Altinity / Altinity/clickhouse-operator
ClickHouseInstallation user settings support for auth_methods
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 2.6k
- Forks
- 574
- Avg merge
- 8d 6h
- Merged PRs (30d)
- 6
Description
Hello,
I am trying to enable auth_methods definition for clickhouse - doc. According to doc, it is possible to use just one of auth_methods, password_sha256_hex, password or ssh_keys. Unfortunately looks like operator is injecting password_sha256_hex field to the user defintion even though it is not specified in ClickHouseInstallation object. Please is there some way how to disable this operator behaviour, so that I can use auth_methods definition and possibly multiple authentication mechanisms?
Current user definition in ClickHouseInstallation object:
users:
backup/auth_methods/method1/password:
valueFrom:
secretKeyRef:
key: password
name: clickhouse-backup-creds
Generated /etc/clickhouse-server/users.d/chop-generated-users.xml:
<clickhouse>
<users>
<backup>
<auth_methods>
<method1>
<password from_env="CONFIGURATION_USERS_BACKUP_AUTH_METHODS_METHOD1_PASSWORD"></password>
</method1>
</auth_methods>
<password_sha256_hex>RANDOM_HASH_GENERATED_BY_OPERATOR?</password_sha256_hex>
<profile>default</profile>
<quota>default</quota>
</backup>
</users>
</clickhouse>
Operator version: 0.24.5
Operator access configuration:
clickhouse:
access:
password: ""
port: 8123
rootCA: ""
scheme: auto
secret:
name: ""
namespace: ""
timeouts:
connect: 1
query: 4
username: ""
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the ClickHouseInstallation users configuration from the issue on operator version 0.24.5 and inspect the generated /etc/clickhouse-server/users.d/chop-generated-users.xml. Trace the user-generation path that adds password_sha256_hex when auth_methods is configured. Done means the generated user retains auth_methods without an unintended password_sha256_hex field and existing password-based users remain supported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- authentication, database, devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100