Nixon Rodrigues created ATLAS-5409:
--------------------------------------
Summary: Atlas Kafka clients authenticate with OAUTHBEARER using
Kubernetes projected service-account tokens
Key: ATLAS-5409
URL: https://issues.apache.org/jira/browse/ATLAS-5409
Project: Atlas
Issue Type: Improvement
Components: atlas-core
Environment: Atlas , ( Kafka + OAUTHBEARER)
Reporter: Nixon Rodrigues
Atlas REST notification and hook consumers fail to publish to Kafka when the
cluster uses SASL/OAUTHBEARER with Kubernetes projected service-account tokens
({{{}file:///var/run/secrets/kafka/kafka.<audience-id>{}}}).
Symptoms:
* HTTP 500 on {{POST .../v2/notification/topic/ATLAS_HOOK}} (often with no
useful error body)
* Spark–Atlas hook delivery blocked
* Logs: {{{}scope value must be non-null{}}}, token file access errors, or
stale token after SA rotation
Root causes:
# Stock {{OAuthBearerLoginCallbackHandler}} rejects K8s SA JWTs (no OAuth
{{scope}} claim) and may fail {{File.canRead()}} on projected token files.
# {{NotificationREST}} only catches {{{}NotificationException{}}};
{{KafkaException}} surfaces as silent HTTP 500.
# Custom/patched handlers that cache the JWT break SA token refresh when
kubelet rotates the file in place and Kafka
{{ExpiringCredentialRefreshingLogin}} re-authenticates.
----
h3. Proposed Solution
h4. 1. {{KubernetesOAuthHandler}} (new)
* Path:
{{notification/src/main/java/org/apache/atlas/security/kafka/KubernetesOAuthHandler.java}}
* Reads JWT via {{Files.readAllBytes()}} from {{file://}} URL
({{{}sasl.oauthbearer.token.endpoint.url{}}})
* No OAuth2 scope validation; broker validates JWT (Strimzi/K8s OIDC in
production)
* Does not cache tokens — re-reads file on every OAuth {{handle()}} (login +
refresh)
* Re-parses {{exp}} / {{iat}} / {{sub}} each time for correct Kafka refresh
scheduling
* Retries read/parse during kubelet atomic file replace (5 attempts, 50ms)
* Unit tests including token rotation
({{{}testHandleReloadsTokenAfterKubernetesRotation{}}})
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
