From 0275b64a1decb21a4c71c0f10def718d56786f0c Mon Sep 17 00:00:00 2001 From: SteBaum Date: Wed, 5 Aug 2026 13:56:54 +0200 Subject: [PATCH 1/5] refactor(trino): only deploy OPAL when enabled and make the trino deployment not dependant on it --- packages/services/trino/trino.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/packages/services/trino/trino.yaml b/packages/services/trino/trino.yaml index b058f46..2034b89 100644 --- a/packages/services/trino/trino.yaml +++ b/packages/services/trino/trino.yaml @@ -19,7 +19,7 @@ name: trino #tag: 480-p01 # Currently, the UI requires the version to conform to SemVer (https://simversion.github.io/) # https://github.com/OKDP/okdp-ui/blob/main/src/app/shared/utils/utils.ts#L131 -tag: 480.0.0-p06 +tag: 480.0.0-p07 protected: false description: | Apache Trino - Distributed SQL query engine designed for large-scale data processing across multiple data sources. @@ -62,6 +62,7 @@ schema: modules: - name: opa + enabled: "{{ .Parameters.enableOPA }}" timeout: 10m source: helmRepository: @@ -86,6 +87,7 @@ modules: create: false - name: opal-secrets + enabled: "{{ .Parameters.enableOPA }}" timeout: 10m source: oci: @@ -94,6 +96,7 @@ modules: values: | fullnameOverride: {{ .Release.metadata.name }}-opal-secrets - name: opal + enabled: "{{ .Parameters.enableOPA }}" dependsOn: - opa - opal-secrets @@ -189,8 +192,6 @@ modules: OIDC_SCOPES: "{{ printf "%d %o" .Parameters.defaultclientScopes .Parameters.optionalClientScopes | join " " }}" - name: main - dependsOn: - - opal timeout: 10m source: helmRepository: From 43e8f18ec7b7250dc1688b449071489cc26b05f5 Mon Sep 17 00:00:00 2001 From: SteBaum Date: Wed, 5 Aug 2026 14:02:55 +0200 Subject: [PATCH 2/5] feat(trino): add opa status and deceison logs --- packages/services/trino/trino.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/packages/services/trino/trino.yaml b/packages/services/trino/trino.yaml index 2034b89..91dff4b 100644 --- a/packages/services/trino/trino.yaml +++ b/packages/services/trino/trino.yaml @@ -79,6 +79,10 @@ modules: pullPolicy: IfNotPresent useHttps: false port: 8181 + extraArgs: + - "--log-format=json-pretty" + - "--set=status.console=true" + - "--set=decision_logs.console=true" mgmt: enabled: false rbac: From 4e097001f2c00b37121fad3497c8be6c11f0a111 Mon Sep 17 00:00:00 2001 From: SteBaum Date: Wed, 5 Aug 2026 14:27:51 +0200 Subject: [PATCH 3/5] feat(trino): add opa-kubemanagement and make OPAL optional as well as upgrade okdp-examples now containing configmaps for opa-kubemanagment --- .../services/okdp-examples/okdp-examples.yaml | 4 ++-- packages/services/trino/trino.yaml | 24 +++++++++++++++---- 2 files changed, 21 insertions(+), 7 deletions(-) diff --git a/packages/services/okdp-examples/okdp-examples.yaml b/packages/services/okdp-examples/okdp-examples.yaml index 4587fd6..4f891a3 100644 --- a/packages/services/okdp-examples/okdp-examples.yaml +++ b/packages/services/okdp-examples/okdp-examples.yaml @@ -16,7 +16,7 @@ apiVersion: v1alpha1 name: okdp-examples -tag: 1.2.0-p01 +tag: 1.3.0-p01 protected: false description: | A collection of hands-on examples, helper utilities, Jupyter notebooks, @@ -36,7 +36,7 @@ modules: source: oci: repository: quay.io/okdp/charts/okdp-examples - tag: 1.2.0 + tag: 1.3.0 values: | {{- $namespace := printf "%v" .Release.spec.targetNamespace -}} diff --git a/packages/services/trino/trino.yaml b/packages/services/trino/trino.yaml index 91dff4b..83c4725 100644 --- a/packages/services/trino/trino.yaml +++ b/packages/services/trino/trino.yaml @@ -36,6 +36,7 @@ schema: workerMemoryGi: { type: number, default: 2, multipleOf: 0.25, description: "Worker memory (GiB) used for Kubernetes requests/limits (recommended: request=limit)." } workerCpu: { type: number, default: 0.5, multipleOf: 0.25, description: "Worker CPU request in millicores (e.g., 500=0.5 vCPU, 1000=1 vCPU)." } enableOPA: { type: boolean, default: true, description: "Whether to enable OPA." } + enableOPAL: { type: boolean, default: false, description: "Whether to enable OPAL." } policyRepoUrl: { type: string, default: "https://github.com/OKDP/okdp-examples.git", description: "OPA policy repo URL" } policyRepoMainBranch: { type: string, default: "main", description: "OPA policy repo branch." } OPAL_POLICY_SUBSCRIPTION_DIRS: {type: string, default: "trino_opa_policy", description: "Policy directories in the repository for which the client will subscribe to, seperated by ':'."} @@ -84,14 +85,27 @@ modules: - "--set=status.console=true" - "--set=decision_logs.console=true" mgmt: - enabled: false + enabled: {{ not .Parameters.enableOPAL }} + startupProbe: + failureThreshold: 5 + httpGet: + path: /health + port: 8181 + scheme: HTTP + initialDelaySeconds: 20 + successThreshold: 1 + timeoutSeconds: 10 + data: + enabled: true + policies: + enabled: true rbac: - create: false + create: {{ not .Parameters.enableOPAL }} serviceAccount: - create: false + create: {{ not .Parameters.enableOPAL }} - name: opal-secrets - enabled: "{{ .Parameters.enableOPA }}" + enabled: "{{ and .Parameters.enableOPA .Parameters.enableOPAL }}" timeout: 10m source: oci: @@ -100,7 +114,7 @@ modules: values: | fullnameOverride: {{ .Release.metadata.name }}-opal-secrets - name: opal - enabled: "{{ .Parameters.enableOPA }}" + enabled: "{{ and .Parameters.enableOPA .Parameters.enableOPAL }}" dependsOn: - opa - opal-secrets From cbd5a2385d0c8568f56b609425233520f66638b7 Mon Sep 17 00:00:00 2001 From: SteBaum <94869007+SteBaum@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:36:30 +0200 Subject: [PATCH 4/5] refactor(trino): add details to the enableOPAL parameter description Co-authored-by: abir-oumghar --- packages/services/trino/trino.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/services/trino/trino.yaml b/packages/services/trino/trino.yaml index 83c4725..aa8bfcf 100644 --- a/packages/services/trino/trino.yaml +++ b/packages/services/trino/trino.yaml @@ -36,7 +36,8 @@ schema: workerMemoryGi: { type: number, default: 2, multipleOf: 0.25, description: "Worker memory (GiB) used for Kubernetes requests/limits (recommended: request=limit)." } workerCpu: { type: number, default: 0.5, multipleOf: 0.25, description: "Worker CPU request in millicores (e.g., 500=0.5 vCPU, 1000=1 vCPU)." } enableOPA: { type: boolean, default: true, description: "Whether to enable OPA." } - enableOPAL: { type: boolean, default: false, description: "Whether to enable OPAL." } + enableOPAL: { type: boolean, default: false, description: "Whether to enable OPAL. When false, OPA policies are loaded from labeled ConfigMaps by the kube-mgmt sidecar." } + enableOPADebugLogs: { type: boolean, default: false, description: "Log OPA status and decision logs to the container console. Verbose, intended for debugging." } policyRepoUrl: { type: string, default: "https://github.com/OKDP/okdp-examples.git", description: "OPA policy repo URL" } policyRepoMainBranch: { type: string, default: "main", description: "OPA policy repo branch." } OPAL_POLICY_SUBSCRIPTION_DIRS: {type: string, default: "trino_opa_policy", description: "Policy directories in the repository for which the client will subscribe to, seperated by ':'."} From 4f329a340c9085d490751d2cb9049ae582c8133b Mon Sep 17 00:00:00 2001 From: SteBaum <94869007+SteBaum@users.noreply.github.com> Date: Thu, 6 Aug 2026 13:52:34 +0200 Subject: [PATCH 5/5] feat(trino): make debug logs optional Co-authored-by: abir-oumghar --- packages/services/trino/trino.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/services/trino/trino.yaml b/packages/services/trino/trino.yaml index aa8bfcf..3175285 100644 --- a/packages/services/trino/trino.yaml +++ b/packages/services/trino/trino.yaml @@ -81,10 +81,11 @@ modules: pullPolicy: IfNotPresent useHttps: false port: 8181 + {{- if .Parameters.enableOPADebugLogs }} extraArgs: - - "--log-format=json-pretty" - "--set=status.console=true" - "--set=decision_logs.console=true" + {{- end }} mgmt: enabled: {{ not .Parameters.enableOPAL }} startupProbe: