ADR032: OIDC Support

apiVersion: authentication.stackable.tech/v1alpha1
kind: AuthenticationClass
metadata:
  name: keycloak
spec:
  provider:
    oidc:
      # Hostname of the IdP. Like "idp.mycompany.corp"
      hostname: "$KEYCLOAK_HOSTNAME"

      # Optional port number to use. If unspecified, connections will
      # use the default port for the HTTP scheme (ie: 443 for when TLS
      # is enabled, or 80 if TLS is disabled).
      port: $KEYCLOAK_PORT

      # Optional root path appended to the hostname. This defaults
      # to "/".
      rootPath: /realms/master

      # User configurable scopes depending on the Identity provider
      # requirements.
      # The following three scopes are usually required, but depending
      # on the Identity Provider requirements, you might need to add or
      # remove some from this list.
      scopes: [ openid, email, profile ]

      # If a product extracts some sort of "effective user" that is
      # represented by a string internally, this config determines with
      # claim is used to extract that string. It is desirable to use
      # `sub` in here (or some other stable identifier), but in many
      # cases you might need to use `preferred_username` (e.g. in case
      # of Keycloak) or a different claim instead.
      #
      # Please note that some products hard-coded the claim in their
      # implementation, so some product operators might error out if
      # the product hardcodes a different claim than configured here.
      #
      # We don't provide any default value, as there is no correct way
      # of doing it that works in all setups. Most demos will probably
      # use `preferred_username`, although `sub` being more desirable,
      # but technically impossible with the current behavior of the
      # products.
      principalClaim: preferred_username

      # Optional provider hint. If unspecified, the product will not
      # enable any known quirks and will assume OIDC works as it is
      # intended to work.
      providerHint: Keycloak
      tls:
        verification:
          none: {}

apiVersion: trino.stackable.tech/v1alpha1
kind: TrinoCluster
metadata:
  name: trino
spec:
  image:
    productVersion: "414"
    stackableVersion: 23.7.0
  clusterConfig:
    # Other required config options omitted for brevity
    authentication:
      - authenticationClass: keycloak / open-ldap
        oidc:
          # A reference to the OIDC client credentials secret, which
          # consists of a client_id and client_secret.
          clientCredentialsSecret: trino-keycloak-client

          # Additional scopes required for this specific product. It
          # will get merged with the above configured scopes.
          extraScopes: [ groups ]
---
apiVersion: v1
kind: Secret
metadata:
  name: trino-keycloak-client
stringData:
  clientId: trino
  clientSecret: "{{ keycloakTrinoClientSecret }}"

apiVersion: trino.stackable.tech/v1alpha1
kind: TrinoCluster
metadata:
  name: trino
spec:
  image:
    productVersion: "414"
    stackableVersion: 23.7.0
  clusterConfig:
    # Other required config options omitted for brevity
    authentication:
      - authenticationClass: open-ldap
        ldap:
          # Optional. Only required for some products. In the future
          # this will be replaced by the key "bindUserSecret".
          bindCredentialsSecretClass: trino-openldap-bind
---
apiVersion: v1
kind: Secret
metadata:
  name: trino-openldap-bind
stringData:
  username: admin
  password: "{{ ldapTrinoPassword }}"