scripts/ci/docker-compose/integration-kerberos.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.
---
services:
  kdc-server-example-com:
    image: ghcr.io/apache/airflow-krb5-kdc-server:2021.07.04
    labels:
      breeze.description: "Integration that provides Kerberos authentication."
    hostname: krb5-kdc-server-example-com
    domainname: example.com
    networks:
      example.com:
        ipv4_address: 10.5.0.2

    volumes:
      - kerberos-keytabs:/root/kerberos-keytabs

    environment:
      - KRB5_TRACE=/dev/stderr
      - POST_BOOTSTRAP_COMMAND=
        /opt/kerberos-utils/create_admin.sh alice alice;
        /opt/kerberos-utils/create_client.sh bob bob /root/kerberos-keytabs/airflow.keytab;
        /opt/kerberos-utils/create_service.sh krb5-machine-example-com airflow
        /root/kerberos-keytabs/airflow.keytab;
        /opt/kerberos-utils/create_service.sh trino HTTP /root/kerberos-keytabs/trino.keytab;
    healthcheck:
      test: |-
        python -c "
        import socket;
        import sys;
        a_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM);
        result_of_check = a_socket.connect_ex(('127.0.0.1', 88));
        sys.exit(result_of_check);
        "
      interval: 5s
      timeout: 30s
      start_period: 30s
      retries: 50
    restart: "on-failure"

  airflow:
    hostname: krb5-machine-example-com
    domainname: example.com
    networks:
      example.com:
        ipv4_address: 10.5.0.1
      default: {}

    depends_on:
      kdc-server-example-com:
        condition: service_healthy

    volumes:
      - kerberos-keytabs:/root/kerberos-keytabs
      - ../dockerfiles/krb5-kdc-server/krb5.conf:/etc/krb5.conf:ro
    environment:
      - INTEGRATION_KERBEROS=true
      - KRB5_CONFIG=/etc/krb5.conf
      - KRB5_KTNAME=/root/kerberos-keytabs/airflow.keytab
      - KRB5_TRACE=/dev/stderr
      - AIRFLOW__KERBEROS__KEYTAB=/root/kerberos-keytabs/airflow.keytab
      - AIRFLOW__KERBEROS__PRINCIPAL=bob@EXAMPLE.COM

volumes:
  kerberos-keytabs:

networks:
  example.com:
    name: example.com
    driver: bridge
    ipam:
      config:
        - subnet: 10.5.0.0/16
          ip_range: 10.5.0.0/16
          gateway: 10.5.0.254