[
https://issues.apache.org/jira/browse/ATLAS-5409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18116370#comment-18116370
]
ASF subversion and git services commented on ATLAS-5409:
--------------------------------------------------------
Commit 6304d4b4edb7c6f3c9dff033b6f9684714ba1613 in atlas's branch
refs/heads/ATLAS-5409 from nixonrodrigues
[ https://gitbox.apache.org/repos/asf?p=atlas.git;h=6304d4b4e ]
ATLAS-5409: Atlas Kafka clients authenticate with OAUTHBEARER using Kubernetes
projected SA tokens
Add KubernetesOAuthHandler to read projected service-account JWTs from a file
URL
without OAuth2 scope validation, re-read the token on each OAuth login/refresh
for kubelet rotation, and improve REST notification error visibility when Kafka
producer creation fails.
Co-authored-by: Cursor <[email protected]>
> Atlas Kafka clients authenticate with OAUTHBEARER using Kubernetes projected
> service-account tokens
> ---------------------------------------------------------------------------------------------------
>
> Key: ATLAS-5409
> URL: https://issues.apache.org/jira/browse/ATLAS-5409
> Project: Atlas
> Issue Type: Improvement
> Components: atlas-core
> Environment: Atlas , ( Kafka + OAUTHBEARER)
> Reporter: Nixon Rodrigues
> Priority: Major
>
> Atlas REST notification and hook consumers fail to publish to Kafka when the
> cluster uses SASL/OAUTHBEARER with Kubernetes projected service-account
> tokens ({{{}file:///var/run/secrets/kafka/kafka.<audience-id>{}}}).
> Symptoms:
> * HTTP 500 on {{POST .../v2/notification/topic/ATLAS_HOOK}} (often with no
> useful error body)
> * Spark–Atlas hook delivery blocked
> * Logs: {{{}scope value must be non-null{}}}, token file access errors, or
> stale token after SA rotation
> Root causes:
> # Stock {{OAuthBearerLoginCallbackHandler}} rejects K8s SA JWTs (no OAuth
> {{scope}} claim) and may fail {{File.canRead()}} on projected token files.
> # {{NotificationREST}} only catches {{{}NotificationException{}}};
> {{KafkaException}} surfaces as silent HTTP 500.
> # Custom/patched handlers that cache the JWT break SA token refresh when
> kubelet rotates the file in place and Kafka
> {{ExpiringCredentialRefreshingLogin}} re-authenticates.
> ----
> h3. Proposed Solution
> h4. 1. {{KubernetesOAuthHandler}} (new)
> * Path:
> {{notification/src/main/java/org/apache/atlas/security/kafka/KubernetesOAuthHandler.java}}
> * Reads JWT via {{Files.readAllBytes()}} from {{file://}} URL
> ({{{}sasl.oauthbearer.token.endpoint.url{}}})
> * No OAuth2 scope validation; broker validates JWT (Strimzi/K8s OIDC in
> production)
> * Does not cache tokens — re-reads file on every OAuth {{handle()}} (login +
> refresh)
> * Re-parses {{exp}} / {{iat}} / {{sub}} each time for correct Kafka refresh
> scheduling
> * Retries read/parse during kubelet atomic file replace (5 attempts, 50ms)
> * Unit tests including token rotation
> ({{{}testHandleReloadsTokenAfterKubernetesRotation{}}})
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
