Skip to content

feat(nifi): Add NiFi OPA Authorizer #1058

New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Open
wants to merge 30 commits into
base: main
Choose a base branch
from
Open

Conversation

labrenbe
Copy link
Member

@labrenbe labrenbe commented Apr 15, 2025

Description

Builds Nifi OPA Plugin from source and makes it available to NiFi as NAR file.

Currently uses a specific commit and contains a workaround patch until this PR is merged and released.

Definition of Done Checklist

  • Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
  • Please make sure all these things are done and tick the boxes
- [X] Changes are OpenShift compatible
- [X] All added packages (via microdnf or otherwise) have a comment on why they are added
- [X] Things not downloaded from Red Hat repositories should be mirrored in the Stackable repository and downloaded from there
- [X] All packages should have (if available) signatures/hashes verified
- [x] Add an entry to the CHANGELOG.md file
- [X] Integration tests ran successfully
TIP: Running integration tests with a new product image

The image can be built and uploaded to the kind cluster with the following commands:

bake --product <product> --image-version <stackable-image-version>
kind load docker-image <image-tagged-with-the-major-version> --name=<name-of-your-test-cluster>

See the output of bake to retrieve the image tag for <image-tagged-with-the-major-version>.

@labrenbe labrenbe self-assigned this Apr 15, 2025
@labrenbe labrenbe marked this pull request as ready for review April 15, 2025 08:54
@labrenbe labrenbe linked an issue Apr 22, 2025 that may be closed by this pull request
@maltesander maltesander self-requested a review April 22, 2025 14:56
@maltesander
Copy link
Member

Could we add the authorizer license as well like e.g.

COPY --chown=${STACKABLE_USER_UID}:0 kcat/licenses /licenses

labrenbe and others added 17 commits May 8, 2025 14:09
Co-authored-by: Malte Sander <malte.sander.it@gmail.com>
* chore: Use fast download mirrors

* chore: Show download progress bar

* chore: Improve gpg key warning message

* chore: Show upload progress bar

Thanks to <https://bashupload.com/how_to_upload_progress_curl>

* Apply suggestions from code review

Co-authored-by: Techassi <sascha.lautenschlaeger@stackable.tech>

* chore: Make output more consistent

---------

Co-authored-by: Techassi <sascha.lautenschlaeger@stackable.tech>
* chore(issue_templates): Use YY.M.X placeholders

* chore(issue_templates): Remove tasklists

:sob:

* chore(issue_templates): Add missing tool update tasks for cyclonedx and auditable
* wip

* Update druid/Dockerfile

Co-authored-by: Natalie Klestrup Röijezon <nat@nullable.se>

* fix: remove unnecessary check / shadow repo root var

* fix: druid src path

* fix: druid src path

* feat: introduce stackable-devel image

* fix: use PathBuf in ProductVersionContext

* chore: align zookeeper patch directory structure

* fix: stackable-devel dnf and shell config

* chore: switch patch process in other products

* fix: hive build

* fix: trino build

* fix: spark build

* chore: make hadolint happy

* fix: remove hbase intermediate sources / remove unnecessary and operator

* fix: permissions in patchable build process

* chore: remove unnecessary curl command in build process

* chore: move adding of JMX config and start-metastore script from builder stage to final stage

* chore: remove git repo in trino and hbase-operator-tools to avoid maven commit plugin bug

---------

Co-authored-by: Natalie Klestrup Röijezon <nat@nullable.se>
* feat: make image namespace a workflow input (default sdp)

* feat: add registry namespace input to build workflows and remove default
* ci(mirror): Include image and version in run-name

* chore: Use colon
* feat: install demo dependencies

* spark-connect-client is now built directly off of spark-k8s

* run pre-commit hooks

* fix shellcheck sc2102
* chore(jmx_exporter): Bump products to use 1.2.0

* chore(tools): Bump kubectl (1.33.0 and yq (4.45.2)

* chore(cyclonedx-bom): Bump to 6.0.0

* chore: Update changelog

* chore: Changelog formatting
* chore(java): Add JDK 24

* chore: Update changelog
* chore(vector): Bump to 0.46.1

* chore(vector): Bump products to use 0.46.1
* chore: Changelog formatting

* chore(zookeeper): Remove 2.9.2

* chore: Update changelog

* chore: Update changelog
…Release 25.7.0 (#1091)

* chore(ubi-rust-builders): Remove ubi8-rust-builder

* chore(ubi-rust-builders): Update base image and use protoc 30.2

* Apply suggestions from code review

Co-authored-by: Techassi <sascha.lautenschlaeger@stackable.tech>
Co-authored-by: Sebastian Bernauer <sebastian.bernauer@stackable.de>

---------

Co-authored-by: Techassi <sascha.lautenschlaeger@stackable.tech>
Co-authored-by: Sebastian Bernauer <sebastian.bernauer@stackable.de>
* chore(opa): Remove 0.67.1

* chore(opa): Remove legacy bundle-builder

* chore(opa): Bump ubi9 base image

* chore(opa): Add 1.4.2

* fix(opa): Manually install Go version

NOTE: The dnf package was 1.23.6 and OPA required 1.23.8
NOTE: I tried making the version paramaterized, but bake wouldn't allow
it (it worked fine with `docker build` and `docker build xbuild`).

* ci(mirror): Add golang

* chore(opa): Use mirrored golang image

* chore(opa): Parameterise golang container version

* chore: Update changelog
NickLarsenNZ and others added 8 commits May 8, 2025 14:11
* chore(superset): Add 4.1.2

* fix(superset): Remove invalid parts of the file

* chore: Update changelog
* feat(nifi): Add nifi-iceberg-bundle

* changelog

* Add SBOM to final image

* Use version 0.0.1

* hadolint

* Bump to 0.0.2

* Bump to 0.0.3
* fix(nifi): Delete correct intermediate folder

* changelog
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add a NiFi Authorizer that interfaces with OPA
7 participants