Google Git
Sign in
apache/impala/refs/heads/master/./helm/impala
tree: 27338d821ad9dacd68f995c0a1364d800cdfa3e0
  1. files/
  2. templates/
  3. tests/
  4. Chart.yaml
  5. kubernetes-in-docker-e2e.md
  6. README.md
  7. values-example.yaml
  8. values-impala-ldap-example.yaml
  9. values-ldap-example.yaml
  10. values.yaml
helm/impala/README.md

Impala on Kubernetes (Helm and Operator)

Scope

  • Fast deployment with Helm
  • Optional Kudu, Ranger, and LDAP components
  • Equivalent operator workflow through ImpalaCluster

Prerequisites

  • Kubernetes cluster access (kubectl configured)
  • Helm 3.x
  • A default StorageClass (or set one explicitly)

From repository root:

cd /path/to/impala

Helm chart structure

Chart root:

  • helm/impala/Chart.yaml
  • helm/impala/values.yaml (base defaults)
  • helm/impala/values-example.yaml (generic runnable example)
  • helm/impala/templates/ (core and optional resources)

Core templates:

  • statestored-*, catalogd-*, impalad-*, hms-*
  • configmap.yaml, pvc.yaml

Optional templates:

  • Kudu: kudu-master-*, kudu-tserver-*, kudu-pvc.yaml
  • Ranger: ranger-deployment.yaml, ranger-service.yaml

Deploy with Helm

Create namespace:

kubectl create namespace impala --dry-run=client -o yaml | kubectl apply -f -

Minimal Impala (first install):

helm install impala ./helm/impala \
  -n impala \
  -f ./helm/impala/values-example.yaml

For subsequent updates, use:

helm upgrade impala ./helm/impala \
  -n impala \
  -f ./helm/impala/values-example.yaml

Verify:

kubectl -n impala get pods
kubectl -n impala get svc
kubectl -n impala get pvc

Storage note for shared warehouse PVC:

  • The chart defaults persistence.accessModes to ReadWriteMany because HMS, catalogd, and impalad share the same warehouse volume and may run on different nodes.
  • If your cluster does not provide RWX-capable storage classes, override persistence.accessModes to ["ReadWriteOnce"] and ensure these pods are co-located on the same node.

Configure Impala (Helm)

Update any setting by editing values and running helm upgrade, or by --set.

Examples:

# Update memory/JVM
helm upgrade impala ./helm/impala -n impala \
  -f ./helm/impala/values-example.yaml \
  --set impalad.memLimit=12gb \
  --set impalad.javaToolOptions="-Xms2g -Xmx4g"

# Expose Impala externally
helm upgrade impala ./helm/impala -n impala \
  -f ./helm/impala/values-example.yaml \
  --set service.impalad.type=LoadBalancer

Optional services (Helm)

Enable Kudu

helm upgrade impala ./helm/impala -n impala \
  -f ./helm/impala/values-example.yaml \
  --set kudu.enabled=true

Enable Ranger service and Ranger auth flags

helm upgrade impala ./helm/impala -n impala \
  -f ./helm/impala/values-example.yaml \
  --set ranger.enabled=true \
  --set auth.ranger.enabled=true

Enable LDAP

values-ldap-example.yaml is for the OpenLDAP chart (openldap/openldap). values-impala-ldap-example.yaml is for the Impala chart LDAP auth settings.

Deploy OpenLDAP first install:

helm repo add openldap https://jp-gouin.github.io/helm-openldap/
helm repo update
helm install impala-ldap openldap/openldap \
  -n impala \
  -f ./helm/impala/values-ldap-example.yaml

For subsequent LDAP updates, use:

helm upgrade impala-ldap openldap/openldap \
  -n impala \
  -f ./helm/impala/values-ldap-example.yaml

Enable LDAP auth on Impala:

helm upgrade impala ./helm/impala -n impala \
  -f ./helm/impala/values-impala-ldap-example.yaml

For custom bind patterns, use --set-string auth.ldap.bindPattern='cn=#UID\,dc=example\,dc=org'.

When using --set for LDAP bind patterns, escape commas (\,) so Helm does not split the value into multiple assignments.

When using --set for list entries (for example kudu.master.extraArgs[0], kudu.master.extraArgs[1], ...), keep indices contiguous from 0. Sparse indices can render empty list elements, which may pass blank arguments to containers.

Enable OAuth token authentication

helm upgrade impala ./helm/impala -n impala \
  -f ./helm/impala/values-example.yaml \
  --set auth.oauth.enabled=true \
  --set auth.oauth.jwksUrl="https://idp.example.org/.well-known/jwks.json" \
  --set auth.oauth.jwtCustomClaimUsername="sub"

For non-TLS development environments only:

helm upgrade impala ./helm/impala -n impala \
  -f ./helm/impala/values-example.yaml \
  --set auth.oauth.enabled=true \
  --set auth.oauth.jwtValidateSignature=false \
  --set auth.oauth.allowWithoutTls=true

Secure cluster configuration (Helm)

Security options are opt-in and preserve non-secure quickstart defaults.

1) Create required inputs

Create a keytab secret (required when Kerberos is enabled):

kubectl -n impala create secret generic impala-kerberos-keytab \
  --from-file=impala.keytab=/path/to/impala.keytab

Create a TLS secret (required when TLS is enabled):

kubectl -n impala create secret generic impala-tls \
  --from-file=tls.crt=/path/to/tls.crt \
  --from-file=tls.key=/path/to/tls.key \
  --from-file=ca.crt=/path/to/ca.crt

Optional non-default krb5.conf:

kubectl -n impala create configmap impala-krb5-conf \
  --from-file=krb5.conf=/path/to/krb5.conf

2) Enable Kerberos/TLS flags in chart values

helm upgrade impala ./helm/impala -n impala \
  -f ./helm/impala/values-example.yaml \
  --set security.kerberos.enabled=true \
  --set security.kerberos.principal='impala/_HOST@EXAMPLE.COM' \
  --set security.kerberos.bePrincipal='impala/_HOST@EXAMPLE.COM' \
  --set security.kerberos.keytabSecretName='impala-kerberos-keytab' \
  --set security.kerberos.krb5ConfigMapName='impala-krb5-conf' \
  --set security.tls.enabled=true \
  --set security.tls.secretName='impala-tls'

3) (Optional) Enable Istio sidecar injection

helm upgrade impala ./helm/impala -n impala \
  -f ./helm/impala/values-example.yaml \
  --set security.istio.enabled=true

If Istio ingress/gateway terminates external TLS, prefer using Istio TLS and leave security.tls.enabled=false. Enabling both Istio TLS termination and security.tls.secretName at the same external endpoint can present different certificates to clients and is usually not desired unless explicitly configured.

Run Impala shell from laptop (tunnel)

Port-forward HS2:

kubectl -n impala port-forward \
  pod/$(kubectl -n impala get pod -o name | awk -F/ '/impala-impalad/{print $2; exit}') \
  21050:21050

In another terminal:

impala-shell --protocol=hs2 -i 127.0.0.1:21050 -q "select version();"

If LDAP is enabled:

impala-shell --protocol=hs2 \
  --ldap --auth_creds_ok_in_clear \
  --user impalauser --ldap_password_cmd="echo -n impala123" \
  -i 127.0.0.1:21050 \
  -q "select version();"

Operator structure

Operator root:

  • operator/impala-operator/main.py (reconciler)
  • operator/impala-operator/manifests/crd-impalacluster.yaml
  • operator/impala-operator/manifests/rbac.yaml
  • operator/impala-operator/manifests/deployment.yaml
  • operator/impala-operator/manifests/sample-impalacluster.yaml

Current model: the operator reconciles an ImpalaCluster CR and performs Helm installs/upgrades.

Deploy with Operator

Build and push operator image:

docker build -f operator/impala-operator/Dockerfile -t <registry>/impala-operator:latest .
docker push <registry>/impala-operator:latest

Install CRD/RBAC/deployment:

kubectl apply -k operator/impala-operator/manifests
kubectl -n impala-operator-system set image deploy/impala-operator \
  operator=<registry>/impala-operator:latest
kubectl -n impala-operator-system rollout status deploy/impala-operator

Operator RBAC scope

The operator no longer relies on cluster-admin.

The default RBAC in operator/impala-operator/manifests/rbac.yaml grants:

  • control-plane permissions for impalaclusters status/finalizers and CRD discovery
  • namespaced Helm reconcile permissions for resources used by the Impala chart (Deployment, StatefulSet, Service, ConfigMap, PersistentVolumeClaim, Secret, and related supporting resources)

Optional-component notes:

  • Kudu and Ranger are covered by the default namespaced permissions above.
  • LDAP (OpenLDAP chart) may enable additional namespaced resources depending on values (for example Role, RoleBinding, Job, NetworkPolicy, Ingress, and HorizontalPodAutoscaler), which are also included in the default role.
  • If you customize LDAP values to use resource kinds outside this set, extend the operator ClusterRole accordingly.

Create the target namespace used by the sample CR:

kubectl create namespace impala --dry-run=client -o yaml | kubectl apply -f -

Create cluster CR:

kubectl apply -f operator/impala-operator/manifests/sample-impalacluster.yaml
kubectl get impalacluster -n impala

Update daemon and query configs with typed CR keys:

kubectl patch impalacluster impala-demo -n impala --type merge -p '{
  "spec": {
    "config": {
      "impalad": {
        "flags": {
          "num_reactor_threads": "0"
        },
        "queryDefaults": {
          "mt_dop": "4",
          "default_file_format": "parquet"
        }
      }
    }
  }
}'

For advanced overrides that are not modeled by typed keys, continue to use spec.set.

Enable optional services via CR patch:

kubectl patch impalacluster impala-demo -n impala --type merge -p '{
  "spec": {
    "kuduEnabled": true,
    "rangerEnabled": true,
    "rangerAuthEnabled": true,
    "ldapValuesFile": "/charts/impala/values-ldap-example.yaml",
    "ldapEnabled": true,
    "ldapUri": "ldaps://impala-ldap-openldap:636",
    "ldapBindPattern": "cn=#UID,dc=example,dc=org"
  }
}'

For ImpalaCluster.spec.ldapBindPattern, provide raw DN syntax (no comma escaping). The operator handles Helm --set-string escaping internally.

Enable OAuth via advanced spec.set overrides:

kubectl patch impalacluster impala-demo -n impala --type merge -p '{
  "spec": {
    "set": {
      "auth.oauth.enabled": "true",
      "auth.oauth.jwksUrl": "https://idp.example.org/.well-known/jwks.json",
      "auth.oauth.jwtCustomClaimUsername": "sub"
    }
  }
}'

Enable secure-cluster overrides via spec.set:

kubectl patch impalacluster impala-demo -n impala --type merge -p '{
  "spec": {
    "set": {
      "security.kerberos.enabled": "true",
      "security.kerberos.principal": "impala/_HOST@EXAMPLE.COM",
      "security.kerberos.keytabSecretName": "impala-kerberos-keytab",
      "security.tls.enabled": "true",
      "security.tls.secretName": "impala-tls",
      "security.istio.enabled": "true"
    }
  }
}'

Troubleshooting

If HMS fails creating directories on the storage volume, set HMS pod user/group:

helm upgrade impala ./helm/impala -n impala \
  -f ./helm/impala/values-example.yaml \
  --set hms.securityContext.runAsUser=0 \
  --set hms.securityContext.runAsGroup=0

If catalog startup fails due to HMS notification API compatibility, disable HMS event polling:

helm upgrade impala ./helm/impala -n impala \
  -f ./helm/impala/values-example.yaml \
  --set catalogd.hmsEventPollingIntervalS=0

Automated chart checks

From the repository root, run:

./helm/impala/tests/run-chart-tests.sh

This script runs helm lint, renders default and override manifests with helm template, and validates key chart behavior with assertions. Coverage includes default core settings plus optional LDAP, Ranger, Kudu, OAuth, and secure-cluster (Kerberos/TLS/Istio) rendering paths.

Required dependencies to run this harness:

  • helm 3.x on PATH
  • impala-python3 on PATH (or Impala dev environment sourced)
  • shell utilities used by the script (bash, mktemp)

This is a render-time validation suite; it does not require a running Kubernetes cluster or Docker runtime.

Kubernetes end-to-end test smoke run

Use the upstream test harness against an existing Kubernetes deployment:

K8S_NAMESPACE=impala \
K8S_IMPALAD_SERVICE=impala-impala-impalad \
./bin/run-k8s-e2e-tests.sh

By default this script port-forwards the Impalad service and runs tests/infra/test_k8s_external_cluster.py in remote-cluster mode. If service-level port-forwarding is not reliable in a local runtime, set K8S_PORT_FORWARD_MODE=pod (or use auto to try service first, then pod). Override the test target with K8S_TEST_TARGET or pass additional pytest arguments after the script name.

For Jenkins-style ephemeral Kubernetes execution from this repository, use:

./bin/jenkins/run-k8s-e2e-tests.sh

This script now supports both kind and k3d Kubernetes-in-Docker runtimes:

# Default runtime is kind
K8S_E2E_RUNTIME=kind ./bin/jenkins/run-k8s-e2e-tests.sh

# Use k3d as an alternate runtime
K8S_E2E_RUNTIME=k3d ./bin/jenkins/run-k8s-e2e-tests.sh

For architecture details and runtime diagrams, see helm/impala/kubernetes-in-docker-e2e.md.

Control-plane guidance

Use one control path per release/namespace:

  • Helm-managed release: update with Helm commands
  • Operator-managed release: update via ImpalaCluster spec

Do not manage the same release with both at the same time.