Skip to content

Commit 5477148

Browse files
jubradjubrad
authored
Merge pull request #47 from MaterializeInc/add-auth-support
Add password auth support
2 parents b2b9e59 + 198d207 commit 5477148

File tree

4 files changed

+99
-14
lines changed

4 files changed

+99
-14
lines changed

‎README.md

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,36 @@ The module supports several rollout strategies for Materialize instances through
3434

3535
To use these options, set the appropriate values in the `instances` input variable and when you want to rollout a new version of the instance, set the `request_rollout` or `force_rollout` value to a new UUID.
3636

37+
## Authentication Options
38+
39+
The module supports two authentication modes for Materialize instances:
40+
41+
### `authenticator_kind` (string)
42+
- Determines how users authenticate with the Materialize instance.
43+
- Valid values are:
44+
- `"None"` (default): No password authentication is enabled.
45+
- `"Password"`: Enables password authentication for the `mz_system` user. When set to `"Password"`, you **must** provide a value for `external_login_password_mz_system`.
46+
47+
### `external_login_password_mz_system` (string)
48+
- The password to set for the `mz_system` user when `authenticator_kind` is `"Password"`.
49+
- This value is stored securely in a Kubernetes Secret and used by the Materialize operator to configure authentication.
50+
- **Required** if `authenticator_kind` is set to `"Password"`.
51+
52+
**Example:**
53+
```hcl
54+
instances = [
55+
{
56+
name = "mz-instance"
57+
namespace = "mz-ns"
58+
authenticator_kind = "Password"
59+
external_login_password_mz_system = "your-secure-password"
60+
# other instance configurations
61+
}
62+
]
63+
```
64+
65+
If `authenticator_kind` is not set or set to `"None"`, password authentication is disabled and `external_login_password_mz_system` is ignored.
66+
3767
## Requirements
3868

3969
| Name | Version |
@@ -77,7 +107,7 @@ No modules.
77107
| <a name="input_helm_repository"></a> [helm\_repository](#input\_helm\_repository) | Repository URL for the Materialize operator Helm chart. Leave empty if using local chart. | `string` | `"https://materializeinc.github.io/materialize/"` | no |
78108
| <a name="input_helm_values"></a> [helm\_values](#input\_helm\_values) | Values to pass to the Helm chart | `any` | n/a | yes |
79109
| <a name="input_install_metrics_server"></a> [install\_metrics\_server](#input\_install\_metrics\_server) | Whether to install the metrics-server | `bool` | `true` | no |
80-
| <a name="input_instances"></a> [instances](#input\_instances) | Configuration for Materialize instances | <pre>list(object({<br/> name = string<br/> namespace = optional(string)<br/> create_database = optional(bool, true)<br/> database_name = string<br/> metadata_backend_url = string<br/> persist_backend_url = string<br/> license_key = optional(string)<br/> environmentd_version = optional(string, "v0.130.13") # META: mz version<br/> environmentd_extra_env = optional(list(object({<br/> name = string<br/> value = string<br/> })), [])<br/> environmentd_extra_args = optional(list(string), [])<br/> cpu_request = optional(string, "1")<br/> memory_request = optional(string, "1Gi")<br/> memory_limit = optional(string, "1Gi")<br/> in_place_rollout = optional(bool, true)<br/> request_rollout = optional(string, "00000000-0000-0000-0000-000000000001")<br/> force_rollout = optional(string, "00000000-0000-0000-0000-000000000001")<br/> balancer_memory_request = optional(string, "256Mi")<br/> balancer_memory_limit = optional(string, "256Mi")<br/> balancer_cpu_request = optional(string, "100m")<br/> }))</pre> | `[]` | no |
110+
| <a name="input_instances"></a> [instances](#input\_instances) | Configuration for Materialize instances | <pre>list(object({<br/> name = string<br/> namespace = optional(string)<br/> create_database = optional(bool, true)<br/> database_name = string<br/> metadata_backend_url = string<br/> persist_backend_url = string<br/> license_key = optional(string)<br/> external_login_password_mz_system = optional(string)<br/> authenticator_kind = optional(string, "None")<br/> environmentd_version = optional(string, "v0.130.13") # META: mz version<br/> environmentd_extra_env = optional(list(object({<br/> name = string<br/> value = string<br/> })), [])<br/> environmentd_extra_args = optional(list(string), [])<br/> cpu_request = optional(string, "1")<br/> memory_request = optional(string, "1Gi")<br/> memory_limit = optional(string, "1Gi")<br/> in_place_rollout = optional(bool, true)<br/> request_rollout = optional(string, "00000000-0000-0000-0000-000000000001")<br/> force_rollout = optional(string, "00000000-0000-0000-0000-000000000001")<br/> balancer_memory_request = optional(string, "256Mi")<br/> balancer_memory_limit = optional(string, "256Mi")<br/> balancer_cpu_request = optional(string, "100m")<br/> }))</pre> | `[]` | no |
81111
| <a name="input_metrics_server_version"></a> [metrics\_server\_version](#input\_metrics\_server\_version) | Version of metrics-server to install | `string` | `"3.12.2"` | no |
82112
| <a name="input_monitoring_namespace"></a> [monitoring\_namespace](#input\_monitoring\_namespace) | Namespace for monitoring resources | `string` | `"monitoring"` | no |
83113
| <a name="input_namespace"></a> [namespace](#input\_namespace) | Namespace prefix for all resources | `string` | n/a | yes |

‎docs/header.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,33 @@ The module supports several rollout strategies for Materialize instances through
2929
- Must be changed to a new UUID value for each rollout
3030

3131
To use these options, set the appropriate values in the `instances` input variable and when you want to rollout a new version of the instance, set the `request_rollout` or `force_rollout` value to a new UUID.
32+
33+
## Authentication Options
34+
35+
The module supports two authentication modes for Materialize instances:
36+
37+
### `authenticator_kind` (string)
38+
- Determines how users authenticate with the Materialize instance.
39+
- Valid values are:
40+
- `"None"` (default): No password authentication is enabled.
41+
- `"Password"`: Enables password authentication for the `mz_system` user. When set to `"Password"`, you **must** provide a value for `external_login_password_mz_system`.
42+
43+
### `external_login_password_mz_system` (string)
44+
- The password to set for the `mz_system` user when `authenticator_kind` is `"Password"`.
45+
- This value is stored securely in a Kubernetes Secret and used by the Materialize operator to configure authentication.
46+
- **Required** if `authenticator_kind` is set to `"Password"`.
47+
48+
**Example:**
49+
```hcl
50+
instances = [
51+
{
52+
name = "materialize-instance"
53+
namespace = "materialize"
54+
authenticator_kind = "Password"
55+
external_login_password_mz_system = "your-secure-password"
56+
# other instance configurations
57+
}
58+
]
59+
```
60+
61+
If `authenticator_kind` is not set or set to `"None"`, password authentication is disabled and `external_login_password_mz_system` is ignored.

‎main.tf

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,16 @@ resource "kubernetes_secret" "materialize_backends" {
6666
namespace = coalesce(each.value.namespace, var.operator_namespace)
6767
}
6868

69-
data = {
70-
metadata_backend_url = each.value.metadata_backend_url
71-
persist_backend_url = each.value.persist_backend_url
72-
license_key = each.value.license_key == null ? "" : each.value.license_key
73-
}
69+
data = merge(
70+
{
71+
metadata_backend_url = each.value.metadata_backend_url
72+
persist_backend_url = each.value.persist_backend_url
73+
license_key = each.value.license_key == null ? "" : each.value.license_key
74+
},
75+
each.value.authenticator_kind == "Password" && each.value.external_login_password_mz_system != null ? {
76+
external_login_password_mz_system = each.value.external_login_password_mz_system
77+
} : {}
78+
)
7479

7580
depends_on = [
7681
kubernetes_namespace.instance_namespaces,
@@ -102,6 +107,7 @@ resource "kubernetes_manifest" "materialize_instances" {
102107
spec = {
103108
environmentdImageRef = "materialize/environmentd:${each.value.environmentd_version}"
104109
backendSecretName = "${each.key}-materialize-backend"
110+
authenticatorKind = each.value.authenticator_kind
105111
inPlaceRollout = each.value.in_place_rollout
106112
requestRollout = lookup(each.value, "request_rollout", null)
107113
forceRollout = lookup(each.value, "force_rollout", null)

‎variables.tf

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -65,14 +65,16 @@ variable "install_metrics_server" {
6565
variable "instances" {
6666
description = "Configuration for Materialize instances"
6767
type = list(object({
68-
name = string
69-
namespace = optional(string)
70-
create_database = optional(bool, true)
71-
database_name = string
72-
metadata_backend_url = string
73-
persist_backend_url = string
74-
license_key = optional(string)
75-
environmentd_version = optional(string, "v0.130.13") # META: mz version
68+
name = string
69+
namespace = optional(string)
70+
create_database = optional(bool, true)
71+
database_name = string
72+
metadata_backend_url = string
73+
persist_backend_url = string
74+
license_key = optional(string)
75+
external_login_password_mz_system = optional(string)
76+
authenticator_kind = optional(string, "None")
77+
environmentd_version = optional(string, "v0.130.13") # META: mz version
7678
environmentd_extra_env = optional(list(object({
7779
name = string
7880
value = string
@@ -107,6 +109,23 @@ variable "instances" {
107109
])
108110
error_message = "Force rollout must be a valid UUID in the format xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
109111
}
112+
113+
validation {
114+
condition = alltrue([
115+
for instance in var.instances :
116+
contains(["Password", "None"], instance.authenticator_kind)
117+
])
118+
error_message = "Authenticator kind must be either 'Password' or 'None'"
119+
}
120+
121+
validation {
122+
condition = alltrue([
123+
for instance in var.instances :
124+
(instance.authenticator_kind == "Password" && instance.external_login_password_mz_system != null)
125+
|| (instance.authenticator_kind == "None" && instance.external_login_password_mz_system == null)
126+
])
127+
error_message = "When authenticator_kind is 'Password', external_login_password_mz_system must be provided"
128+
}
110129
}
111130

112131
variable "postgres_version" {

0 commit comments

Comments
 (0)