Apache Ignite database secrets engine

Apache Ignite is one of the supported plugins for the database secrets engine. This plugin generates dynamic credentials against an Apache Ignite cluster using the cluster's thin client binary protocol. It also supports Static Roles.

See the database secrets engine docs for more information about setting up the database secrets engine.

Statements from creation_statements, revocation_statements, and password rotation are all run as SQL over the thin client protocol (default port 10800) with no bound cache, so user-management DDL works even on a cluster with no user-created caches. Dynamic credentials become native SQL users created with CREATE USER / ALTER USER / DROP USER DDL, which requires Ignite 2.5+ with persistence enabled and authenticationEnabled=true set on the cluster's IgniteConfiguration — without cluster-side authentication enabled, CREATE USER is rejected.

Capabilities

Plugin Name	Root Credential Rotation	Dynamic Roles	Static Roles	Username Customization
ignite-database-plugin	No	Yes	Yes	Yes

Setup

1. Enable the database secrets engine if it is not already enabled:

   $ bao secrets enable database
   Success! Enabled the database secrets engine at: database/

   By default, the secrets engine will enable at the name of the engine. To enable the secrets engine at a different path, use the -path argument.

2. Configure OpenBao with the proper plugin and connection information. The url must point at the Ignite thin client listener (typically port 10800):

   $ bao write database/config/ignite \
       plugin_name="ignite-database-plugin" \
       allowed_roles="reader" \
       url="tcp://ignite.example.com:10800" \
       username="ignite" \
       password="ignite"
   Success! Data written to: database/config/ignite

3. Configure a role that maps a name in OpenBao to the SQL statements executed to create the database credential. Ignite's CREATE USER DDL does not accept parameters, so the plugin renders {{name}} (or {{username}}) and {{password}} directly into the statement after validating both against a safe character set:

   $ bao write database/roles/reader \
       db_name="ignite" \
       creation_statements="CREATE USER \"{{name}}\" WITH PASSWORD '{{password}}';" \
       default_ttl="1h" \
       max_ttl="24h"
   Success! Data written to: database/roles/reader

Usage

After the secrets engine is configured and a user/machine has an OpenBao token with the proper permission, it can generate credentials.

1. Generate a new credential by reading from the /creds endpoint with the name of the role:

   $ bao read database/creds/reader
   Key                Value
   ---                -----
   lease_id           database/creds/reader/2f6a614c-4aa2-7b19-24b9-ad944a8d4de6
   lease_duration     1h
   lease_renewable    true
   password           SsnoaA-8Tv4t34f41baD
   username           V_TOKEN_READER_USZT1N4C

Ignite-specific notes

• Thin client protocol: Apache Ignite has no official Go driver, so this plugin speaks the binary thin client protocol via amsokol/ignite-go-client — the same library KubeDB's tooling uses. url should be the thin client address (tcp://host:10800); only host and port are used, and explicit host/port fields override it.
• Cluster-side authentication is required: authenticationEnabled=true must be set on the cluster's IgniteConfiguration, and persistence must be enabled, or CREATE USER / ALTER USER / DROP USER will be rejected by the cluster.
• Server errors are surfaced verbatim: failures reported by the cluster (for example, the cluster not being in an active state, or authentication not being enabled) are returned as errors rather than silently ignored.
• Identifier and password safety: Because Ignite DDL cannot be parameterized, the plugin validates identifiers and passwords before building SQL strings. Usernames generated by the username producer are uppercased and have - converted to _; any identifier containing ", ', ;, or ` is rejected, and any password containing a single quote is rejected outright (Ignite DDL has no way to escape it safely). If you set a custom password_policy, make sure it cannot produce single quotes.
• No native credential expiration: Ignite has no VALID UNTIL construct for users, so there's nothing for {{expiration}} to substitute into — the plugin does not render it into statements. Credential lifetime is enforced entirely by OpenBao's lease system, which calls revocation_statements (or DROP USER "<name>" by default) when a lease expires or is revoked.
• No root credential rotation: The plugin does not implement root credential rotation (database/rotate-root).
• rollback_statements and root_rotation_statements are accepted but unused: both fields are accepted by the database secrets engine framework for compatibility, but this plugin ignores them. User creation has no separate rollback step, and static role rotation always executes ALTER USER "<name>" WITH PASSWORD '<password>' regardless of any statements supplied.

API

The full list of configurable options can be seen in the Apache Ignite database plugin API page.

For more information on the database secrets engine's HTTP API please see the Database secrets engine API page.