Skip to content

feat: allow solution to config internal system user #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

sydefz
Copy link
Contributor

@sydefz sydefz commented Feb 13, 2024

*This PR enables customisation on druid internal system user, once the cluster is provisioned owner can change the internal system user credentials in secret manager to customise it. The solution now pulls the system user secret and set username/password as environment variables, the variable is then handled in render_druid_config.py and check_druid_status.py script so it applies to the entire cluster.

We also updated render_utils.py to correctly handle dict properties. For example previously "druid.auth.authenticator.allowAll.initialInternalClientPassword": {"type": "environment", "variable": "DRUID_INTERNAL_CLIENT_PASSWORD"} will be rendered as string into the file (properties[key] = str(value)) which makes the final file has {'type': 'environment', 'variable': 'DRUID_INTERNAL_CLIENT_PASSWORD'} property value, this will cause druid to confuse about where to get the value from INFO [main] org.apache.druid.guice.JsonConfigurator - Unable to parse value of property [druid.auth.authenticator.allowAll.initialInternalClientPassword] as a json object, using as is.*

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@sydefz
Copy link
Contributor Author

sydefz commented Feb 13, 2024

For testing we tested the following flow to ensure the customisation is working.

  • Spin up a new cluster
  • Create a new user (eg.aws_druid_system ) for internal communication using Druid API
  • Modify the secret in AWS secrets manager to use the newly created user. eg. secret payload = {"username": "aws_druid_system", "password": "xxxxxx"}
  • Redeploy the solution (npm run cdk deploy) to make the cluster use the new user aws_druid_system for internal communication

@van-vothanh
Copy link
Member

Thank you for your contribution @sydefz
This change has now been verified against our pipeline.

@van-vothanh van-vothanh self-requested a review February 14, 2024 23:34
@van-vothanh van-vothanh merged commit c915336 into aws-solutions:main Feb 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants