Skip to content

feat(nifi): Add NiFi OPA Authorizer #1058

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 29 commits into
base: main
Choose a base branch
from
Open

Conversation

labrenbe
Copy link
Member

@labrenbe labrenbe commented Apr 15, 2025

Description

Builds Nifi OPA Plugin from source and makes it available to NiFi as NAR file.

Currently uses a specific commit and contains a workaround patch until this PR is merged and released.

Definition of Done Checklist

  • Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
  • Please make sure all these things are done and tick the boxes
- [X] Changes are OpenShift compatible
- [X] All added packages (via microdnf or otherwise) have a comment on why they are added
- [X] Things not downloaded from Red Hat repositories should be mirrored in the Stackable repository and downloaded from there
- [X] All packages should have (if available) signatures/hashes verified
- [x] Add an entry to the CHANGELOG.md file
- [X] Integration tests ran successfully
TIP: Running integration tests with a new product image

The image can be built and uploaded to the kind cluster with the following commands:

bake --product <product> --image-version <stackable-image-version>
kind load docker-image <image-tagged-with-the-major-version> --name=<name-of-your-test-cluster>

See the output of bake to retrieve the image tag for <image-tagged-with-the-major-version>.

@labrenbe labrenbe self-assigned this Apr 15, 2025
@labrenbe labrenbe marked this pull request as ready for review April 15, 2025 08:54
@labrenbe labrenbe linked an issue Apr 22, 2025 that may be closed by this pull request
@maltesander maltesander self-requested a review April 22, 2025 14:56
@maltesander
Copy link
Member

Could we add the authorizer license as well like e.g.

COPY --chown=${STACKABLE_USER_UID}:0 kcat/licenses /licenses

labrenbe and others added 17 commits May 8, 2025 14:09
Co-authored-by: Malte Sander <malte.sander.it@gmail.com>
* chore: Use fast download mirrors

* chore: Show download progress bar

* chore: Improve gpg key warning message

* chore: Show upload progress bar

Thanks to <https://bashupload.com/how_to_upload_progress_curl>

* Apply suggestions from code review

Co-authored-by: Techassi <sascha.lautenschlaeger@stackable.tech>

* chore: Make output more consistent

---------

Co-authored-by: Techassi <sascha.lautenschlaeger@stackable.tech>
* chore(issue_templates): Use YY.M.X placeholders

* chore(issue_templates): Remove tasklists

:sob:

* chore(issue_templates): Add missing tool update tasks for cyclonedx and auditable
* wip

* Update druid/Dockerfile

Co-authored-by: Natalie Klestrup Röijezon <nat@nullable.se>

* fix: remove unnecessary check / shadow repo root var

* fix: druid src path

* fix: druid src path

* feat: introduce stackable-devel image

* fix: use PathBuf in ProductVersionContext

* chore: align zookeeper patch directory structure

* fix: stackable-devel dnf and shell config

* chore: switch patch process in other products

* fix: hive build

* fix: trino build

* fix: spark build

* chore: make hadolint happy

* fix: remove hbase intermediate sources / remove unnecessary and operator

* fix: permissions in patchable build process

* chore: remove unnecessary curl command in build process

* chore: move adding of JMX config and start-metastore script from builder stage to final stage

* chore: remove git repo in trino and hbase-operator-tools to avoid maven commit plugin bug

---------

Co-authored-by: Natalie Klestrup Röijezon <nat@nullable.se>
* feat: make image namespace a workflow input (default sdp)

* feat: add registry namespace input to build workflows and remove default
* ci(mirror): Include image and version in run-name

* chore: Use colon
* feat: install demo dependencies

* spark-connect-client is now built directly off of spark-k8s

* run pre-commit hooks

* fix shellcheck sc2102
* chore(jmx_exporter): Bump products to use 1.2.0

* chore(tools): Bump kubectl (1.33.0 and yq (4.45.2)

* chore(cyclonedx-bom): Bump to 6.0.0

* chore: Update changelog

* chore: Changelog formatting
* chore(java): Add JDK 24

* chore: Update changelog
* chore(vector): Bump to 0.46.1

* chore(vector): Bump products to use 0.46.1
* chore: Changelog formatting

* chore(zookeeper): Remove 2.9.2

* chore: Update changelog

* chore: Update changelog
…Release 25.7.0 (#1091)

* chore(ubi-rust-builders): Remove ubi8-rust-builder

* chore(ubi-rust-builders): Update base image and use protoc 30.2

* Apply suggestions from code review

Co-authored-by: Techassi <sascha.lautenschlaeger@stackable.tech>
Co-authored-by: Sebastian Bernauer <sebastian.bernauer@stackable.de>

---------

Co-authored-by: Techassi <sascha.lautenschlaeger@stackable.tech>
Co-authored-by: Sebastian Bernauer <sebastian.bernauer@stackable.de>
* chore(opa): Remove 0.67.1

* chore(opa): Remove legacy bundle-builder

* chore(opa): Bump ubi9 base image

* chore(opa): Add 1.4.2

* fix(opa): Manually install Go version

NOTE: The dnf package was 1.23.6 and OPA required 1.23.8
NOTE: I tried making the version paramaterized, but bake wouldn't allow
it (it worked fine with `docker build` and `docker build xbuild`).

* ci(mirror): Add golang

* chore(opa): Use mirrored golang image

* chore(opa): Parameterise golang container version

* chore: Update changelog
NickLarsenNZ and others added 7 commits May 8, 2025 14:11
* chore(superset): Add 4.1.2

* fix(superset): Remove invalid parts of the file

* chore: Update changelog
* feat(nifi): Add nifi-iceberg-bundle

* changelog

* Add SBOM to final image

* Use version 0.0.1

* hadolint

* Bump to 0.0.2

* Bump to 0.0.3
* fix(nifi): Delete correct intermediate folder

* changelog
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add a NiFi Authorizer that interfaces with OPA
7 participants