[
https://issues.apache.org/jira/browse/ATLAS-5409?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Nixon Rodrigues reassigned ATLAS-5409:
--------------------------------------
Assignee: Nixon Rodrigues
> Atlas Kafka clients authenticate with OAUTHBEARER using Kubernetes projected
> service-account tokens
> ---------------------------------------------------------------------------------------------------
>
> Key: ATLAS-5409
> URL: https://issues.apache.org/jira/browse/ATLAS-5409
> Project: Atlas
> Issue Type: Improvement
> Components: atlas-core
> Environment: Atlas , ( Kafka + OAUTHBEARER)
> Reporter: Nixon Rodrigues
> Assignee: Nixon Rodrigues
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Atlas REST notification and hook consumers fail to publish to Kafka when the
> cluster uses SASL/OAUTHBEARER with Kubernetes projected service-account
> tokens ({{{}file:///var/run/secrets/kafka/kafka.<audience-id>{}}}).
> Symptoms:
> * HTTP 500 on {{POST .../v2/notification/topic/ATLAS_HOOK}} (often with no
> useful error body)
> * Spark–Atlas hook delivery blocked
> * Logs: {{{}scope value must be non-null{}}}, token file access errors, or
> stale token after SA rotation
> Root causes:
> # Stock {{OAuthBearerLoginCallbackHandler}} rejects K8s SA JWTs (no OAuth
> {{scope}} claim) and may fail {{File.canRead()}} on projected token files.
> # {{NotificationREST}} only catches {{{}NotificationException{}}};
> {{KafkaException}} surfaces as silent HTTP 500.
> # Custom/patched handlers that cache the JWT break SA token refresh when
> kubelet rotates the file in place and Kafka
> {{ExpiringCredentialRefreshingLogin}} re-authenticates.
> ----
> h3. Proposed Solution
> h4. 1. {{KubernetesOAuthHandler}} (new)
> * Path:
> {{notification/src/main/java/org/apache/atlas/security/kafka/KubernetesOAuthHandler.java}}
> * Reads JWT via {{Files.readAllBytes()}} from {{file://}} URL
> ({{{}sasl.oauthbearer.token.endpoint.url{}}})
> * No OAuth2 scope validation; broker validates JWT (Strimzi/K8s OIDC in
> production)
> * Does not cache tokens — re-reads file on every OAuth {{handle()}} (login +
> refresh)
> * Re-parses {{exp}} / {{iat}} / {{sub}} each time for correct Kafka refresh
> scheduling
> * Retries read/parse during kubelet atomic file replace (5 attempts, 50ms)
> * Unit tests including token rotation
> ({{{}testHandleReloadsTokenAfterKubernetesRotation{}}})
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
