Altinity / Altinity/clickhouse-operator

ClickHouseInstallation user settings support for auth_methods

Open
#1,958 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
2.6k
Forks
574
Avg merge
8d 6h
Merged PRs (30d)
6

Description

Hello,
I am trying to enable auth_methods definition for clickhouse - doc. According to doc, it is possible to use just one of auth_methods, password_sha256_hex, password or ssh_keys. Unfortunately looks like operator is injecting password_sha256_hex field to the user defintion even though it is not specified in ClickHouseInstallation object. Please is there some way how to disable this operator behaviour, so that I can use auth_methods definition and possibly multiple authentication mechanisms?

Current user definition in ClickHouseInstallation object:

users:
  backup/auth_methods/method1/password:
    valueFrom:
      secretKeyRef:
        key: password
        name: clickhouse-backup-creds

Generated /etc/clickhouse-server/users.d/chop-generated-users.xml:

<clickhouse>
    <users>
        <backup>
            <auth_methods>
                <method1>
                    <password from_env="CONFIGURATION_USERS_BACKUP_AUTH_METHODS_METHOD1_PASSWORD"></password>
                </method1>
            </auth_methods>
            <password_sha256_hex>RANDOM_HASH_GENERATED_BY_OPERATOR?</password_sha256_hex>
            <profile>default</profile>
            <quota>default</quota>
        </backup>
    </users>
</clickhouse>    

Operator version: 0.24.5
Operator access configuration:

clickhouse:
  access:
    password: ""
    port: 8123
    rootCA: ""
    scheme: auto
    secret:
      name: ""
      namespace: ""
    timeouts:
      connect: 1
      query: 4
    username: ""

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the ClickHouseInstallation users configuration from the issue on operator version 0.24.5 and inspect the generated /etc/clickhouse-server/users.d/chop-generated-users.xml. Trace the user-generation path that adds password_sha256_hex when auth_methods is configured. Done means the generated user retains auth_methods without an unintended password_sha256_hex field and existing password-based users remain supported.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
authentication, database, devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.