Installation and Configuration

Installation

To install the Platfom BigQuery interceptor:

1. First, pull the BigQuery interceptor container image from PlainID Container Registry using the docker pull command:

docker pull <platform registry location>:<version>

For example:

docker pull gcr.io/plainid-presales/bigquery:1.0

1. Create a secret from the credentials JSON:

Note - The credentials JSON

kubectl create secret generic google-creds --from-file=<json location>

For example:

kubectl create secret generic google-creds --from-file=query-enforcer/creds.json

1. Make the required changes in bigq.yaml. Check the Sample Configuration below
2. Apply the bigq.yaml

kubectl apply -f bigq.yaml

Sample Configuration bigq.yaml

This sample bigq.yaml contains the following yamls:

• Configmap
• Service
• Deployment
• Secret (Optional)

apiVersion: v1
data:
  application.properties: |
    server.port=8080
    #server.tomcat.uri-encoding=UTF-8
    #server.error.whitelabel.enabled=false

    logging.config=classpath:logback-spring.xml
#   The PlainID logging level options include trace, debug, info, error, and OFF. 
    logging.level.org.springframework=OFF
    logging.level.org.springframework.core=OFF
    logging.level.org.springframework.beans=OFF
    logging.level.org.springframework.context=OFF
    logging.level.org.springframework.transaction=OFF
    logging.level.org.springframework.web=OFF
    logging.level.org.springframework.test=OFF
    logging.level.org.springframework.data=OFF
    logging.level.com.google.zetasql=info
    logging.level.com.plainid=error

    spring.main.banner-mode=OFF
    spring.http.encoding.charset=UTF-8
    spring.http.encoding.enabled=true
    spring.http.encoding.force=true
    spring.mvc.throw-exception-if-no-handler-found=true
    spring.resources.add-mappings=false

    spring.redis.host=redis.example.com
    spring.redis.port=6379
    spring.redis.password=SXSIvHJo1OzaWnU2YHZ8p3us0z
    spring.data.redis.ssl.enabled=true

    management.security.enabled=false
    management.endpoints.enabled-by-default=false
    management.endpoints.web.exposure.include=info, health
    management.endpoint.info.enabled=true
    management.endpoint.health.enabled=true
    management.endpoint.health.show-components=always
    management.endpoint.health.show-details=always
    management.endpoint.health.probes.enabled=true
    management.endpoint.health.group.liveness.include=livenessState
    management.endpoint.health.group.liveness.show-details=always
    management.endpoint.health.group.readiness.include=readinessState
    management.endpoint.health.group.readiness.show-details=always
    management.health.postgres.enabled=true
    management.health.readinessstate.enabled=true
    management.info.git.mode=full

    spring.cloud.gcp.core.enabled=false
    spring.cloud.gcp.bigquery.enabled=false

    app.request-context.prefix=context
# update the following parameter to your PDP URL
    app.policy-resolution.api-url=https://URL-TO-PDP-RUNTIME/api/runtime/resolution/v3
    app.cache.prefix=query-enforcer.v2
    app.cache.ttl-policy-resolution=3000
    app.cache.ttl-db-schema-initial-delay=3000
    app.cache.ttl-db-schema=600000
    app.cache.ttl-catalog=300000
# update to the full path of the GCP Service Account Credentials file:
    app.enforcer.bigquery-credential-files[0]=file:creds.json
    app.enforcer.resolutionresponse-empty=deny
    app.enforcer.resolutionaccess-empty=deny
    app.enforcer.resolutionprivileges-empty=allow
    app.enforcer.ignoreforbidden-columns=deny
    app.enforcer.columnenforcermasks[string]=***
    app.enforcer.resolutionmasking-as-column=deny
    app.enforcer.resolution-attribute-projectId=projectid
    app.enforcer.resolution-attribute-dataset=dataset
    app.enforcer.resolution-attribute-table=table
    app.enforcer.resolution-attribute-column=column
    app.enforcer.bigquery-information-schema=allow
    app.enforcer.ignore-enforcer-fails=deny
    # app.enforcer.ignore-tables[0]=plainid-142815.*.*
    app.enforcer.ignore-forbidden-columns=deny
    # SSL configuration (Uncomment to enable SSL)
    # The format used for the keystore. It could be set to JKS in case it is a JKS file
    # server.ssl.key-store-type=PKCS12
    # The path to the keystore containing the certificate
    # server.ssl.key-store=/app/keystore.jks
    # The password used to generate the certificate
    # server.ssl.key-store-password=111
    # The alias mapped to the certificate
    # server.ssl.key-alias=111
    # security.require-ssl=false
kind: ConfigMap
metadata:
  name: bigq-config

---
apiVersion: v1
kind: Service
metadata:
  name: bigq
spec:
  selector:
    app: bigq
  ports:
  - name: "bigq"
    protocol: "TCP"
    port: 8080
    targetPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: bigq
spec:
  selector:
    matchLabels:
      app: bigq
  strategy:
    rollingUpdate:
      maxSurge: 2
      maxUnavailable: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: bigq
    spec:
      containers:
# The following 3 lines are optional - depending on the used redis - internal or managed
       - image: redis
         name: redis
         resources: {}
# Use the Image and Tag provided by PlainID
       - image: plainid/authz-bigquery:5.2321.0
         imagePullPolicy: Always
         name: bigq
         resources: {}
         volumeMounts:
         - name: bigq
           mountPath: /app/application.properties
           subPath: application.properties
         - name: creds
           mountPath: /app/creds.json
# The name of the credentials JSON file - matching the name of the local file `creds.json`
           subPath: creds.json
      volumes:
      - name: bigq
        configMap:
          name: bigq-config
      - name: creds
        secret:
          secretName: google-creds

Configuration Properties

Optional Configuration to create the secret on-the-fly

Append the following yaml to the bigq.yaml:

apiVersion: v1
metadata:
  name: google-creds
data:
  creds.json: the-gcp-iam-service-user-credentials-content
kind: Secret

Configuration

Required Parameters/Attributes