(Recommended) Secure approach for passing a token

In this approach, you use Kubernetes' method of distributing secrets. You first encode the credentials and then add the encoded bit as a data item in the HUE_AI_INTERFACE_TOKEN property. The token becomes available in the Data Explorer pod as an environment variable.

To run the kubectl commands listed below, you must:

  1. Have kubectl installed on your local machine.
  2. Download and configure the kubeconfig file for the specific Cloudera Data Warehouse environment. You can obtain this from the Cloudera Management Console under the Container Service environment settings.
  3. Ensure your user account or service principal has the necessary Role-Based Access Control (RBAC) permissions to edit secrets within the Virtual Warehouse namespace.
  1. Use a base64 encoding tool to convert your token to a base-64 representation by running the following command:
    echo -n '[***MY-TOKEN***]' | base64
    Replace [***MY-TOKEN***] with the token value you want to encode.
  2. Open a terminal session and run the following command to add the encoded secret:
    kubectl edit secret hue-secret -n [***VIRTUAL-WAREHOUSE-NAMESPACE***]
    Replace [***VIRTUAL-WAREHOUSE-NAMESPACE***] with the actual Virtual Warehouse ID (same as the namespace) in which you want to add the secret.
  3. Add the encoded value returned for your token in the HUE_AI_INTERFACE_TOKEN property as follows:
    ...
    apiVersion: v1
    data:
      HADOOP_CREDSTORE_PASSWORD: [***ENCODED-HADOOP-CREDSTORE-PASSWORD***]
      HUE_AI_INTERFACE_TOKEN: [***ENCODED-TOKEN-VALUE***]
    kind: Secret
    Replace [***ENCODED-TOKEN-VALUE***] with the actual encoded value returned for your token.