Retrieve nifi config properties from Secret

[deebify]

I want to get the value from a secret

apiVersion: nifi.stackable.tech/v1alpha1
kind: NifiCluster
metadata:
  name: simple-nifi
spec:
  image:
    productVersion: 1.21.0
    stackableVersion: 23.7.0
  clusterConfig:
    listenerClass: external-unstable
    authentication:
      - authenticationClass: simple-nifi-users
    extraVolumes:
      - name: nifi-oidc-authorizers
        configMap:
          name: nifi-oidc-authorizers
    sensitiveProperties:
      keySecret: nifi-sensitive-property-key
      autoGenerate: true
    zookeeperConfigMapName: simple-nifi-znode
  nodes:
    configOverrides:
      nifi.properties:
        nifi.security.user.authorizer: managed-authorizer
        nifi.security.user.oidc.client.id: CLIENT_ID 
        nifi.security.user.oidc.client.secret: CLIENT_SECRET << Get from a secret
        nifi.security.user.oidc.discovery.url: https://KEYCLOAK_HOST/realms/KEYCLOAK_REALM/.well-known/openid-configuration
        nifi.security.user.oidc.claim.identifying.user: preferred_username
        nifi.authorizer.configuration.file: /stackable/userdata/nifi-oidc-authorizers/authorizers.xml
    roleGroups:
      default:
        replicas: 1

[sbernauer]

Hi @deebify you should be able to use https://druid.apache.org/docs/latest/operations/password-provider
So something like this (not tested):

nifi.security.user.oidc.client.secret: '{"type":"environment","variable":"DRUID_CLIENT_SECRET"}'

and than use an podOverride to mount the env var from a Secret

    podOverrides: &pod-overrides
      spec:
        containers:
          - name: druid
            env:
              - name: DRUID_CLIENT_SECRET
                valueFrom:
                  secretKeyRef:
                    name: keycloak-client-secrets
                    key: druid

Copied the code from this working example https://github.com/stackabletech/demos/blob/main/stacks/keycloak-opa-poc/druid.yaml

@labrenbe would you be willing to update the test you added to pull in the secret securely using this method?

[sbernauer]

Ohhh, sorry though this is Druid. Actually let me check for NiFi.

It sadly looks like NiFi does not support this :/ So without really hacky workarounds I sadly currently don't see an options to do that, sorry!

However, we will add proper OIDC support in stackabletech/nifi-operator#519, which will give a secure way of specifying the credentials.