healthcheck technical user with multiple authenticators

[fhennig]

Problem

The k8s healthcheck probes make HTTP requests which get blocked by Druid if Authorization is enabled.

Proposed solution

We need a technical user to make these probe requests, in case authentication and authorization are enabled. Otherwise the endpoints cannot be queried.

Druid supports an authentication and authorization chain, with multiple authenticators/authorizers. We can add a second mini-authenticator for just a single health-check user, or maybe reuse the existing one for basic auth, on top of LDAP. we can then use this user to do our health checks. The user should be created automatically, with generated credentials.

Open Questions

• The healthchecks are made from a k8s Probe: https://docs.rs/k8s-openapi/latest/k8s_openapi/api/core/v1/struct.Probe.html
  • does the probe support HTTPS? without HTTPS, basic auth isn't safe.