Examples with KafkaClientAuthentication io.strimzi.api.kafka.model.authentication.KafkaClientAuthentication used on opensource projects

Example 1 with KafkaClientAuthentication

use of io.strimzi.api.kafka.model.authentication.KafkaClientAuthentication in project strimzi by strimzi.

the class UtilTest method getHashOk.

@Test
public void getHashOk() {
    String namespace = "ns";
    GenericSecretSource at = new GenericSecretSourceBuilder().withSecretName("top-secret-at").withKey("key").build();
    GenericSecretSource cs = new GenericSecretSourceBuilder().withSecretName("top-secret-cs").withKey("key").build();
    GenericSecretSource rt = new GenericSecretSourceBuilder().withSecretName("top-secret-rt").withKey("key").build();
    KafkaClientAuthentication kcu = new KafkaClientAuthenticationOAuthBuilder().withAccessToken(at).withRefreshToken(rt).withClientSecret(cs).build();
    CertSecretSource css = new CertSecretSourceBuilder().withCertificate("key").withSecretName("css-secret").build();
    Secret secret = new SecretBuilder().withData(Map.of("key", "value")).build();
    SecretOperator secretOps = mock(SecretOperator.class);
    when(secretOps.getAsync(eq(namespace), eq("top-secret-at"))).thenReturn(Future.succeededFuture(secret));
    when(secretOps.getAsync(eq(namespace), eq("top-secret-rt"))).thenReturn(Future.succeededFuture(secret));
    when(secretOps.getAsync(eq(namespace), eq("top-secret-cs"))).thenReturn(Future.succeededFuture(secret));
    when(secretOps.getAsync(eq(namespace), eq("css-secret"))).thenReturn(Future.succeededFuture(secret));
    Future<Integer> res = Util.authTlsHash(secretOps, "ns", kcu, singletonList(css));
    res.onComplete(v -> {
        assertThat(v.succeeded(), is(true));
        // we are summing "value" hash four times
        assertThat(v.result(), is("value".hashCode() * 4));
    });
}

Example 2 with KafkaClientAuthentication

use of io.strimzi.api.kafka.model.authentication.KafkaClientAuthentication in project strimzi by strimzi.

the class KafkaMirrorMaker2Cluster method getEnvVars.

@SuppressWarnings({ "checkstyle:CyclomaticComplexity", "checkstyle:NPathComplexity" })
@Override
protected List<EnvVar> getEnvVars() {
    List<EnvVar> varList = super.getEnvVars();
    final StringBuilder clusterAliases = new StringBuilder();
    final StringBuilder clustersTrustedCerts = new StringBuilder();
    boolean hasClusterWithTls = false;
    final StringBuilder clustersTlsAuthCerts = new StringBuilder();
    final StringBuilder clustersTlsAuthKeys = new StringBuilder();
    final StringBuilder clustersSaslPasswordFiles = new StringBuilder();
    boolean hasClusterOauthTrustedCerts = false;
    final StringBuilder clustersOauthClientSecrets = new StringBuilder();
    final StringBuilder clustersOauthAccessTokens = new StringBuilder();
    final StringBuilder clustersOauthRefreshTokens = new StringBuilder();
    for (KafkaMirrorMaker2ClusterSpec mirrorMaker2Cluster : clusters) {
        String clusterAlias = mirrorMaker2Cluster.getAlias();
        if (clusterAliases.length() > 0) {
            clusterAliases.append(";");
        }
        clusterAliases.append(clusterAlias);
        if (mirrorMaker2Cluster.getTls() != null) {
            hasClusterWithTls = true;
        }
        getClusterTrustedCerts(clustersTrustedCerts, mirrorMaker2Cluster, clusterAlias);
        KafkaClientAuthentication authentication = mirrorMaker2Cluster.getAuthentication();
        if (authentication != null) {
            if (authentication instanceof KafkaClientAuthenticationTls) {
                KafkaClientAuthenticationTls tlsAuth = (KafkaClientAuthenticationTls) authentication;
                if (tlsAuth.getCertificateAndKey() != null) {
                    appendCluster(clustersTlsAuthCerts, clusterAlias, () -> tlsAuth.getCertificateAndKey().getSecretName() + "/" + tlsAuth.getCertificateAndKey().getCertificate());
                    appendCluster(clustersTlsAuthKeys, clusterAlias, () -> tlsAuth.getCertificateAndKey().getSecretName() + "/" + tlsAuth.getCertificateAndKey().getKey());
                }
            } else if (authentication instanceof KafkaClientAuthenticationPlain) {
                KafkaClientAuthenticationPlain passwordAuth = (KafkaClientAuthenticationPlain) authentication;
                appendClusterPasswordSecretSource(clustersSaslPasswordFiles, clusterAlias, passwordAuth.getPasswordSecret());
            } else if (authentication instanceof KafkaClientAuthenticationScram) {
                KafkaClientAuthenticationScram passwordAuth = (KafkaClientAuthenticationScram) authentication;
                appendClusterPasswordSecretSource(clustersSaslPasswordFiles, clusterAlias, passwordAuth.getPasswordSecret());
            } else if (authentication instanceof KafkaClientAuthenticationOAuth) {
                KafkaClientAuthenticationOAuth oauth = (KafkaClientAuthenticationOAuth) authentication;
                if (oauth.getTlsTrustedCertificates() != null && !oauth.getTlsTrustedCertificates().isEmpty()) {
                    hasClusterOauthTrustedCerts = true;
                }
                appendClusterOAuthSecretSource(clustersOauthClientSecrets, clusterAlias, oauth.getClientSecret());
                appendClusterOAuthSecretSource(clustersOauthAccessTokens, clusterAlias, oauth.getAccessToken());
                appendClusterOAuthSecretSource(clustersOauthRefreshTokens, clusterAlias, oauth.getRefreshToken());
            }
        }
    }
    varList.add(buildEnvVar(ENV_VAR_KAFKA_MIRRORMAKER_2_CLUSTERS, clusterAliases.toString()));
    if (hasClusterWithTls) {
        varList.add(buildEnvVar(ENV_VAR_KAFKA_MIRRORMAKER_2_TLS_CLUSTERS, "true"));
    }
    if (clustersTrustedCerts.length() > 0) {
        varList.add(buildEnvVar(ENV_VAR_KAFKA_MIRRORMAKER_2_TRUSTED_CERTS_CLUSTERS, clustersTrustedCerts.toString()));
    }
    if (clustersTlsAuthCerts.length() > 0 || clustersTlsAuthKeys.length() > 0) {
        varList.add(buildEnvVar(ENV_VAR_KAFKA_MIRRORMAKER_2_TLS_AUTH_CLUSTERS, "true"));
        varList.add(buildEnvVar(ENV_VAR_KAFKA_MIRRORMAKER_2_TLS_AUTH_CERTS_CLUSTERS, clustersTlsAuthCerts.toString()));
        varList.add(buildEnvVar(ENV_VAR_KAFKA_MIRRORMAKER_2_TLS_AUTH_KEYS_CLUSTERS, clustersTlsAuthKeys.toString()));
    }
    if (clustersSaslPasswordFiles.length() > 0) {
        varList.add(buildEnvVar(ENV_VAR_KAFKA_MIRRORMAKER_2_SASL_PASSWORD_FILES_CLUSTERS, clustersSaslPasswordFiles.toString()));
    }
    if (hasClusterOauthTrustedCerts) {
        varList.add(buildEnvVar(ENV_VAR_KAFKA_MIRRORMAKER_2_OAUTH_TRUSTED_CERTS, "true"));
    }
    if (clustersOauthClientSecrets.length() > 0) {
        varList.add(buildEnvVar(ENV_VAR_KAFKA_MIRRORMAKER_2_OAUTH_CLIENT_SECRETS_CLUSTERS, clustersOauthClientSecrets.toString()));
    }
    if (clustersOauthAccessTokens.length() > 0) {
        varList.add(buildEnvVar(ENV_VAR_KAFKA_MIRRORMAKER_2_OAUTH_ACCESS_TOKENS_CLUSTERS, clustersOauthAccessTokens.toString()));
    }
    if (clustersOauthRefreshTokens.length() > 0) {
        varList.add(buildEnvVar(ENV_VAR_KAFKA_MIRRORMAKER_2_OAUTH_REFRESH_TOKENS_CLUSTERS, clustersOauthRefreshTokens.toString()));
    }
    if (javaSystemProperties != null) {
        varList.add(buildEnvVar(ENV_VAR_STRIMZI_JAVA_SYSTEM_PROPERTIES, ModelUtils.getJavaSystemPropertiesToString(javaSystemProperties)));
    }
    return varList;
}

Example 3 with KafkaClientAuthentication

use of io.strimzi.api.kafka.model.authentication.KafkaClientAuthentication in project strimzi by strimzi.

the class KafkaConnectAssemblyOperator method generateAuthHash.

/**
 * Generates a hash from the trusted TLS certificates that can be used to spot if it has changed.
 *
 * @param namespace          Namespace of the Connect cluster
 * @param kafkaConnectSpec   KafkaConnectSpec object
 * @return                   Future for tracking the asynchronous result of generating the TLS auth hash
 */
Future<Integer> generateAuthHash(String namespace, KafkaConnectSpec kafkaConnectSpec) {
    KafkaClientAuthentication auth = kafkaConnectSpec.getAuthentication();
    List<CertSecretSource> trustedCertificates = kafkaConnectSpec.getTls() == null ? Collections.emptyList() : kafkaConnectSpec.getTls().getTrustedCertificates();
    return Util.authTlsHash(secretOperations, namespace, auth, trustedCertificates);
}

Example 4 with KafkaClientAuthentication

use of io.strimzi.api.kafka.model.authentication.KafkaClientAuthentication in project strimzi by strimzi.

the class KafkaMirrorMakerAssemblyOperator method createOrUpdate.

@Override
protected Future<KafkaMirrorMakerStatus> createOrUpdate(Reconciliation reconciliation, KafkaMirrorMaker assemblyResource) {
    String namespace = reconciliation.namespace();
    KafkaMirrorMakerCluster mirror;
    KafkaMirrorMakerStatus kafkaMirrorMakerStatus = new KafkaMirrorMakerStatus();
    try {
        mirror = KafkaMirrorMakerCluster.fromCrd(reconciliation, assemblyResource, versions);
    } catch (Exception e) {
        LOGGER.warnCr(reconciliation, e);
        StatusUtils.setStatusConditionAndObservedGeneration(assemblyResource, kafkaMirrorMakerStatus, Future.failedFuture(e));
        return Future.failedFuture(new ReconciliationException(kafkaMirrorMakerStatus, e));
    }
    Map<String, String> annotations = new HashMap<>(1);
    KafkaClientAuthentication authConsumer = assemblyResource.getSpec().getConsumer().getAuthentication();
    List<CertSecretSource> trustedCertificatesConsumer = assemblyResource.getSpec().getConsumer().getTls() == null ? Collections.emptyList() : assemblyResource.getSpec().getConsumer().getTls().getTrustedCertificates();
    KafkaClientAuthentication authProducer = assemblyResource.getSpec().getProducer().getAuthentication();
    List<CertSecretSource> trustedCertificatesProducer = assemblyResource.getSpec().getProducer().getTls() == null ? Collections.emptyList() : assemblyResource.getSpec().getProducer().getTls().getTrustedCertificates();
    Promise<KafkaMirrorMakerStatus> createOrUpdatePromise = Promise.promise();
    boolean mirrorHasZeroReplicas = mirror.getReplicas() == 0;
    LOGGER.debugCr(reconciliation, "Updating Kafka Mirror Maker cluster");
    mirrorMakerServiceAccount(reconciliation, namespace, mirror).compose(i -> deploymentOperations.scaleDown(reconciliation, namespace, mirror.getName(), mirror.getReplicas())).compose(i -> Util.metricsAndLogging(reconciliation, configMapOperations, namespace, mirror.getLogging(), mirror.getMetricsConfigInCm())).compose(metricsAndLoggingCm -> {
        ConfigMap logAndMetricsConfigMap = mirror.generateMetricsAndLogConfigMap(metricsAndLoggingCm);
        annotations.put(Annotations.STRIMZI_LOGGING_ANNOTATION, logAndMetricsConfigMap.getData().get(mirror.ANCILLARY_CM_KEY_LOG_CONFIG));
        return configMapOperations.reconcile(reconciliation, namespace, mirror.getAncillaryConfigMapName(), logAndMetricsConfigMap);
    }).compose(i -> pfa.hasPodDisruptionBudgetV1() ? podDisruptionBudgetOperator.reconcile(reconciliation, namespace, mirror.getName(), mirror.generatePodDisruptionBudget()) : Future.succeededFuture()).compose(i -> !pfa.hasPodDisruptionBudgetV1() ? podDisruptionBudgetV1Beta1Operator.reconcile(reconciliation, namespace, mirror.getName(), mirror.generatePodDisruptionBudgetV1Beta1()) : Future.succeededFuture()).compose(i -> CompositeFuture.join(Util.authTlsHash(secretOperations, namespace, authConsumer, trustedCertificatesConsumer), Util.authTlsHash(secretOperations, namespace, authProducer, trustedCertificatesProducer))).compose(hashFut -> {
        if (hashFut != null) {
            annotations.put(Annotations.ANNO_STRIMZI_AUTH_HASH, Integer.toString((int) hashFut.resultAt(0) + (int) hashFut.resultAt(1)));
        }
        return Future.succeededFuture();
    }).compose(i -> deploymentOperations.reconcile(reconciliation, namespace, mirror.getName(), mirror.generateDeployment(annotations, pfa.isOpenshift(), imagePullPolicy, imagePullSecrets))).compose(i -> deploymentOperations.scaleUp(reconciliation, namespace, mirror.getName(), mirror.getReplicas())).compose(i -> deploymentOperations.waitForObserved(reconciliation, namespace, mirror.getName(), 1_000, operationTimeoutMs)).compose(i -> mirrorHasZeroReplicas ? Future.succeededFuture() : deploymentOperations.readiness(reconciliation, namespace, mirror.getName(), 1_000, operationTimeoutMs)).onComplete(reconciliationResult -> {
        StatusUtils.setStatusConditionAndObservedGeneration(assemblyResource, kafkaMirrorMakerStatus, reconciliationResult);
        kafkaMirrorMakerStatus.setReplicas(mirror.getReplicas());
        kafkaMirrorMakerStatus.setLabelSelector(mirror.getSelectorLabels().toSelectorString());
        if (reconciliationResult.succeeded()) {
            createOrUpdatePromise.complete(kafkaMirrorMakerStatus);
        } else {
            createOrUpdatePromise.fail(new ReconciliationException(kafkaMirrorMakerStatus, reconciliationResult.cause()));
        }
    });
    return createOrUpdatePromise.future();
}

Example 5 with KafkaClientAuthentication

use of io.strimzi.api.kafka.model.authentication.KafkaClientAuthentication in project strimzi by strimzi.

the class KafkaBridgeAssemblyOperator method createOrUpdate.

@Override
protected Future<KafkaBridgeStatus> createOrUpdate(Reconciliation reconciliation, KafkaBridge assemblyResource) {
    KafkaBridgeStatus kafkaBridgeStatus = new KafkaBridgeStatus();
    String namespace = reconciliation.namespace();
    KafkaBridgeCluster bridge;
    try {
        bridge = KafkaBridgeCluster.fromCrd(reconciliation, assemblyResource, versions);
    } catch (Exception e) {
        LOGGER.warnCr(reconciliation, e);
        StatusUtils.setStatusConditionAndObservedGeneration(assemblyResource, kafkaBridgeStatus, Future.failedFuture(e));
        return Future.failedFuture(new ReconciliationException(kafkaBridgeStatus, e));
    }
    KafkaClientAuthentication auth = assemblyResource.getSpec().getAuthentication();
    List<CertSecretSource> trustedCertificates = assemblyResource.getSpec().getTls() == null ? Collections.emptyList() : assemblyResource.getSpec().getTls().getTrustedCertificates();
    Promise<KafkaBridgeStatus> createOrUpdatePromise = Promise.promise();
    boolean bridgeHasZeroReplicas = bridge.getReplicas() == 0;
    LOGGER.debugCr(reconciliation, "Updating Kafka Bridge cluster");
    kafkaBridgeServiceAccount(reconciliation, namespace, bridge).compose(i -> deploymentOperations.scaleDown(reconciliation, namespace, bridge.getName(), bridge.getReplicas())).compose(scale -> serviceOperations.reconcile(reconciliation, namespace, bridge.getServiceName(), bridge.generateService())).compose(i -> Util.metricsAndLogging(reconciliation, configMapOperations, namespace, bridge.getLogging(), null)).compose(metricsAndLogging -> configMapOperations.reconcile(reconciliation, namespace, bridge.getAncillaryConfigMapName(), bridge.generateMetricsAndLogConfigMap(metricsAndLogging))).compose(i -> pfa.hasPodDisruptionBudgetV1() ? podDisruptionBudgetOperator.reconcile(reconciliation, namespace, bridge.getName(), bridge.generatePodDisruptionBudget()) : Future.succeededFuture()).compose(i -> !pfa.hasPodDisruptionBudgetV1() ? podDisruptionBudgetV1Beta1Operator.reconcile(reconciliation, namespace, bridge.getName(), bridge.generatePodDisruptionBudgetV1Beta1()) : Future.succeededFuture()).compose(i -> Util.authTlsHash(secretOperations, namespace, auth, trustedCertificates)).compose(hash -> deploymentOperations.reconcile(reconciliation, namespace, bridge.getName(), bridge.generateDeployment(Collections.singletonMap(Annotations.ANNO_STRIMZI_AUTH_HASH, Integer.toString(hash)), pfa.isOpenshift(), imagePullPolicy, imagePullSecrets))).compose(i -> deploymentOperations.scaleUp(reconciliation, namespace, bridge.getName(), bridge.getReplicas())).compose(i -> deploymentOperations.waitForObserved(reconciliation, namespace, bridge.getName(), 1_000, operationTimeoutMs)).compose(i -> bridgeHasZeroReplicas ? Future.succeededFuture() : deploymentOperations.readiness(reconciliation, namespace, bridge.getName(), 1_000, operationTimeoutMs)).onComplete(reconciliationResult -> {
        StatusUtils.setStatusConditionAndObservedGeneration(assemblyResource, kafkaBridgeStatus, reconciliationResult.mapEmpty());
        if (!bridgeHasZeroReplicas) {
            int port = KafkaBridgeCluster.DEFAULT_REST_API_PORT;
            if (bridge.getHttp() != null) {
                port = bridge.getHttp().getPort();
            }
            kafkaBridgeStatus.setUrl(KafkaBridgeResources.url(bridge.getCluster(), namespace, port));
        }
        kafkaBridgeStatus.setReplicas(bridge.getReplicas());
        kafkaBridgeStatus.setLabelSelector(bridge.getSelectorLabels().toSelectorString());
        if (reconciliationResult.succeeded()) {
            createOrUpdatePromise.complete(kafkaBridgeStatus);
        } else {
            createOrUpdatePromise.fail(new ReconciliationException(kafkaBridgeStatus, reconciliationResult.cause()));
        }
    });
    return createOrUpdatePromise.future();
}