Helm chart from `main` as of 2025-08-11 is not compatible with 1.0.x binaires (provides incorrect defaults)

[bacek]

polaris/helm/polaris/values.yaml

Line 567 in bae5444

type: default

type for both authenticator and roleProvider should be one of internal, external, or hybrid. default is not accepted by polaris itself

[adutra]

Hi @bacek thanks for reporting this.

There are two different settings:

authentication.type: internal
authentication.authenticator.type: default

• authentication.type can be: internal, external, or mixed.
• authentication.authenticator.type can only be default (for now).

Does that make sense?

[bacek]

Hi @adutra

I probably didn't put it clearly.

Problem is: existing helm chart provides defaults which can't be used. Generated configmap with defaults is

polaris.authentication.active-roles-provider.type=default
polaris.authentication.authenticator.type=default
polaris.authentication.token-broker.max-token-generation=PT1H
polaris.authentication.token-broker.type=rsa-key-pair
polaris.authentication.token-service.type=default
polaris.authentication.type=internal
polaris.file-io.type=default
polaris.log.request-id-header-name=Polaris-Request-Id
polaris.persistence.type=in-memory
polaris.rate-limiter.filter.type=no-op
polaris.realm-context.realms=POLARIS
polaris.realm-context.type=default
quarkus.http.port=8181
quarkus.log.category."org.apache.iceberg.rest".level=INFO
quarkus.log.category."org.apache.polaris".level=INFO
quarkus.log.console.enable=true 
quarkus.log.console.format=%d{yyyy-MM-dd HH:mm:ss,SSS} %-5p [%c{3.}] [%X{requestId},%X{realmId}] [%X{traceId},%X{parentId},%X{spanId},%X{sampled}] (%t) %s%e%n quarkus.log.console.level=ALL
quarkus.log.file.enable=false
quarkus.log.level=INFO
quarkus.management.port=8182quarkus.otel.sdk.disabled=true                                                                                                                                                      

Pod is failing with

Configuration validation failed:                                                                                                                                                           java.lang.IllegalArgumentException: SRCFG00039: The config property polaris.authentication.active-roles-provider.type with the config value "default" threw an Exception whilst being converted SRCFG00049: Cannot convert default to enum class org.apache.polaris.service.auth.AuthenticationType, allowed values: internal,external,mixed                                     │

Yes, you are absolutely correct and actual behaviour.

[adutra]

@bacek

Your configuration above is correct. I deployed a Polaris pod with it and the pod came up without problems.

Which version of Polaris are you deploying? Can you try with apache/polaris:latest from Docker Hub?

[bacek]

It was 1.0.0-incubating. I'll try latest later today.

[bacek]

Same results with 1.0.1-incubating-rc0.

[bacek]

Same with latest (sha256:82ba0c7b73bc476f0a37abf4d9f7e90960221600513d189af1ccc48ee9e4f71c)

[dimas-b]

Just FYI: 1.0.1 has the same java code as 1.0.0 (only helm charts are different).

[dimas-b]

Configuration validation failed:
java.lang.IllegalArgumentException: SRCFG00039: The config property polaris.authentication.active-roles-provider.type with
the config value "default" threw an Exception whilst being converted SRCFG00049: Cannot convert default to enum class
org.apache.polaris.service.auth.AuthenticationType, allowed values: internal,external,mixed │

@adutra : it looks like QuarkusAuthenticationConfiguration from the 1.0.0 state of the code treats the active-roles-provider part of the config name as a "realm", subsequently it tries to parse .type as QuarkusAuthenticationRealmConfiguration.type() (and fails) 🤷

[dimas-b]

@bacek : which version of the Helm Charts did you use?

[adutra]

OK I tried again with:

• Helm chart: 1.0.0-incubating
• Image: 1.0.0-incubating

And it worked. Note that this version does not have external auth.

But then I tried with:

• Helm chart: from main branch
• Image: 1.0.1-incubating-rc0

And I finally got the error:

Configuration validation failed:
	java.lang.IllegalArgumentException: SRCFG00039: The config property polaris.authentication.active-roles-provider.type with the config value "default" threw an Exception whilst being converted SRCFG00049: Cannot convert default to enum class org.apache.polaris.service.auth.AuthenticationType, allowed values: internal,external,mixed

Investigating...

[dimas-b]

@adutra : could you double-check helm charts from 1.0.1 RC0 too? (they worked for me, IIRC)

[adutra]

OK I see the issue:

The image doesn't have this commit: b96461a which makes active-roles-provider configurable per realm.

Before that commit, the roles provider was configured with polaris.active-roles-provider.type. So polaris.authentication.active-roles-provider.type doesn't exist in this version.

But the current Helm chart in the main branch does have support for this option, which is why the configmap contains:

polaris.authentication.type=internal
polaris.authentication.active-roles-provider.type=default

Now since polaris.authentication.active-roles-provider.type doesn't exist, SmallRye is considering that active-roles-provider is the name of a realm, and that for that realm, the authentication type is default – which is indeed incorrect.

TLDR: the 1.0.1-incubating-rc0 image can only work with Helm charts before b96461a.

[adutra]

@adutra : could you double-check helm charts from 1.0.1 RC0 too? (they worked for me, IIRC)

It works for me as well.

@bacek Could you try with the below options please?

• This Helm chart: https://dist.apache.org/repos/dist/dev/incubator/polaris/helm-chart/1.0.1-incubating/
• This image: 1.0.1-incubating-rc0