You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I am running mm-less kerberized druid on k8s. But while running kafka task peons are using ip address when they are doing authentication from kerberos Van someone help me with that
I am running mm-less kerberized druid on k8s. But while running kafka task peons are using ip address when they are doing authentication from kerberos Van someone help me with that
Configuration:
apiVersion: "druid.apache.org/v1alpha1"
kind: "Druid"
metadata:
name: druid
namespace: druid
spec:
image: apache-druid:28.0.1
startScript: /druid.sh
podLabels:
app.kubernetes.io/instance: druid
app.kubernetes.io/managed-by: druid-operator
app.kubernetes.io/name: druid
serviceAccount: druid
readinessProbe:
httpGet:
path: /status/health
port: 8088
securityContext:
fsGroup: 0
runAsUser: 0
runAsGroup: 0
services:
- spec:
type: ClusterIP
clusterIP: None
commonConfigMountPath: "/opt/druid/conf/druid/cluster/_common"
jvm.options: |-
-server
-XX:MaxDirectMemorySize=10240g
-Duser.timezone=UTC
-Dfile.encoding=UTF-8
-Dlog4j.debug
-Djava.util.logging.manager=org.apache.logging.log4j.jul.LogManager
-Djava.io.tmpdir=/druid/data
-Dsun.security.krb5.debug=true
-Dsun.security.jgss.debug=true
-Dsun.security.spnego.debug=true
-Djava.security.auth.login.config=/opt/druid/conf/druid/kafka_jaas.conf
log4j.config: |-
common.runtime.properties: |
metricDimensions.json: |-
{
"query/time" : { "dimensions" : ["dataSource", "type"], "type" : "timer"},
"query/bytes" : { "dimensions" : ["dataSource", "type"], "type" : "count"},
"query/node/time" : { "dimensions" : ["server"], "type" : "timer"},
"query/node/ttfb" : { "dimensions" : ["server"], "type" : "timer"},
"query/node/bytes" : { "dimensions" : ["server"], "type" : "count"},
"query/node/backpressure": { "dimensions" : ["server"], "type" : "timer"},
"query/intervalChunk/time" : { "dimensions" : [], "type" : "timer"},
volumeMounts:
- mountPath: /druid/data
name: data-volume
- mountPath: /druid/deepstorage
name: deepstorage-volume
- mountPath: /etc/krb5.conf
name: krbfile-volume
subPath: krb5.conf
- mountPath: /opt/druid/conf/druid/kafka_jaas.conf
name: kafka-jaas-volume
subPath: kafka_jaas.conf
volumes:
- name: data-volume
emptyDir: {}
- name: deepstorage-volume
hostPath:
path: /tmp/druid/deepstorage
type: DirectoryOrCreate
- name: krbfile-volume
configMap:
name: krb-file
- name: kafka-jaas-volume
configMap:
name: kafka-jaas
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: METADATA_STORAGE_PASSWORD
valueFrom:
secretKeyRef:
name: druid-mysql-password
key: password
- name: DRUID_SET_HOST
value: "0"
nodes:
brokers:
# Optionally specify for running broker as Deployment
kind: Deployment
nodeType: "broker"
# Optionally specify for broker nodes
# imagePullSecrets:
# - name: tutu
podLabels:
app.kubernetes.io/component: broker
podAnnotations:
druid.k8s.enablePatching: "true"
prometheus.io/scrape: 'true'
prometheus.io/port: '9090'
druid.port: 8088
nodeConfigMountPath: "/opt/druid/conf/druid/cluster/query/broker"
replicas: 1
runtime.properties: |
druid.host=xxxx-brokers.service.xxx
druid.service=druid/broker
# HTTP server threads
druid.broker.http.numConnections=5
druid.server.http.numThreads=10
# Processing threads and buffers
druid.processing.buffer.sizeBytes=1
druid.processing.numMergeBuffers=1
druid.processing.numThreads=1
druid.sql.enable=true
druid.auth.authenticatorChain=["xxx-authenticator"]
druid.auth.authenticator.xxx-authenticator.type=kerberos
# druid.auth.authenticator.xxx-authenticator-internal.type=basic
druid.auth.authenticator.xxx-authenticator.serverPrincipal=HTTP/xxxx
druid.auth.authenticator.xxx-authenticator.serverKeytab=/druid/keytabs/xx.keytab
druid.auth.authenticator.xxx-authenticator.cookieSignatureSecret="xxxx"
druid.auth.authorizers=["xxx-authorizer"]
druid.auth.authorizer.xxx-authorizer.type=allowAll
druid.auth.authenticator.xxx-authenticator.authorizerName=xxx-authorizer
druid.escalator.type=kerberos
druid.escalator.authorizerName=xxx-authorizer
druid.escalator.internalClientKeytab=/druid/keytabs/internal.keytab
druid.escalator.internalClientPrincipal=druid-internal@xxxx
druid.auth.unsecuredPaths=["/metrics","/druid/historical/v1/loadstatus"]
extra.jvm.options: |-
-Xmx512M
-Xms512M
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: druid
rules:
resources:
verbs:
resources: ["jobs"]
verbs: ["get", "watch", "list", "delete", "create"]
resources: ["pods", "pods/log"]
verbs: ["get", "watch", "list", "delete", "create"]
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: druid
subjects:
name: druid
roleRef:
kind: Role
name: druid
apiGroup: rbac.authorization.k8s.io
Can someone please help me with this
The text was updated successfully, but these errors were encountered: