGGREGATOR') %} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: vector-aggregator-discovery +{% endif %} diff --git a/tests/templates/kuttl/s3-no-tls/00-install-vector-aggregator-discovery-configmap.yaml.j2 b/tests/templates/kuttl/s3-no-tls/00-install-vector-aggregator-discovery-configmap.yaml.j2 new file mode 100644 index 000000000..2d6a0df5f --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/00-install-vector-aggregator-discovery-configmap.yaml.j2 @@ -0,0 +1,9 @@ +{% if lookup('env', 'VECTOR_AGGREGATOR') %} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: vector-aggregator-discovery +data: + ADDRESS: {{ lookup('env', 'VECTOR_AGGREGATOR') }} +{% endif %} diff --git a/tests/templates/kuttl/s3-no-tls/00-limit-range.yaml b/tests/templates/kuttl/s3-no-tls/00-limit-range.yaml new file mode 100644 index 000000000..8fd022107 --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/00-limit-range.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: v1 +kind: LimitRange +metadata: + name: limit-request-ratio +spec: + limits: + - type: "Container" + maxLimitRequestRatio: + cpu: 5 + memory: 1 diff --git a/tests/templates/kuttl/s3-no-tls/00-patch-ns.yaml.j2 b/tests/templates/kuttl/s3-no-tls/00-patch-ns.yaml.j2 new file mode 100644 index 000000000..67185acfd --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/00-patch-ns.yaml.j2 @@ -0,0 +1,9 @@ +{% if test_scenario['values']['openshift'] == 'true' %} +# see https://github.com/stackabletech/issues/issues/566 +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +commands: + - script: kubectl patch namespace $NAMESPACE -p '{"metadata":{"labels":{"pod-security.kubernetes.io/enforce":"privileged"}}}' + timeout: 120 +{% endif %} diff --git a/tests/templates/kuttl/s3-no-tls/00-rbac.yaml.j2 b/tests/templates/kuttl/s3-no-tls/00-rbac.yaml.j2 new file mode 100644 index 000000000..9cbf03511 --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/00-rbac.yaml.j2 @@ -0,0 +1,29 @@ +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: use-integration-tests-scc +rules: +{% if test_scenario['values']['openshift'] == "true" %} + - apiGroups: ["security.openshift.io"] + resources: ["securitycontextconstraints"] + resourceNames: ["privileged"] + verbs: ["use"] +{% endif %} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: integration-tests-sa +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: use-integration-tests-scc +subjects: + - kind: ServiceAccount + name: integration-tests-sa +roleRef: + kind: Role + name: use-integration-tests-scc + apiGroup: rbac.authorization.k8s.io diff --git a/tests/templates/kuttl/s3-no-tls/00-secrets.yaml.j2 b/tests/templates/kuttl/s3-no-tls/00-secrets.yaml.j2 new file mode 100644 index 000000000..cd71e30b9 --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/00-secrets.yaml.j2 @@ -0,0 +1,38 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: minio-credentials + labels: + secrets.stackable.tech/class: s3-credentials-class +timeout: 240 +stringData: + accessKey: minioAccessKey + secretKey: minioSecretKey + # The following two entries are used by the Bitnami chart for MinIO to + # set up credentials for accessing buckets managed by the MinIO tenant. + root-user: minioAccessKey + root-password: minioSecretKey +--- +apiVersion: secrets.stackable.tech/v1alpha1 +kind: SecretClass +metadata: + name: s3-credentials-class +spec: + backend: + k8sSearch: + searchNamespace: + pod: {} +--- +# This connection has no `tls` section, so Trino must talk plaintext HTTP to MinIO, which is +# installed without TLS in helm-bitnami-minio-values.yaml. +apiVersion: s3.stackable.tech/v1alpha1 +kind: S3Connection +metadata: + name: minio +spec: + host: minio + port: 9000 + accessStyle: Path + credentials: + secretClass: s3-credentials-class diff --git a/tests/templates/kuttl/s3-no-tls/01-assert.yaml b/tests/templates/kuttl/s3-no-tls/01-assert.yaml new file mode 100644 index 000000000..4d24ed7db --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/01-assert.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestAssert +timeout: 600 +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: minio +status: + readyReplicas: 1 + replicas: 1 +--- +apiVersion: v1 +kind: Service +metadata: + name: minio diff --git a/tests/templates/kuttl/s3-no-tls/01-install-minio.yaml.j2 b/tests/templates/kuttl/s3-no-tls/01-install-minio.yaml.j2 new file mode 100644 index 000000000..0be8b7a3a --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/01-install-minio.yaml.j2 @@ -0,0 +1,11 @@ +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +commands: + - script: >- + helm install minio + --namespace $NAMESPACE + --version 12.6.4 + -f helm-bitnami-minio-values.yaml + --repo https://charts.bitnami.com/bitnami minio + timeout: 240 diff --git a/tests/templates/kuttl/s3-no-tls/02-assert.yaml b/tests/templates/kuttl/s3-no-tls/02-assert.yaml new file mode 100644 index 000000000..1ac124233 --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/02-assert.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestAssert +timeout: 600 +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: postgresql +status: + readyReplicas: 1 + replicas: 1 diff --git a/tests/templates/kuttl/s3-no-tls/02-install-postgres.yaml b/tests/templates/kuttl/s3-no-tls/02-install-postgres.yaml new file mode 100644 index 000000000..93c93a16f --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/02-install-postgres.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestStep +timeout: 300 +commands: + - script: >- + helm upgrade postgresql + --install + --version=12.5.6 + --namespace $NAMESPACE + -f helm-bitnami-postgresql-values.yaml + --repo https://charts.bitnami.com/bitnami postgresql diff --git a/tests/templates/kuttl/s3-no-tls/03-assert.yaml b/tests/templates/kuttl/s3-no-tls/03-assert.yaml new file mode 100644 index 000000000..50c27fd93 --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/03-assert.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestAssert +timeout: 900 +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: hive-metastore-default +status: + readyReplicas: 1 + replicas: 1 diff --git a/tests/templates/kuttl/s3-no-tls/03-install-hive.yaml.j2 b/tests/templates/kuttl/s3-no-tls/03-install-hive.yaml.j2 new file mode 100644 index 000000000..d145f8006 --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/03-install-hive.yaml.j2 @@ -0,0 +1,36 @@ +--- +apiVersion: hive.stackable.tech/v1alpha1 +kind: HiveCluster +metadata: + name: hive +spec: + image: + productVersion: "{{ test_scenario['values']['hive-latest'] }}" + pullPolicy: IfNotPresent + clusterConfig: + metadataDatabase: + postgresql: + host: postgresql + database: hive + credentialsSecretName: postgres-credentials + s3: + reference: minio +{% if lookup('env', 'VECTOR_AGGREGATOR') %} + vectorAggregatorConfigMapName: vector-aggregator-discovery +{% endif %} + metastore: + config: + logging: + enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }} + roleGroups: + default: + replicas: 1 +--- +apiVersion: v1 +kind: Secret +metadata: + name: postgres-credentials +type: Opaque +stringData: + username: hive + password: hive diff --git a/tests/templates/kuttl/s3-no-tls/04-assert.yaml b/tests/templates/kuttl/s3-no-tls/04-assert.yaml new file mode 100644 index 000000000..dbfd93658 --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/04-assert.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestAssert +timeout: 720 +commands: + - script: kubectl -n $NAMESPACE wait --for=condition=available=true trinoclusters.trino.stackable.tech/trino --timeout 301s +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: trino-coordinator-default +status: + readyReplicas: 1 + replicas: 1 +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: trino-worker-default +status: + readyReplicas: 1 + replicas: 1 diff --git a/tests/templates/kuttl/s3-no-tls/04-install-trino.yaml.j2 b/tests/templates/kuttl/s3-no-tls/04-install-trino.yaml.j2 new file mode 100644 index 000000000..5a9e76d79 --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/04-install-trino.yaml.j2 @@ -0,0 +1,102 @@ +--- +# The `hive` catalog uses the `reference` form of the S3 connection, ... +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: hive + labels: + trino: trino +spec: + connector: + hive: + metastore: + configMap: hive + s3: + reference: minio +--- +# ... and the `iceberg` catalog the `inline` form. Both go through the same +# `ExtendCatalogConfig` implementation, so both must accept a connection without TLS. +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: iceberg + labels: + trino: trino +spec: + connector: + iceberg: + metastore: + configMap: hive # It's fine to reuse the existing HMS for tests. Not recommended for production though, there a dedicated HMS should be used. + s3: + inline: + host: minio + port: 9000 + accessStyle: Path + credentials: + secretClass: s3-credentials-class +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCatalog +metadata: + name: tpch + labels: + trino: trino +spec: + connector: + tpch: {} +--- +apiVersion: authentication.stackable.tech/v1alpha1 +kind: AuthenticationClass +metadata: + name: trino-users-auth +spec: + provider: + static: + userCredentialsSecret: + name: trino-users +--- +apiVersion: v1 +kind: Secret +metadata: + name: trino-users +type: kubernetes.io/opaque +stringData: + admin: admin +--- +apiVersion: trino.stackable.tech/v1alpha1 +kind: TrinoCluster +metadata: + name: trino +spec: + image: +{% if test_scenario['values']['trino-latest'].find(",") > 0 %} + custom: "{{ test_scenario['values']['trino-latest'].split(',')[1] }}" + productVersion: "{{ test_scenario['values']['trino-latest'].split(',')[0] }}" +{% else %} + productVersion: "{{ test_scenario['values']['trino-latest'] }}" +{% endif %} + pullPolicy: IfNotPresent + clusterConfig: + catalogLabelSelector: + matchLabels: + trino: trino + authentication: + - authenticationClass: trino-users-auth +{% if lookup('env', 'VECTOR_AGGREGATOR') %} + vectorAggregatorConfigMapName: vector-aggregator-discovery +{% endif %} + coordinators: + config: + logging: + enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }} + roleGroups: + default: + replicas: 1 + workers: + config: + gracefulShutdownTimeout: 5s # Let the test run faster + logging: + enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }} + roleGroups: + default: + replicas: 1 diff --git a/tests/templates/kuttl/s3-no-tls/05-assert.yaml b/tests/templates/kuttl/s3-no-tls/05-assert.yaml new file mode 100644 index 000000000..fa895b52c --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/05-assert.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestAssert +timeout: 120 +commands: + # Both catalogs must be configured with a plaintext endpoint. The backslashes are the Java + # properties escaping of `:` and are stripped before comparing. + - script: | + set -eu + for role in coordinator worker; do + for catalog in hive iceberg; do + endpoint=$(kubectl -n "$NAMESPACE" get configmap "trino-$role-default-catalog" \ + -o go-template="{{ index .data \"$catalog.properties\" }}" \ + | grep '^s3.endpoint=' | tr -d '\\') + if [ "$endpoint" != "s3.endpoint=http://minio:9000/" ]; then + echo "ERROR: trino-$role-default-catalog $catalog.properties has '$endpoint'" + exit 1 + fi + done + done diff --git a/tests/templates/kuttl/s3-no-tls/06-assert.yaml b/tests/templates/kuttl/s3-no-tls/06-assert.yaml new file mode 100644 index 000000000..4ebfbaa86 --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/06-assert.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestAssert +timeout: 300 +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: s3-no-tls-check +status: + succeeded: 1 diff --git a/tests/templates/kuttl/s3-no-tls/06-run-queries.yaml b/tests/templates/kuttl/s3-no-tls/06-run-queries.yaml new file mode 100644 index 000000000..d836c6ccd --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/06-run-queries.yaml @@ -0,0 +1,129 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: s3-no-tls-check-script +data: + check-s3-no-tls.py: | + #!/usr/bin/env python + # + # Writes and reads a table on an S3 endpoint without TLS, through the Hive and the + # Iceberg connector. + # + import argparse + import sys + + import trino + + if not sys.warnoptions: + import warnings + + warnings.simplefilter("ignore") + + + def get_connection(username, password, coordinator): + conn = trino.dbapi.connect( + host=coordinator, + port=8443, + user=username, + http_scheme="https", + auth=trino.auth.BasicAuthentication(username, password), + session_properties={"query_max_execution_time": "60s"}, + ) + conn._http_session.verify = False + return conn + + + def run_query(connection, query): + print(f"[DEBUG] Executing query {query}") + cursor = connection.cursor() + cursor.execute(query) + return cursor.fetchall() + + + if __name__ == "__main__": + all_args = argparse.ArgumentParser() + all_args.add_argument( + "-c", + "--coordinator", + required=True, + help="Trino Coordinator Host to connect to", + ) + all_args.add_argument( + "-b", "--bucket", required=True, help="The S3 bucket name to use" + ) + args = vars(all_args.parse_args()) + + coordinator = args["coordinator"] + bucket = args["bucket"] + + connection = get_connection("admin", "admin", coordinator) + + for catalog in ["hive", "iceberg"]: + print(f"[INFO] Testing the {catalog} connector against plaintext S3") + + run_query( + connection, + f"CREATE SCHEMA IF NOT EXISTS {catalog}.plain WITH (location = 's3a://{bucket}/{catalog}-plain/')", + ) + # Clean up leftovers from an earlier run so that the CTAS below is a real write. + run_query(connection, f"DROP TABLE IF EXISTS {catalog}.plain.nation") + + rows_written = run_query( + connection, + f"CREATE TABLE {catalog}.plain.nation AS SELECT * FROM tpch.tiny.nation", + )[0][0] + assert rows_written == 25, f"Expected 25 rows written, got {rows_written}" + + rows_read = run_query( + connection, f"SELECT COUNT(*) FROM {catalog}.plain.nation" + )[0][0] + assert rows_read == 25, f"Expected 25 rows, got {rows_read}" + + # A filtered read, because Iceberg can answer COUNT(*) from metadata alone and + # would not need to fetch the data files. + names = run_query( + connection, + f"SELECT name FROM {catalog}.plain.nation WHERE regionkey = 1 ORDER BY name", + ) + assert len(names) == 5, f"Expected 5 nations in region 1, got {names}" + + run_query(connection, f"DROP TABLE {catalog}.plain.nation") + + print("[SUCCESS] All tests in check-s3-no-tls.py succeeded!") +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: s3-no-tls-check +spec: + backoffLimit: 0 + template: + spec: + serviceAccountName: integration-tests-sa + restartPolicy: Never + containers: + - name: trino-test-helper + image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev + command: + - python + - /tmp/check-s3-no-tls.py + - -c + - trino-coordinator + - -b + - trino + resources: + requests: + cpu: "250m" + memory: "64Mi" + limits: + cpu: "500m" + memory: "64Mi" + volumeMounts: + - name: s3-no-tls-check-script + mountPath: /tmp/check-s3-no-tls.py + subPath: check-s3-no-tls.py + volumes: + - name: s3-no-tls-check-script + configMap: + name: s3-no-tls-check-script diff --git a/tests/templates/kuttl/s3-no-tls/helm-bitnami-minio-values.yaml.j2 b/tests/templates/kuttl/s3-no-tls/helm-bitnami-minio-values.yaml.j2 new file mode 100644 index 000000000..e01eb5715 --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/helm-bitnami-minio-values.yaml.j2 @@ -0,0 +1,65 @@ +--- +global: + security: + allowInsecureImages: true # needed starting with Chart version 14.9.0 if modifying images + +image: + repository: bitnamilegacy/minio +clientImage: + repository: bitnamilegacy/minio-client +defaultInitContainers: + volumePermissions: # volumePermissions moved under defaultInitContainers starting with Chart version 17.0.0 + enabled: false + image: + repository: bitnamilegacy/os-shell +console: + image: + repository: bitnamilegacy/minio-object-browser + +mode: standalone + +provisioning: + enabled: true + buckets: + - name: trino + resources: + requests: + memory: 1Gi + cpu: "512m" + limits: + memory: "1Gi" + cpu: "1" + podSecurityContext: + enabled: false + containerSecurityContext: + enabled: false + +# volumePermissions can be removed starting with Chart version 17.0.0, moved under defaultInitContainers +volumePermissions: + enabled: false + image: + repository: bitnamilegacy/os-shell + +podSecurityContext: + enabled: false + +containerSecurityContext: + enabled: false + +persistence: + enabled: false + +resources: + requests: + memory: 1Gi + cpu: "512m" + limits: + memory: "1Gi" + cpu: "1" + +auth: + existingSecret: minio-credentials + +# This is what the test is about: MinIO serves plaintext HTTP only. +tls: + enabled: false diff --git a/tests/templates/kuttl/s3-no-tls/helm-bitnami-postgresql-values.yaml.j2 b/tests/templates/kuttl/s3-no-tls/helm-bitnami-postgresql-values.yaml.j2 new file mode 100644 index 000000000..40dfcd339 --- /dev/null +++ b/tests/templates/kuttl/s3-no-tls/helm-bitnami-postgresql-values.yaml.j2 @@ -0,0 +1,42 @@ +--- +global: + security: + allowInsecureImages: true # needed starting with Chart version 16.3.0 if modifying images + +image: + repository: bitnamilegacy/postgresql + +volumePermissions: + enabled: false + image: + repository: bitnamilegacy/os-shell + securityContext: + runAsUser: auto + +metrics: + image: + repository: bitnamilegacy/postgres-exporter + +primary: + extendedConfiguration: | + password_encryption=md5 + podSecurityContext: +{% if test_scenario['values']['openshift'] == 'true' %} + enabled: false +{% else %} + enabled: true +{% endif %} + containerSecurityContext: + enabled: false + resources: + requests: + memory: "512Mi" + cpu: "512m" + limits: + memory: "512Mi" + cpu: "1" + +auth: + username: hive + password: hive + database: hive diff --git a/tests/test-definition.yaml b/tests/test-definition.yaml index c765a62d8..752f37d99 100644 --- a/tests/test-definition.yaml +++ b/tests/test-definition.yaml @@ -4,8 +4,7 @@ # However, the Bitnami chart for MinIO which cannot use self-signed TLS # certificates due to a bug in libminioclient.sh. # -# Therefore, testing S3 access with TLS on OpenShift is currently broken due to -# the Native S3 implementation in Trino requiring S3 connections to use TLS. +# Therefore, testing S3 access with TLS on OpenShift is currently broken. # # libminioclient.sh hard-codes localhost in the certificate: # https://github.com/bitnami/containers/blob/7b976016fb6e926c91881bc4d824dd9e1c8e045f/bitnami/minio/2025/debian-12/rootfs/opt/bitnami/scripts/libminioclient.sh#L108 @@ -136,6 +135,12 @@ tests: - trino-delta - hive-latest - openshift + - name: s3-no-tls + # Trino must accept an S3Connection without a `tls` section and talk plaintext HTTP to it. + dimensions: + - trino-latest + - hive-latest + - openshift suites: - name: nightly # Run with the latest product versions and tls true and false to cover different tls code paths. From 42dedeec2e5b27a64e3f9da62c85cc3d54ec8570 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Florian=20M=C3=BCller?= Date: Thu, 13 Aug 2026 11:57:00 +0200 Subject: [PATCH 2/3] chore: reuse delta test to exercise plain s3 connection --- .../templates/kuttl/delta/00-secrets.yaml.j2 | 5 + .../01-assert.yaml => delta/02-assert.yaml} | 8 ++ .../kuttl/delta/04-prepare-bucket.yaml.j2 | 3 +- tests/templates/kuttl/delta/11-assert.yaml.j2 | 23 ++++ .../delta/helm-bitnami-minio-values.yaml.j2 | 4 +- .../kuttl/s3-no-tls/00-assert.yaml.j2 | 10 -- ...tor-aggregator-discovery-configmap.yaml.j2 | 9 -- .../kuttl/s3-no-tls/00-limit-range.yaml | 11 -- .../kuttl/s3-no-tls/00-patch-ns.yaml.j2 | 9 -- .../templates/kuttl/s3-no-tls/00-rbac.yaml.j2 | 29 ---- .../kuttl/s3-no-tls/00-secrets.yaml.j2 | 38 ------ .../kuttl/s3-no-tls/01-install-minio.yaml.j2 | 11 -- .../templates/kuttl/s3-no-tls/02-assert.yaml | 12 -- .../kuttl/s3-no-tls/02-install-postgres.yaml | 12 -- .../templates/kuttl/s3-no-tls/03-assert.yaml | 12 -- .../kuttl/s3-no-tls/03-install-hive.yaml.j2 | 36 ----- .../templates/kuttl/s3-no-tls/04-assert.yaml | 22 --- .../kuttl/s3-no-tls/04-install-trino.yaml.j2 | 102 -------------- .../templates/kuttl/s3-no-tls/05-assert.yaml | 20 --- .../templates/kuttl/s3-no-tls/06-assert.yaml | 11 -- .../kuttl/s3-no-tls/06-run-queries.yaml | 129 ------------------ .../helm-bitnami-minio-values.yaml.j2 | 65 --------- .../helm-bitnami-postgresql-values.yaml.j2 | 42 ------ tests/test-definition.yaml | 15 +- 24 files changed, 49 insertions(+), 589 deletions(-) rename tests/templates/kuttl/{s3-no-tls/01-assert.yaml => delta/02-assert.yaml} (54%) create mode 100644 tests/templates/kuttl/delta/11-assert.yaml.j2 delete mode 100644 tests/templates/kuttl/s3-no-tls/00-assert.yaml.j2 delete mode 100644 tests/templates/kuttl/s3-no-tls/00-install-vector-aggregator-discovery-configmap.yaml.j2 delete mode 100644 tests/templates/kuttl/s3-no-tls/00-limit-range.yaml delete mode 100644 tests/templates/kuttl/s3-no-tls/00-patch-ns.yaml.j2 delete mode 100644 tests/templates/kuttl/s3-no-tls/00-rbac.yaml.j2 delete mode 100644 tests/templates/kuttl/s3-no-tls/00-secrets.yaml.j2 delete mode 100644 tests/templates/kuttl/s3-no-tls/01-install-minio.yaml.j2 delete mode 100644 tests/templates/kuttl/s3-no-tls/02-assert.yaml delete mode 100644 tests/templates/kuttl/s3-no-tls/02-install-postgres.yaml delete mode 100644 tests/templates/kuttl/s3-no-tls/03-assert.yaml delete mode 100644 tests/templates/kuttl/s3-no-tls/03-install-hive.yaml.j2 delete mode 100644 tests/templates/kuttl/s3-no-tls/04-assert.yaml delete mode 100644 tests/templates/kuttl/s3-no-tls/04-install-trino.yaml.j2 delete mode 100644 tests/templates/kuttl/s3-no-tls/05-assert.yaml delete mode 100644 tests/templates/kuttl/s3-no-tls/06-assert.yaml delete mode 100644 tests/templates/kuttl/s3-no-tls/06-run-queries.yaml delete mode 100644 tests/templates/kuttl/s3-no-tls/helm-bitnami-minio-values.yaml.j2 delete mode 100644 tests/templates/kuttl/s3-no-tls/helm-bitnami-postgresql-values.yaml.j2 diff --git a/tests/templates/kuttl/delta/00-secrets.yaml.j2 b/tests/templates/kuttl/delta/00-secrets.yaml.j2 index 72fe2f493..72e921b86 100644 --- a/tests/templates/kuttl/delta/00-secrets.yaml.j2 +++ b/tests/templates/kuttl/delta/00-secrets.yaml.j2 @@ -60,6 +60,9 @@ data: tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUR5RENDQXJDZ0F3SUJBZ0lVQ0kyUE5OcnR6cDZRbDdHa3VhRnhtRGE2VUJvd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2V6RUxNQWtHQTFVRUJoTUNSRVV4R3pBWkJnTlZCQWdNRWxOamFHeGxjM2RwWnkxSWIyeHpkR1ZwYmpFTwpNQXdHQTFVRUJ3d0ZWMlZrWld3eEtEQW1CZ05WQkFvTUgxTjBZV05yWVdKc1pTQlRhV2R1YVc1bklFRjFkR2h2CmNtbDBlU0JKYm1NeEZUQVRCZ05WQkFNTURITjBZV05yWVdKc1pTNWtaVEFnRncweU16QTJNVFl4TWpVeE1ESmEKR0E4eU1USXpNRFV5TXpFeU5URXdNbG93WGpFTE1Ba0dBMVVFQmhNQ1JFVXhHekFaQmdOVkJBZ01FbE5qYUd4bApjM2RwWnkxSWIyeHpkR1ZwYmpFT01Bd0dBMVVFQnd3RlYyVmtaV3d4RWpBUUJnTlZCQW9NQ1ZOMFlXTnJZV0pzClpURU9NQXdHQTFVRUF3d0ZiV2x1YVc4d2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUIKQVFDanluVnorWEhCOE9DWTRwc0VFWW1qb2JwZHpUbG93d2NTUU4rWURQQ2tCZW9yMFRiODdFZ0x6SksrSllidQpwb1hCbE5JSlBRYW93SkVvL1N6U2s4ZnUyWFNNeXZBWlk0RldHeEp5Mnl4SXh2UC9pYk9HT1l1aVBHWEsyNHQ2ClpjR1RVVmhhdWlaR1Nna1dyZWpXV2g3TWpGUytjMXZhWVpxQitRMXpQczVQRk1sYzhsNVYvK2I4WjdqTUppODQKbU9mSVB4amt2SXlKcjVVa2VGM1VmTHFKUzV5NExGNHR5NEZ0MmlBZDdiYmZIYW5mdlltdjZVb0RWdE1YdFdvMQpvUVBmdjNzaFdybVJMenc2ZXVJQXRiWGM1Q2pCeUlha0NiaURuQVU4cktnK0IxSjRtdlFnckx3bzNxUHJ5Smd4ClNkaWRtWjJtRVI3RXorYzVCMG0vTGlJaEFnTUJBQUdqWHpCZE1Cc0dBMVVkRVFRVU1CS0NCVzFwYm1sdmdnbHMKYjJOaGJHaHZjM1F3SFFZRFZSME9CQllFRkpRMGdENWtFdFFyK3REcERTWjdrd1o4SDVoR01COEdBMVVkSXdRWQpNQmFBRkVJM1JNTWl5aUJqeVExUlM4bmxPUkpWZDFwQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQmNkaGQrClI0Sm9HdnFMQms1OWRxSVVlY2N0dUZzcmRQeHNCaU9GaFlOZ1pxZWRMTTBVTDVEenlmQUhmVk8wTGZTRURkZFgKUkpMOXlMNytrTVUwVDc2Y3ZkQzlYVkFJRTZIVXdUbzlHWXNQcXN1eVpvVmpOcEVESkN3WTNDdm9ubEpWZTRkcQovZ0FiSk1ZQitUU21ZNXlEUHovSkZZL1haellhUGI3T2RlR3VqYlZUNUl4cDk3QXBTOFlJaXY3M0Mwd1ViYzZSCmgwcmNmUmJ5a1NRVWg5dmdWZFhSU1I4RFQzV0NmZHFOek5CWVh2OW1xZlc1ejRzYkdqK2wzd1VsL0kzRi9tSXcKZnlPNEN0aTRha2lHVkhsZmZFeTB3a3pWYUJ4aGNYajJJM0JVVGhCNFpxamxzc2llVmFGa3d2WG1teVJUMG9FVwo1SCtOUEhjcXVTMXpQc2NsCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ2p5blZ6K1hIQjhPQ1kKNHBzRUVZbWpvYnBkelRsb3d3Y1NRTitZRFBDa0Jlb3IwVGI4N0VnTHpKSytKWWJ1cG9YQmxOSUpQUWFvd0pFbwovU3pTazhmdTJYU015dkFaWTRGV0d4SnkyeXhJeHZQL2liT0dPWXVpUEdYSzI0dDZaY0dUVVZoYXVpWkdTZ2tXCnJlaldXaDdNakZTK2MxdmFZWnFCK1ExelBzNVBGTWxjOGw1Vi8rYjhaN2pNSmk4NG1PZklQeGprdkl5SnI1VWsKZUYzVWZMcUpTNXk0TEY0dHk0RnQyaUFkN2JiZkhhbmZ2WW12NlVvRFZ0TVh0V28xb1FQZnYzc2hXcm1STHp3NgpldUlBdGJYYzVDakJ5SWFrQ2JpRG5BVThyS2crQjFKNG12UWdyTHdvM3FQcnlKZ3hTZGlkbVoybUVSN0V6K2M1CkIwbS9MaUloQWdNQkFBRUNnZ0VBQWQzdDVzdUNFMjdXY0llc3NxZ3NoSFAwZHRzKyswVzF6K3h6WC8xTnhPRFkKWVhWNkJmbi9mRHJ4dFQ4aVFaZ2VVQzJORTFQaHZveXJXdWMvMm9xYXJjdEd1OUFZV29HNjJLdG9VMnpTSFdZLwpJN3VERTFXV2xOdlJZVFdOYW5DOGV4eGpRRzE4d0RKWjFpdFhTeEl0NWJEM3lrL3dUUlh0dCt1SnpyVjVqb2N1CmNoeERMd293aXUxQWo2ZFJDWk5CejlUSnh5TnI1ME5ZVzJVWEJhVC84N1hyRkZkSndNVFZUMEI3SE9uRzdSQlYKUWxLdzhtcVZiYU5lbmhjdk1qUjI5c3hUekhSK2p4SU8zQndPNk9Hai9PRmhGQllVN1RMWGVsZDFxb2UwdmIyRwpiOGhQcEd1cHRyNUF0OWx3MXc1d1EzSWdpdXRQTkg1cXlEeUNwRWw2RVFLQmdRRGNkYnNsT2ZLSmo3TzJMQXlZCkZ0a1RwaWxFMFYzajBxbVE5M0lqclY0K0RSbUxNRUIyOTk0MDdCVVlRUWoxL0RJYlFjb1oyRUVjVUI1cGRlSHMKN0RNRUQ2WExIYjJKVTEyK2E3c1d5Q05kS2VjZStUNy9JYmxJOFR0MzQwVWxIUTZ6U01TRGNqdmZjRkhWZ3YwcwpDYWpoRng3TmtMRVhUWnI4ZlQzWUloajR2UUtCZ1FDK01nWjFVbW9KdzlJQVFqMnVJVTVDeTl4aldlWURUQU8vCllhWEl6d2xnZTQzOE1jYmI0Y04yU2FOU0dEZ1Y3bnU1a3FpaWhwalBZV0lpaU9CcDlrVFJIWE9kUFc0N3N5ZUkKdDNrd3JwMnpWbFVnbGNNWlo2bW1WM1FWYUFOWmdqVTRSU3Y0ZS9WeFVMamJaYWZqUHRaUnNqWkdwSzBZVTFvdApWajhJZVE3Zk5RS0JnQ1ArWk11ekpsSW5VQ1FTRlF4UHpxbFNtN0pNckpPaHRXV2h3TlRxWFZTc050dHV5VmVqCktIaGpneDR1b0JQcFZSVDJMTlVEWmI0RnByRjVPYVhBK3FOVEdyS0s3SU1iUlZidHArSVVVeEhHNGFGQStIUVgKUVhVVFRhNUpRT1RLVmJnWHpWM1lyTVhTUk1valZNcDMyVWJHeTVTc1p2MXpBamJ2QzhYWjYxSFJBb0dBZEJjUQp2aGU1eFpBUzVEbUtjSGkvemlHa3ViZXJuNk9NUGdxYUtJSEdsVytVOExScFR0ajBkNFRtL1Rydk1PUEovVEU1CllVcUtoenBIcmhDaCtjdHBvY0k2U1dXdm5SenpLbzNpbVFaY0Y1VEFqUTBjY3F0RmI5UzlkRHR5bi9YTUNqYWUKYWlNdll5VUVVRll5TFpDelBGWnNycDNoVVpHKzN5RmZoQXB3TzJrQ2dZQkh3WWFQSWRXNld3NytCMmhpbjBvdwpqYTNjZXN2QTRqYU1Qd1NMVDhPTnRVMUdCU01md2N6TWJuUEhMclJ2Qjg3bjlnUGFSMndRR1VtckZFTzNMUFgvCmtSY09HcFlCSHBEWEVqRGhLa1dkUnVMT0ZnNEhMWmRWOEFOWmxRMFZTY0U4dTNkRERVTzg5cEdEbjA4cVRBcmwKeDlreHN1ZEVWcmtlclpiNVV4RlZxUT09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K --- +# With `s3-use-tls` set to false this connection has no `tls` section, so Trino must talk +# plaintext HTTP to MinIO, which is then installed without TLS as well. The resulting +# `s3.endpoint` is asserted in 11-assert.yaml. apiVersion: s3.stackable.tech/v1alpha1 kind: S3Connection metadata: @@ -70,8 +73,10 @@ spec: accessStyle: Path credentials: secretClass: s3-credentials-class +{% if test_scenario['values']['s3-use-tls'] == 'true' %} tls: verification: server: caCert: secretClass: minio-tls-certificates +{% endif %} diff --git a/tests/templates/kuttl/s3-no-tls/01-assert.yaml b/tests/templates/kuttl/delta/02-assert.yaml similarity index 54% rename from tests/templates/kuttl/s3-no-tls/01-assert.yaml rename to tests/templates/kuttl/delta/02-assert.yaml index 4d24ed7db..92cff570c 100644 --- a/tests/templates/kuttl/s3-no-tls/01-assert.yaml +++ b/tests/templates/kuttl/delta/02-assert.yaml @@ -15,3 +15,11 @@ apiVersion: v1 kind: Service metadata: name: minio +--- +# The provisioning Job creates the `trino` bucket that 04-prepare-bucket.yaml.j2 uploads into. +apiVersion: batch/v1 +kind: Job +metadata: + name: minio-provisioning +status: + succeeded: 1 diff --git a/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 b/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 index ff7126800..b20e843e7 100644 --- a/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 +++ b/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 @@ -2,8 +2,7 @@ apiVersion: kuttl.dev/v1beta1 kind: TestStep commands: - # give minio enough time to start - - command: sleep 5 + # MinIO and its bucket provisioning Job are awaited in 02-assert.yaml. - script: | POD=$(kubectl -n $NAMESPACE get pod -l app.kubernetes.io/instance=minio -o name | head -n1 | sed 's#pod/##') kubectl -n $NAMESPACE cp delta-table "$POD:/tmp/delta-table" diff --git a/tests/templates/kuttl/delta/11-assert.yaml.j2 b/tests/templates/kuttl/delta/11-assert.yaml.j2 new file mode 100644 index 000000000..839fa3553 --- /dev/null +++ b/tests/templates/kuttl/delta/11-assert.yaml.j2 @@ -0,0 +1,23 @@ +{% if test_scenario['values']['s3-use-tls'] == 'true' %} +{% set scheme = 'https' %} +{% else %} +{% set scheme = 'http' %} +{% endif %} +--- +apiVersion: kuttl.dev/v1beta1 +kind: TestAssert +timeout: 120 +commands: + # The catalog must be configured with a {{ scheme }} endpoint. The backslashes are the Java + # properties escaping of `:` and are stripped before comparing. + - script: | + set -eu + for role in coordinator worker; do + endpoint=$(kubectl -n "$NAMESPACE" get configmap "trino-$role-default-catalog" \ + -o go-template='{{ '{{' }} index .data "delta.properties" {{ '}}' }}' \ + | grep '^s3.endpoint=' | tr -d '\\') + if [ "$endpoint" != "s3.endpoint={{ scheme }}://minio:9000/" ]; then + echo "ERROR: trino-$role-default-catalog delta.properties has '$endpoint'" + exit 1 + fi + done diff --git a/tests/templates/kuttl/delta/helm-bitnami-minio-values.yaml.j2 b/tests/templates/kuttl/delta/helm-bitnami-minio-values.yaml.j2 index 3436e86b3..c5d371d40 100644 --- a/tests/templates/kuttl/delta/helm-bitnami-minio-values.yaml.j2 +++ b/tests/templates/kuttl/delta/helm-bitnami-minio-values.yaml.j2 @@ -72,5 +72,7 @@ service: type: NodePort tls: - enabled: true + enabled: {{ test_scenario['values']['s3-use-tls'] }} +{% if test_scenario['values']['s3-use-tls'] == 'true' %} existingSecret: minio-tls-certificates +{% endif %} diff --git a/tests/templates/kuttl/s3-no-tls/00-assert.yaml.j2 b/tests/templates/kuttl/s3-no-tls/00-assert.yaml.j2 deleted file mode 100644 index 50b1d4c3d..000000000 --- a/tests/templates/kuttl/s3-no-tls/00-assert.yaml.j2 +++ /dev/null @@ -1,10 +0,0 @@ ---- -apiVersion: kuttl.dev/v1beta1 -kind: TestAssert -{% if lookup('env', 'VECTOR_AGGREGATOR') %} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: vector-aggregator-discovery -{% endif %} diff --git a/tests/templates/kuttl/s3-no-tls/00-install-vector-aggregator-discovery-configmap.yaml.j2 b/tests/templates/kuttl/s3-no-tls/00-install-vector-aggregator-discovery-configmap.yaml.j2 deleted file mode 100644 index 2d6a0df5f..000000000 --- a/tests/templates/kuttl/s3-no-tls/00-install-vector-aggregator-discovery-configmap.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ -{% if lookup('env', 'VECTOR_AGGREGATOR') %} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: vector-aggregator-discovery -data: - ADDRESS: {{ lookup('env', 'VECTOR_AGGREGATOR') }} -{% endif %} diff --git a/tests/templates/kuttl/s3-no-tls/00-limit-range.yaml b/tests/templates/kuttl/s3-no-tls/00-limit-range.yaml deleted file mode 100644 index 8fd022107..000000000 --- a/tests/templates/kuttl/s3-no-tls/00-limit-range.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -apiVersion: v1 -kind: LimitRange -metadata: - name: limit-request-ratio -spec: - limits: - - type: "Container" - maxLimitRequestRatio: - cpu: 5 - memory: 1 diff --git a/tests/templates/kuttl/s3-no-tls/00-patch-ns.yaml.j2 b/tests/templates/kuttl/s3-no-tls/00-patch-ns.yaml.j2 deleted file mode 100644 index 67185acfd..000000000 --- a/tests/templates/kuttl/s3-no-tls/00-patch-ns.yaml.j2 +++ /dev/null @@ -1,9 +0,0 @@ -{% if test_scenario['values']['openshift'] == 'true' %} -# see https://github.com/stackabletech/issues/issues/566 ---- -apiVersion: kuttl.dev/v1beta1 -kind: TestStep -commands: - - script: kubectl patch namespace $NAMESPACE -p '{"metadata":{"labels":{"pod-security.kubernetes.io/enforce":"privileged"}}}' - timeout: 120 -{% endif %} diff --git a/tests/templates/kuttl/s3-no-tls/00-rbac.yaml.j2 b/tests/templates/kuttl/s3-no-tls/00-rbac.yaml.j2 deleted file mode 100644 index 9cbf03511..000000000 --- a/tests/templates/kuttl/s3-no-tls/00-rbac.yaml.j2 +++ /dev/null @@ -1,29 +0,0 @@ ---- -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: use-integration-tests-scc -rules: -{% if test_scenario['values']['openshift'] == "true" %} - - apiGroups: ["security.openshift.io"] - resources: ["securitycontextconstraints"] - resourceNames: ["privileged"] - verbs: ["use"] -{% endif %} ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: integration-tests-sa ---- -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: use-integration-tests-scc -subjects: - - kind: ServiceAccount - name: integration-tests-sa -roleRef: - kind: Role - name: use-integration-tests-scc - apiGroup: rbac.authorization.k8s.io diff --git a/tests/templates/kuttl/s3-no-tls/00-secrets.yaml.j2 b/tests/templates/kuttl/s3-no-tls/00-secrets.yaml.j2 deleted file mode 100644 index cd71e30b9..000000000 --- a/tests/templates/kuttl/s3-no-tls/00-secrets.yaml.j2 +++ /dev/null @@ -1,38 +0,0 @@ ---- -apiVersion: v1 -kind: Secret -metadata: - name: minio-credentials - labels: - secrets.stackable.tech/class: s3-credentials-class -timeout: 240 -stringData: - accessKey: minioAccessKey - secretKey: minioSecretKey - # The following two entries are used by the Bitnami chart for MinIO to - # set up credentials for accessing buckets managed by the MinIO tenant. - root-user: minioAccessKey - root-password: minioSecretKey ---- -apiVersion: secrets.stackable.tech/v1alpha1 -kind: SecretClass -metadata: - name: s3-credentials-class -spec: - backend: - k8sSearch: - searchNamespace: - pod: {} ---- -# This connection has no `tls` section, so Trino must talk plaintext HTTP to MinIO, which is -# installed without TLS in helm-bitnami-minio-values.yaml. -apiVersion: s3.stackable.tech/v1alpha1 -kind: S3Connection -metadata: - name: minio -spec: - host: minio - port: 9000 - accessStyle: Path - credentials: - secretClass: s3-credentials-class diff --git a/tests/templates/kuttl/s3-no-tls/01-install-minio.yaml.j2 b/tests/templates/kuttl/s3-no-tls/01-install-minio.yaml.j2 deleted file mode 100644 index 0be8b7a3a..000000000 --- a/tests/templates/kuttl/s3-no-tls/01-install-minio.yaml.j2 +++ /dev/null @@ -1,11 +0,0 @@ ---- -apiVersion: kuttl.dev/v1beta1 -kind: TestStep -commands: - - script: >- - helm install minio - --namespace $NAMESPACE - --version 12.6.4 - -f helm-bitnami-minio-values.yaml - --repo https://charts.bitnami.com/bitnami minio - timeout: 240 diff --git a/tests/templates/kuttl/s3-no-tls/02-assert.yaml b/tests/templates/kuttl/s3-no-tls/02-assert.yaml deleted file mode 100644 index 1ac124233..000000000 --- a/tests/templates/kuttl/s3-no-tls/02-assert.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: kuttl.dev/v1beta1 -kind: TestAssert -timeout: 600 ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: postgresql -status: - readyReplicas: 1 - replicas: 1 diff --git a/tests/templates/kuttl/s3-no-tls/02-install-postgres.yaml b/tests/templates/kuttl/s3-no-tls/02-install-postgres.yaml deleted file mode 100644 index 93c93a16f..000000000 --- a/tests/templates/kuttl/s3-no-tls/02-install-postgres.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: kuttl.dev/v1beta1 -kind: TestStep -timeout: 300 -commands: - - script: >- - helm upgrade postgresql - --install - --version=12.5.6 - --namespace $NAMESPACE - -f helm-bitnami-postgresql-values.yaml - --repo https://charts.bitnami.com/bitnami postgresql diff --git a/tests/templates/kuttl/s3-no-tls/03-assert.yaml b/tests/templates/kuttl/s3-no-tls/03-assert.yaml deleted file mode 100644 index 50c27fd93..000000000 --- a/tests/templates/kuttl/s3-no-tls/03-assert.yaml +++ /dev/null @@ -1,12 +0,0 @@ ---- -apiVersion: kuttl.dev/v1beta1 -kind: TestAssert -timeout: 900 ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: hive-metastore-default -status: - readyReplicas: 1 - replicas: 1 diff --git a/tests/templates/kuttl/s3-no-tls/03-install-hive.yaml.j2 b/tests/templates/kuttl/s3-no-tls/03-install-hive.yaml.j2 deleted file mode 100644 index d145f8006..000000000 --- a/tests/templates/kuttl/s3-no-tls/03-install-hive.yaml.j2 +++ /dev/null @@ -1,36 +0,0 @@ ---- -apiVersion: hive.stackable.tech/v1alpha1 -kind: HiveCluster -metadata: - name: hive -spec: - image: - productVersion: "{{ test_scenario['values']['hive-latest'] }}" - pullPolicy: IfNotPresent - clusterConfig: - metadataDatabase: - postgresql: - host: postgresql - database: hive - credentialsSecretName: postgres-credentials - s3: - reference: minio -{% if lookup('env', 'VECTOR_AGGREGATOR') %} - vectorAggregatorConfigMapName: vector-aggregator-discovery -{% endif %} - metastore: - config: - logging: - enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }} - roleGroups: - default: - replicas: 1 ---- -apiVersion: v1 -kind: Secret -metadata: - name: postgres-credentials -type: Opaque -stringData: - username: hive - password: hive diff --git a/tests/templates/kuttl/s3-no-tls/04-assert.yaml b/tests/templates/kuttl/s3-no-tls/04-assert.yaml deleted file mode 100644 index dbfd93658..000000000 --- a/tests/templates/kuttl/s3-no-tls/04-assert.yaml +++ /dev/null @@ -1,22 +0,0 @@ ---- -apiVersion: kuttl.dev/v1beta1 -kind: TestAssert -timeout: 720 -commands: - - script: kubectl -n $NAMESPACE wait --for=condition=available=true trinoclusters.trino.stackable.tech/trino --timeout 301s ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: trino-coordinator-default -status: - readyReplicas: 1 - replicas: 1 ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: trino-worker-default -status: - readyReplicas: 1 - replicas: 1 diff --git a/tests/templates/kuttl/s3-no-tls/04-install-trino.yaml.j2 b/tests/templates/kuttl/s3-no-tls/04-install-trino.yaml.j2 deleted file mode 100644 index 5a9e76d79..000000000 --- a/tests/templates/kuttl/s3-no-tls/04-install-trino.yaml.j2 +++ /dev/null @@ -1,102 +0,0 @@ ---- -# The `hive` catalog uses the `reference` form of the S3 connection, ... -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: hive - labels: - trino: trino -spec: - connector: - hive: - metastore: - configMap: hive - s3: - reference: minio ---- -# ... and the `iceberg` catalog the `inline` form. Both go through the same -# `ExtendCatalogConfig` implementation, so both must accept a connection without TLS. -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: iceberg - labels: - trino: trino -spec: - connector: - iceberg: - metastore: - configMap: hive # It's fine to reuse the existing HMS for tests. Not recommended for production though, there a dedicated HMS should be used. - s3: - inline: - host: minio - port: 9000 - accessStyle: Path - credentials: - secretClass: s3-credentials-class ---- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCatalog -metadata: - name: tpch - labels: - trino: trino -spec: - connector: - tpch: {} ---- -apiVersion: authentication.stackable.tech/v1alpha1 -kind: AuthenticationClass -metadata: - name: trino-users-auth -spec: - provider: - static: - userCredentialsSecret: - name: trino-users ---- -apiVersion: v1 -kind: Secret -metadata: - name: trino-users -type: kubernetes.io/opaque -stringData: - admin: admin ---- -apiVersion: trino.stackable.tech/v1alpha1 -kind: TrinoCluster -metadata: - name: trino -spec: - image: -{% if test_scenario['values']['trino-latest'].find(",") > 0 %} - custom: "{{ test_scenario['values']['trino-latest'].split(',')[1] }}" - productVersion: "{{ test_scenario['values']['trino-latest'].split(',')[0] }}" -{% else %} - productVersion: "{{ test_scenario['values']['trino-latest'] }}" -{% endif %} - pullPolicy: IfNotPresent - clusterConfig: - catalogLabelSelector: - matchLabels: - trino: trino - authentication: - - authenticationClass: trino-users-auth -{% if lookup('env', 'VECTOR_AGGREGATOR') %} - vectorAggregatorConfigMapName: vector-aggregator-discovery -{% endif %} - coordinators: - config: - logging: - enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }} - roleGroups: - default: - replicas: 1 - workers: - config: - gracefulShutdownTimeout: 5s # Let the test run faster - logging: - enableVectorAgent: {{ lookup('env', 'VECTOR_AGGREGATOR') | length > 0 }} - roleGroups: - default: - replicas: 1 diff --git a/tests/templates/kuttl/s3-no-tls/05-assert.yaml b/tests/templates/kuttl/s3-no-tls/05-assert.yaml deleted file mode 100644 index fa895b52c..000000000 --- a/tests/templates/kuttl/s3-no-tls/05-assert.yaml +++ /dev/null @@ -1,20 +0,0 @@ ---- -apiVersion: kuttl.dev/v1beta1 -kind: TestAssert -timeout: 120 -commands: - # Both catalogs must be configured with a plaintext endpoint. The backslashes are the Java - # properties escaping of `:` and are stripped before comparing. - - script: | - set -eu - for role in coordinator worker; do - for catalog in hive iceberg; do - endpoint=$(kubectl -n "$NAMESPACE" get configmap "trino-$role-default-catalog" \ - -o go-template="{{ index .data \"$catalog.properties\" }}" \ - | grep '^s3.endpoint=' | tr -d '\\') - if [ "$endpoint" != "s3.endpoint=http://minio:9000/" ]; then - echo "ERROR: trino-$role-default-catalog $catalog.properties has '$endpoint'" - exit 1 - fi - done - done diff --git a/tests/templates/kuttl/s3-no-tls/06-assert.yaml b/tests/templates/kuttl/s3-no-tls/06-assert.yaml deleted file mode 100644 index 4ebfbaa86..000000000 --- a/tests/templates/kuttl/s3-no-tls/06-assert.yaml +++ /dev/null @@ -1,11 +0,0 @@ ---- -apiVersion: kuttl.dev/v1beta1 -kind: TestAssert -timeout: 300 ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: s3-no-tls-check -status: - succeeded: 1 diff --git a/tests/templates/kuttl/s3-no-tls/06-run-queries.yaml b/tests/templates/kuttl/s3-no-tls/06-run-queries.yaml deleted file mode 100644 index d836c6ccd..000000000 --- a/tests/templates/kuttl/s3-no-tls/06-run-queries.yaml +++ /dev/null @@ -1,129 +0,0 @@ ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: s3-no-tls-check-script -data: - check-s3-no-tls.py: | - #!/usr/bin/env python - # - # Writes and reads a table on an S3 endpoint without TLS, through the Hive and the - # Iceberg connector. - # - import argparse - import sys - - import trino - - if not sys.warnoptions: - import warnings - - warnings.simplefilter("ignore") - - - def get_connection(username, password, coordinator): - conn = trino.dbapi.connect( - host=coordinator, - port=8443, - user=username, - http_scheme="https", - auth=trino.auth.BasicAuthentication(username, password), - session_properties={"query_max_execution_time": "60s"}, - ) - conn._http_session.verify = False - return conn - - - def run_query(connection, query): - print(f"[DEBUG] Executing query {query}") - cursor = connection.cursor() - cursor.execute(query) - return cursor.fetchall() - - - if __name__ == "__main__": - all_args = argparse.ArgumentParser() - all_args.add_argument( - "-c", - "--coordinator", - required=True, - help="Trino Coordinator Host to connect to", - ) - all_args.add_argument( - "-b", "--bucket", required=True, help="The S3 bucket name to use" - ) - args = vars(all_args.parse_args()) - - coordinator = args["coordinator"] - bucket = args["bucket"] - - connection = get_connection("admin", "admin", coordinator) - - for catalog in ["hive", "iceberg"]: - print(f"[INFO] Testing the {catalog} connector against plaintext S3") - - run_query( - connection, - f"CREATE SCHEMA IF NOT EXISTS {catalog}.plain WITH (location = 's3a://{bucket}/{catalog}-plain/')", - ) - # Clean up leftovers from an earlier run so that the CTAS below is a real write. - run_query(connection, f"DROP TABLE IF EXISTS {catalog}.plain.nation") - - rows_written = run_query( - connection, - f"CREATE TABLE {catalog}.plain.nation AS SELECT * FROM tpch.tiny.nation", - )[0][0] - assert rows_written == 25, f"Expected 25 rows written, got {rows_written}" - - rows_read = run_query( - connection, f"SELECT COUNT(*) FROM {catalog}.plain.nation" - )[0][0] - assert rows_read == 25, f"Expected 25 rows, got {rows_read}" - - # A filtered read, because Iceberg can answer COUNT(*) from metadata alone and - # would not need to fetch the data files. - names = run_query( - connection, - f"SELECT name FROM {catalog}.plain.nation WHERE regionkey = 1 ORDER BY name", - ) - assert len(names) == 5, f"Expected 5 nations in region 1, got {names}" - - run_query(connection, f"DROP TABLE {catalog}.plain.nation") - - print("[SUCCESS] All tests in check-s3-no-tls.py succeeded!") ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: s3-no-tls-check -spec: - backoffLimit: 0 - template: - spec: - serviceAccountName: integration-tests-sa - restartPolicy: Never - containers: - - name: trino-test-helper - image: oci.stackable.tech/sdp/testing-tools:0.2.0-stackable0.0.0-dev - command: - - python - - /tmp/check-s3-no-tls.py - - -c - - trino-coordinator - - -b - - trino - resources: - requests: - cpu: "250m" - memory: "64Mi" - limits: - cpu: "500m" - memory: "64Mi" - volumeMounts: - - name: s3-no-tls-check-script - mountPath: /tmp/check-s3-no-tls.py - subPath: check-s3-no-tls.py - volumes: - - name: s3-no-tls-check-script - configMap: - name: s3-no-tls-check-script diff --git a/tests/templates/kuttl/s3-no-tls/helm-bitnami-minio-values.yaml.j2 b/tests/templates/kuttl/s3-no-tls/helm-bitnami-minio-values.yaml.j2 deleted file mode 100644 index e01eb5715..000000000 --- a/tests/templates/kuttl/s3-no-tls/helm-bitnami-minio-values.yaml.j2 +++ /dev/null @@ -1,65 +0,0 @@ ---- -global: - security: - allowInsecureImages: true # needed starting with Chart version 14.9.0 if modifying images - -image: - repository: bitnamilegacy/minio -clientImage: - repository: bitnamilegacy/minio-client -defaultInitContainers: - volumePermissions: # volumePermissions moved under defaultInitContainers starting with Chart version 17.0.0 - enabled: false - image: - repository: bitnamilegacy/os-shell -console: - image: - repository: bitnamilegacy/minio-object-browser - -mode: standalone - -provisioning: - enabled: true - buckets: - - name: trino - resources: - requests: - memory: 1Gi - cpu: "512m" - limits: - memory: "1Gi" - cpu: "1" - podSecurityContext: - enabled: false - containerSecurityContext: - enabled: false - -# volumePermissions can be removed starting with Chart version 17.0.0, moved under defaultInitContainers -volumePermissions: - enabled: false - image: - repository: bitnamilegacy/os-shell - -podSecurityContext: - enabled: false - -containerSecurityContext: - enabled: false - -persistence: - enabled: false - -resources: - requests: - memory: 1Gi - cpu: "512m" - limits: - memory: "1Gi" - cpu: "1" - -auth: - existingSecret: minio-credentials - -# This is what the test is about: MinIO serves plaintext HTTP only. -tls: - enabled: false diff --git a/tests/templates/kuttl/s3-no-tls/helm-bitnami-postgresql-values.yaml.j2 b/tests/templates/kuttl/s3-no-tls/helm-bitnami-postgresql-values.yaml.j2 deleted file mode 100644 index 40dfcd339..000000000 --- a/tests/templates/kuttl/s3-no-tls/helm-bitnami-postgresql-values.yaml.j2 +++ /dev/null @@ -1,42 +0,0 @@ ---- -global: - security: - allowInsecureImages: true # needed starting with Chart version 16.3.0 if modifying images - -image: - repository: bitnamilegacy/postgresql - -volumePermissions: - enabled: false - image: - repository: bitnamilegacy/os-shell - securityContext: - runAsUser: auto - -metrics: - image: - repository: bitnamilegacy/postgres-exporter - -primary: - extendedConfiguration: | - password_encryption=md5 - podSecurityContext: -{% if test_scenario['values']['openshift'] == 'true' %} - enabled: false -{% else %} - enabled: true -{% endif %} - containerSecurityContext: - enabled: false - resources: - requests: - memory: "512Mi" - cpu: "512m" - limits: - memory: "512Mi" - cpu: "1" - -auth: - username: hive - password: hive - database: hive diff --git a/tests/test-definition.yaml b/tests/test-definition.yaml index 752f37d99..397ffd4c4 100644 --- a/tests/test-definition.yaml +++ b/tests/test-definition.yaml @@ -59,6 +59,12 @@ dimensions: values: - "true" - "false" + # Whether the S3Connection used by the `delta` test carries a `tls` section, and MinIO is + # installed with TLS. With "false" Trino talks plaintext HTTP to S3. + - name: s3-use-tls + values: + - "true" + - "false" - name: use-internal-tls values: - "true" @@ -131,15 +137,12 @@ tests: - name: delta # NOTE: this test only works because we set `parquet.use-column-index=false` in the delta catalog # to work around this bug: https://github.com/trinodb/trino/issues/28885 + # + # This is also where plaintext (non-TLS) S3 access is covered, via the `s3-use-tls` dimension. dimensions: - trino-delta - hive-latest - - openshift - - name: s3-no-tls - # Trino must accept an S3Connection without a `tls` section and talk plaintext HTTP to it. - dimensions: - - trino-latest - - hive-latest + - s3-use-tls - openshift suites: - name: nightly From 9079fe754482994ee5a508cc485b41b6433fb722 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Florian=20M=C3=BCller?= Date: Thu, 13 Aug 2026 13:42:20 +0200 Subject: [PATCH 3/3] chore: remove unnecessary assert file and make test definitions more explicit --- .../templates/kuttl/delta/00-secrets.yaml.j2 | 3 +-- .../kuttl/delta/04-prepare-bucket.yaml.j2 | 1 - tests/templates/kuttl/delta/11-assert.yaml.j2 | 23 ------------------- tests/test-definition.yaml | 9 ++++---- 4 files changed, 5 insertions(+), 31 deletions(-) delete mode 100644 tests/templates/kuttl/delta/11-assert.yaml.j2 diff --git a/tests/templates/kuttl/delta/00-secrets.yaml.j2 b/tests/templates/kuttl/delta/00-secrets.yaml.j2 index 72e921b86..1b87ac805 100644 --- a/tests/templates/kuttl/delta/00-secrets.yaml.j2 +++ b/tests/templates/kuttl/delta/00-secrets.yaml.j2 @@ -61,8 +61,7 @@ data: tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQ2p5blZ6K1hIQjhPQ1kKNHBzRUVZbWpvYnBkelRsb3d3Y1NRTitZRFBDa0Jlb3IwVGI4N0VnTHpKSytKWWJ1cG9YQmxOSUpQUWFvd0pFbwovU3pTazhmdTJYU015dkFaWTRGV0d4SnkyeXhJeHZQL2liT0dPWXVpUEdYSzI0dDZaY0dUVVZoYXVpWkdTZ2tXCnJlaldXaDdNakZTK2MxdmFZWnFCK1ExelBzNVBGTWxjOGw1Vi8rYjhaN2pNSmk4NG1PZklQeGprdkl5SnI1VWsKZUYzVWZMcUpTNXk0TEY0dHk0RnQyaUFkN2JiZkhhbmZ2WW12NlVvRFZ0TVh0V28xb1FQZnYzc2hXcm1STHp3NgpldUlBdGJYYzVDakJ5SWFrQ2JpRG5BVThyS2crQjFKNG12UWdyTHdvM3FQcnlKZ3hTZGlkbVoybUVSN0V6K2M1CkIwbS9MaUloQWdNQkFBRUNnZ0VBQWQzdDVzdUNFMjdXY0llc3NxZ3NoSFAwZHRzKyswVzF6K3h6WC8xTnhPRFkKWVhWNkJmbi9mRHJ4dFQ4aVFaZ2VVQzJORTFQaHZveXJXdWMvMm9xYXJjdEd1OUFZV29HNjJLdG9VMnpTSFdZLwpJN3VERTFXV2xOdlJZVFdOYW5DOGV4eGpRRzE4d0RKWjFpdFhTeEl0NWJEM3lrL3dUUlh0dCt1SnpyVjVqb2N1CmNoeERMd293aXUxQWo2ZFJDWk5CejlUSnh5TnI1ME5ZVzJVWEJhVC84N1hyRkZkSndNVFZUMEI3SE9uRzdSQlYKUWxLdzhtcVZiYU5lbmhjdk1qUjI5c3hUekhSK2p4SU8zQndPNk9Hai9PRmhGQllVN1RMWGVsZDFxb2UwdmIyRwpiOGhQcEd1cHRyNUF0OWx3MXc1d1EzSWdpdXRQTkg1cXlEeUNwRWw2RVFLQmdRRGNkYnNsT2ZLSmo3TzJMQXlZCkZ0a1RwaWxFMFYzajBxbVE5M0lqclY0K0RSbUxNRUIyOTk0MDdCVVlRUWoxL0RJYlFjb1oyRUVjVUI1cGRlSHMKN0RNRUQ2WExIYjJKVTEyK2E3c1d5Q05kS2VjZStUNy9JYmxJOFR0MzQwVWxIUTZ6U01TRGNqdmZjRkhWZ3YwcwpDYWpoRng3TmtMRVhUWnI4ZlQzWUloajR2UUtCZ1FDK01nWjFVbW9KdzlJQVFqMnVJVTVDeTl4aldlWURUQU8vCllhWEl6d2xnZTQzOE1jYmI0Y04yU2FOU0dEZ1Y3bnU1a3FpaWhwalBZV0lpaU9CcDlrVFJIWE9kUFc0N3N5ZUkKdDNrd3JwMnpWbFVnbGNNWlo2bW1WM1FWYUFOWmdqVTRSU3Y0ZS9WeFVMamJaYWZqUHRaUnNqWkdwSzBZVTFvdApWajhJZVE3Zk5RS0JnQ1ArWk11ekpsSW5VQ1FTRlF4UHpxbFNtN0pNckpPaHRXV2h3TlRxWFZTc050dHV5VmVqCktIaGpneDR1b0JQcFZSVDJMTlVEWmI0RnByRjVPYVhBK3FOVEdyS0s3SU1iUlZidHArSVVVeEhHNGFGQStIUVgKUVhVVFRhNUpRT1RLVmJnWHpWM1lyTVhTUk1valZNcDMyVWJHeTVTc1p2MXpBamJ2QzhYWjYxSFJBb0dBZEJjUQp2aGU1eFpBUzVEbUtjSGkvemlHa3ViZXJuNk9NUGdxYUtJSEdsVytVOExScFR0ajBkNFRtL1Rydk1PUEovVEU1CllVcUtoenBIcmhDaCtjdHBvY0k2U1dXdm5SenpLbzNpbVFaY0Y1VEFqUTBjY3F0RmI5UzlkRHR5bi9YTUNqYWUKYWlNdll5VUVVRll5TFpDelBGWnNycDNoVVpHKzN5RmZoQXB3TzJrQ2dZQkh3WWFQSWRXNld3NytCMmhpbjBvdwpqYTNjZXN2QTRqYU1Qd1NMVDhPTnRVMUdCU01md2N6TWJuUEhMclJ2Qjg3bjlnUGFSMndRR1VtckZFTzNMUFgvCmtSY09HcFlCSHBEWEVqRGhLa1dkUnVMT0ZnNEhMWmRWOEFOWmxRMFZTY0U4dTNkRERVTzg5cEdEbjA4cVRBcmwKeDlreHN1ZEVWcmtlclpiNVV4RlZxUT09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K --- # With `s3-use-tls` set to false this connection has no `tls` section, so Trino must talk -# plaintext HTTP to MinIO, which is then installed without TLS as well. The resulting -# `s3.endpoint` is asserted in 11-assert.yaml. +# plaintext HTTP to MinIO, which is then installed without TLS as well. apiVersion: s3.stackable.tech/v1alpha1 kind: S3Connection metadata: diff --git a/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 b/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 index b20e843e7..c2d0ab984 100644 --- a/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 +++ b/tests/templates/kuttl/delta/04-prepare-bucket.yaml.j2 @@ -2,7 +2,6 @@ apiVersion: kuttl.dev/v1beta1 kind: TestStep commands: - # MinIO and its bucket provisioning Job are awaited in 02-assert.yaml. - script: | POD=$(kubectl -n $NAMESPACE get pod -l app.kubernetes.io/instance=minio -o name | head -n1 | sed 's#pod/##') kubectl -n $NAMESPACE cp delta-table "$POD:/tmp/delta-table" diff --git a/tests/templates/kuttl/delta/11-assert.yaml.j2 b/tests/templates/kuttl/delta/11-assert.yaml.j2 deleted file mode 100644 index 839fa3553..000000000 --- a/tests/templates/kuttl/delta/11-assert.yaml.j2 +++ /dev/null @@ -1,23 +0,0 @@ -{% if test_scenario['values']['s3-use-tls'] == 'true' %} -{% set scheme = 'https' %} -{% else %} -{% set scheme = 'http' %} -{% endif %} ---- -apiVersion: kuttl.dev/v1beta1 -kind: TestAssert -timeout: 120 -commands: - # The catalog must be configured with a {{ scheme }} endpoint. The backslashes are the Java - # properties escaping of `:` and are stripped before comparing. - - script: | - set -eu - for role in coordinator worker; do - endpoint=$(kubectl -n "$NAMESPACE" get configmap "trino-$role-default-catalog" \ - -o go-template='{{ '{{' }} index .data "delta.properties" {{ '}}' }}' \ - | grep '^s3.endpoint=' | tr -d '\\') - if [ "$endpoint" != "s3.endpoint={{ scheme }}://minio:9000/" ]; then - echo "ERROR: trino-$role-default-catalog delta.properties has '$endpoint'" - exit 1 - fi - done diff --git a/tests/test-definition.yaml b/tests/test-definition.yaml index 397ffd4c4..6cbb0bcb7 100644 --- a/tests/test-definition.yaml +++ b/tests/test-definition.yaml @@ -59,8 +59,6 @@ dimensions: values: - "true" - "false" - # Whether the S3Connection used by the `delta` test carries a `tls` section, and MinIO is - # installed with TLS. With "false" Trino talks plaintext HTTP to S3. - name: s3-use-tls values: - "true" @@ -137,8 +135,6 @@ tests: - name: delta # NOTE: this test only works because we set `parquet.use-column-index=false` in the delta catalog # to work around this bug: https://github.com/trinodb/trino/issues/28885 - # - # This is also where plaintext (non-TLS) S3 access is covered, via the `s3-use-tls` dimension. dimensions: - trino-delta - hive-latest @@ -163,7 +159,7 @@ suites: - dimensions: - expr: last - name: openshift - # Run with the openshift and all tls dimensions set to true + # Run with the openshift and all tls dimensions set to true (except S3) patch: - dimensions: - expr: last @@ -174,3 +170,6 @@ suites: expr: "true" - name: use-internal-tls expr: "true" + # S3 with TLS doesn't work on OpenShift (see comment at the top of the file) + - name: s3-use-tls + expr: "false"