search

trinodb / trino-python-client

Python client for Trino
Apache License 2.0
335 stars 168 forks source link

Kerberos integration tests #37

Open mik-laj opened 4 years ago

mik-laj commented 4 years ago

Hello,

I have currently prepared the Docker environment, there are 3 containers:

Link: https://github.com/mik-laj/presto-kerberos-docker

All Keytab keys, SSL certificates are generated automatically. All you need to do is run start.sh. To test the environment, you can run test.sh. Currently, Github Action is set up in this repository, so it's easy to verify that everything is working fine.

I think we can use it for automatic tests of this library as well, to verify the correct implementation of Kerberos authorization. This will require some changes to our CI environment as Kerberos is very sensitive to hostnames. In practice, this means that we will have to run all the tests in Docker because you cannot configure only KDC and Presto in Docker, and the tests on the machine, because Kerberos will detect it as a connection from another network, which will make configuration even more difficult. I think this is a good solution as Docker will also provide greater repeatability of these tests and independence from CI.

If we run everything in Docker, we can easily migrate to Github Action or another system if necessary Travis CI is not a tool that is actively developed. It is only maintained by the owners.

Best regards.

findepi commented 4 years ago

If we run everything in Docker, we can easily migrate to Github Action or another system if necessary Travis CI is not a tool that is actively developed.

https://github.com/prestosql/presto-python-client/issues/38

findepi commented 4 years ago

@mik-laj thanks for looking into this. I guess we should use the KDC image that we already have: https://hub.docker.com/r/prestodev/kerberos / https://github.com/prestosql/docker-images/tree/master/prestodev/kerberos

Then there is a question how do we launch the environment. I think docker-compose is fine here.

In practice, this means that we will have to run all the tests in Docker because you cannot configure only KDC and Presto in Docker, and the tests on the machine, because Kerberos will detect it as a connection from another network, which will make configuration even more difficult.

Correct. Fortunately docker network and docker container hostnames are good solution for this. This is how we test kerberos in product tests in https://github.com/prestosql/presto