Example 26 with KafkaListenerAuthenticationOAuthBuilder
use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder in project strimzi-kafka-operator by strimzi.
the class KafkaBrokerConfigurationBuilderTest method testOAuthOptions.
@ParallelTest
public void testOAuthOptions() {
KafkaListenerAuthenticationOAuth auth = new KafkaListenerAuthenticationOAuthBuilder().withValidIssuerUri("http://valid-issuer").withCheckIssuer(false).withCheckAudience(true).withJwksEndpointUri("http://jwks-endpoint").withIntrospectionEndpointUri("http://introspection-endpoint").withUserInfoEndpointUri("http://userinfo-endpoint").withJwksExpirySeconds(160).withJwksRefreshSeconds(50).withJwksMinRefreshPauseSeconds(5).withEnableECDSA(true).withUserNameClaim("preferred_username").withFallbackUserNameClaim("client_id").withFallbackUserNamePrefix("client-account-").withCheckAccessTokenType(false).withClientId("my-kafka-id").withAccessTokenIsJwt(false).withValidTokenType("access_token").withDisableTlsHostnameVerification(true).withMaxSecondsWithoutReauthentication(3600).withEnablePlain(true).withTokenEndpointUri("http://token").withCustomClaimCheck("@.aud && @.aud == 'something'").withConnectTimeoutSeconds(30).withReadTimeoutSeconds(60).withClientAudience("kafka").withClientScope("messaging").build();
List<String> expectedOptions = new ArrayList<>(5);
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CLIENT_ID, "my-kafka-id"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_VALID_ISSUER_URI, "http://valid-issuer"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CHECK_ISSUER, false));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CHECK_AUDIENCE, true));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CUSTOM_CLAIM_CHECK, "@.aud && @.aud == 'something'"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_SCOPE, "messaging"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_AUDIENCE, "kafka"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_JWKS_ENDPOINT_URI, "http://jwks-endpoint"));
expectedOptions.add(String.format("%s=\"%d\"", ServerConfig.OAUTH_JWKS_REFRESH_SECONDS, 50));
expectedOptions.add(String.format("%s=\"%d\"", ServerConfig.OAUTH_JWKS_EXPIRY_SECONDS, 160));
expectedOptions.add(String.format("%s=\"%d\"", ServerConfig.OAUTH_JWKS_REFRESH_MIN_PAUSE_SECONDS, 5));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_INTROSPECTION_ENDPOINT_URI, "http://introspection-endpoint"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_USERINFO_ENDPOINT_URI, "http://userinfo-endpoint"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_USERNAME_CLAIM, "preferred_username"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_FALLBACK_USERNAME_CLAIM, "client_id"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_FALLBACK_USERNAME_PREFIX, "client-account-"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_ACCESS_TOKEN_IS_JWT, false));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CHECK_ACCESS_TOKEN_TYPE, false));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_VALID_TOKEN_TYPE, "access_token"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM, ""));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CONNECT_TIMEOUT_SECONDS, 30));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_READ_TIMEOUT_SECONDS, 60));
// enablePlain and tokenEndpointUri are handled separately from getOAuthOptions
List<String> actualOptions = KafkaBrokerConfigurationBuilder.getOAuthOptions(auth);
assertThat(actualOptions, is(equalTo(expectedOptions)));
}
Also used :
ArrayList(java.util.ArrayList)
KafkaListenerAuthenticationOAuth(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuth)
CoreMatchers.containsString(org.hamcrest.CoreMatchers.containsString)
KafkaListenerAuthenticationOAuthBuilder(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder)
ParallelTest(io.strimzi.test.annotations.ParallelTest)
Example 27 with KafkaListenerAuthenticationOAuthBuilder
use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder in project strimzi-kafka-operator by strimzi.
the class KafkaBrokerConfigurationBuilderTest method testOAuthDefaultOptions.
@ParallelTest
public void testOAuthDefaultOptions() {
KafkaListenerAuthenticationOAuth auth = new KafkaListenerAuthenticationOAuthBuilder().build();
List<String> actualOptions = KafkaBrokerConfigurationBuilder.getOAuthOptions(auth);
assertThat(actualOptions, is(equalTo(Collections.emptyList())));
}
Also used :
KafkaListenerAuthenticationOAuth(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuth)
CoreMatchers.containsString(org.hamcrest.CoreMatchers.containsString)
KafkaListenerAuthenticationOAuthBuilder(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder)
ParallelTest(io.strimzi.test.annotations.ParallelTest)
Example 28 with KafkaListenerAuthenticationOAuthBuilder
use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder in project strimzi-kafka-operator by strimzi.
the class KafkaClusterTest method testGenerateDeploymentWithOAuthEverywhere.
@ParallelTest
public void testGenerateDeploymentWithOAuthEverywhere() {
CertSecretSource cert1 = new CertSecretSourceBuilder().withSecretName("first-certificate").withCertificate("ca.crt").build();
CertSecretSource cert2 = new CertSecretSourceBuilder().withSecretName("second-certificate").withCertificate("tls.crt").build();
CertSecretSource cert3 = new CertSecretSourceBuilder().withSecretName("first-certificate").withCertificate("ca2.crt").build();
Kafka kafkaAssembly = new KafkaBuilder(ResourceUtils.createKafka(namespace, cluster, replicas, image, healthDelay, healthTimeout, jmxMetricsConfig, configuration, emptyMap())).editSpec().editKafka().withListeners(new GenericKafkaListenerBuilder().withName("plain").withPort(9092).withType(KafkaListenerType.INTERNAL).withTls(false).withAuth(new KafkaListenerAuthenticationOAuthBuilder().withClientId("my-client-id").withValidIssuerUri("http://valid-issuer").withIntrospectionEndpointUri("http://introspection").withNewClientSecret().withSecretName("my-secret-secret").withKey("my-secret-key").endClientSecret().withDisableTlsHostnameVerification(true).withTlsTrustedCertificates(cert1, cert2, cert3).build()).build(), new GenericKafkaListenerBuilder().withName("tls").withPort(9093).withType(KafkaListenerType.INTERNAL).withTls(true).withAuth(new KafkaListenerAuthenticationOAuthBuilder().withClientId("my-client-id").withValidIssuerUri("http://valid-issuer").withIntrospectionEndpointUri("http://introspection").withNewClientSecret().withSecretName("my-secret-secret").withKey("my-secret-key").endClientSecret().withDisableTlsHostnameVerification(true).withTlsTrustedCertificates(cert1, cert2, cert3).build()).build(), new GenericKafkaListenerBuilder().withName("external").withPort(9094).withType(KafkaListenerType.NODEPORT).withTls(true).withAuth(new KafkaListenerAuthenticationOAuthBuilder().withClientId("my-client-id").withValidIssuerUri("http://valid-issuer").withIntrospectionEndpointUri("http://introspection").withNewClientSecret().withSecretName("my-secret-secret").withKey("my-secret-key").endClientSecret().withDisableTlsHostnameVerification(true).withTlsTrustedCertificates(cert1, cert2, cert3).build()).build()).endKafka().endSpec().build();
KafkaCluster kc = KafkaCluster.fromCrd(Reconciliation.DUMMY_RECONCILIATION, kafkaAssembly, VERSIONS);
StatefulSet sts = kc.generateStatefulSet(true, null, null, null);
Container cont = sts.getSpec().getTemplate().getSpec().getContainers().get(0);
assertThat(cont.getEnv().stream().filter(var -> "STRIMZI_PLAIN_9092_OAUTH_CLIENT_SECRET".equals(var.getName())).findFirst().orElseThrow().getValueFrom().getSecretKeyRef().getName(), is("my-secret-secret"));
assertThat(cont.getEnv().stream().filter(var -> "STRIMZI_PLAIN_9092_OAUTH_CLIENT_SECRET".equals(var.getName())).findFirst().orElseThrow().getValueFrom().getSecretKeyRef().getKey(), is("my-secret-key"));
assertThat(cont.getEnv().stream().filter(var -> "STRIMZI_TLS_9093_OAUTH_CLIENT_SECRET".equals(var.getName())).findFirst().orElseThrow().getValueFrom().getSecretKeyRef().getName(), is("my-secret-secret"));
assertThat(cont.getEnv().stream().filter(var -> "STRIMZI_TLS_9093_OAUTH_CLIENT_SECRET".equals(var.getName())).findFirst().orElseThrow().getValueFrom().getSecretKeyRef().getKey(), is("my-secret-key"));
assertThat(cont.getEnv().stream().filter(var -> "STRIMZI_EXTERNAL_9094_OAUTH_CLIENT_SECRET".equals(var.getName())).findFirst().orElseThrow().getValueFrom().getSecretKeyRef().getName(), is("my-secret-secret"));
assertThat(cont.getEnv().stream().filter(var -> "STRIMZI_EXTERNAL_9094_OAUTH_CLIENT_SECRET".equals(var.getName())).findFirst().orElseThrow().getValueFrom().getSecretKeyRef().getKey(), is("my-secret-key"));
// Volume mounts
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-plain-9092-0".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-plain-9092-certs/first-certificate-0"));
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-plain-9092-1".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-plain-9092-certs/second-certificate-1"));
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-plain-9092-2".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-plain-9092-certs/first-certificate-2"));
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-tls-9093-0".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-tls-9093-certs/first-certificate-0"));
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-tls-9093-1".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-tls-9093-certs/second-certificate-1"));
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-tls-9093-2".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-tls-9093-certs/first-certificate-2"));
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-external-9094-0".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-external-9094-certs/first-certificate-0"));
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-external-9094-1".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-external-9094-certs/second-certificate-1"));
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-external-9094-2".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-external-9094-certs/first-certificate-2"));
// Volumes
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("ca.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("ca2.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-tls-9093-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-tls-9093-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("ca.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-tls-9093-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-tls-9093-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-tls-9093-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-tls-9093-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-tls-9093-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-tls-9093-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("ca2.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-tls-9093-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-external-9094-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-external-9094-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("ca.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-external-9094-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-external-9094-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-external-9094-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-external-9094-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-external-9094-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-external-9094-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("ca2.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-external-9094-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
}
Also used :
Quantity(io.fabric8.kubernetes.api.model.Quantity)
VolumeMount(io.fabric8.kubernetes.api.model.VolumeMount)
ExternalTrafficPolicy(io.strimzi.api.kafka.model.template.ExternalTrafficPolicy)
PersistentClaimStorageOverrideBuilder(io.strimzi.api.kafka.model.storage.PersistentClaimStorageOverrideBuilder)
IntOrString(io.fabric8.kubernetes.api.model.IntOrString)
Rack(io.strimzi.api.kafka.model.Rack)
GenericKafkaListenerConfigurationBrokerBuilder(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerConfigurationBrokerBuilder)
SecurityContextBuilder(io.fabric8.kubernetes.api.model.SecurityContextBuilder)
PodDisruptionBudget(io.fabric8.kubernetes.api.model.policy.v1.PodDisruptionBudget)
Collections.singletonList(java.util.Collections.singletonList)
ResourceRequirements(io.fabric8.kubernetes.api.model.ResourceRequirements)
KafkaResources(io.strimzi.api.kafka.model.KafkaResources)
Arrays.asList(java.util.Arrays.asList)
Map(java.util.Map)
ContainerEnvVar(io.strimzi.api.kafka.model.ContainerEnvVar)
KafkaJmxOptionsBuilder(io.strimzi.api.kafka.model.KafkaJmxOptionsBuilder)
LabelSelectorBuilder(io.fabric8.kubernetes.api.model.LabelSelectorBuilder)
CertSecretSource(io.strimzi.api.kafka.model.CertSecretSource)
JbodStorageBuilder(io.strimzi.api.kafka.model.storage.JbodStorageBuilder)
Matchers.allOf(org.hamcrest.Matchers.allOf)
Set(java.util.Set)
GenericKafkaListenerBuilder(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerBuilder)
HasMetadata(io.fabric8.kubernetes.api.model.HasMetadata)
GenericSecretSourceBuilder(io.strimzi.api.kafka.model.GenericSecretSourceBuilder)
PodSecurityContextBuilder(io.fabric8.kubernetes.api.model.PodSecurityContextBuilder)
Matchers.contains(org.hamcrest.Matchers.contains)
PasswordGenerator(io.strimzi.operator.common.PasswordGenerator)
HostAliasBuilder(io.fabric8.kubernetes.api.model.HostAliasBuilder)
KafkaListenerAuthenticationOAuthBuilder(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder)
PersistentVolumeClaim(io.fabric8.kubernetes.api.model.PersistentVolumeClaim)
Matchers.containsString(org.hamcrest.Matchers.containsString)
Assertions.assertThrows(org.junit.jupiter.api.Assertions.assertThrows)
Assertions.fail(org.junit.jupiter.api.Assertions.fail)
ClusterRoleBinding(io.fabric8.kubernetes.api.model.rbac.ClusterRoleBinding)
EnvVar(io.fabric8.kubernetes.api.model.EnvVar)
CoreMatchers.equalTo(org.hamcrest.CoreMatchers.equalTo)
ResourceRequirementsBuilder(io.fabric8.kubernetes.api.model.ResourceRequirementsBuilder)
IpFamily(io.strimzi.api.kafka.model.template.IpFamily)
LocalObjectReference(io.fabric8.kubernetes.api.model.LocalObjectReference)
OwnerReference(io.fabric8.kubernetes.api.model.OwnerReference)
GenericKafkaListenerConfigurationBootstrapBuilder(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerConfigurationBootstrapBuilder)
KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder)
ArrayList(java.util.ArrayList)
Matchers.hasProperty(org.hamcrest.Matchers.hasProperty)
PersistentClaimStorageBuilder(io.strimzi.api.kafka.model.storage.PersistentClaimStorageBuilder)
GenericKafkaListenerConfigurationBroker(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerConfigurationBroker)
SecurityContext(io.fabric8.kubernetes.api.model.SecurityContext)
KafkaVersionTestUtils(io.strimzi.operator.cluster.KafkaVersionTestUtils)
PodSpec(io.fabric8.kubernetes.api.model.PodSpec)
KafkaListenerAuthenticationCustomBuilder(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationCustomBuilder)
MatcherAssert.assertThat(org.hamcrest.MatcherAssert.assertThat)
CoreMatchers.nullValue(org.hamcrest.CoreMatchers.nullValue)
KafkaJmxAuthenticationPasswordBuilder(io.strimzi.api.kafka.model.KafkaJmxAuthenticationPasswordBuilder)
IOException(java.io.IOException)
StatefulSet(io.fabric8.kubernetes.api.model.apps.StatefulSet)
ConfigMap(io.fabric8.kubernetes.api.model.ConfigMap)
ContainerPort(io.fabric8.kubernetes.api.model.ContainerPort)
Reconciliation(io.strimzi.operator.common.Reconciliation)
Util(io.strimzi.operator.common.Util)
KafkaListenerType(io.strimzi.api.kafka.model.listener.arraylistener.KafkaListenerType)
SystemPropertyBuilder(io.strimzi.api.kafka.model.SystemPropertyBuilder)
ConfigMapKeySelectorBuilder(io.fabric8.kubernetes.api.model.ConfigMapKeySelectorBuilder)
NetworkPolicyPeer(io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer)
OpenSslCertManager(io.strimzi.certs.OpenSslCertManager)
X509Certificate(java.security.cert.X509Certificate)
CoreMatchers.is(org.hamcrest.CoreMatchers.is)
CoreMatchers.hasItem(org.hamcrest.CoreMatchers.hasItem)
Storage(io.strimzi.api.kafka.model.storage.Storage)
ParallelSuite(io.strimzi.test.annotations.ParallelSuite)
CoreMatchers.notNullValue(org.hamcrest.CoreMatchers.notNullValue)
NetworkPolicyIngressRule(io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyIngressRule)
Route(io.fabric8.openshift.api.model.Route)
SystemProperty(io.strimzi.api.kafka.model.SystemProperty)
ResourceUtils(io.strimzi.operator.cluster.ResourceUtils)
KafkaAuthorizationKeycloakBuilder(io.strimzi.api.kafka.model.KafkaAuthorizationKeycloakBuilder)
IpFamilyPolicy(io.strimzi.api.kafka.model.template.IpFamilyPolicy)
ParallelTest(io.strimzi.test.annotations.ParallelTest)
Collections.emptyList(java.util.Collections.emptyList)
Collectors(java.util.stream.Collectors)
List(java.util.List)
CertSecretSourceBuilder(io.strimzi.api.kafka.model.CertSecretSourceBuilder)
Labels(io.strimzi.operator.common.model.Labels)
NodeAddressType(io.strimzi.api.kafka.model.listener.NodeAddressType)
RackBuilder(io.strimzi.api.kafka.model.RackBuilder)
Matchers.containsInAnyOrder(org.hamcrest.Matchers.containsInAnyOrder)
Ingress(io.fabric8.kubernetes.api.model.networking.v1.Ingress)
Secret(io.fabric8.kubernetes.api.model.Secret)
TopologySpreadConstraintBuilder(io.fabric8.kubernetes.api.model.TopologySpreadConstraintBuilder)
NetworkPolicyPeerBuilder(io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeerBuilder)
PodManagementPolicy(io.strimzi.api.kafka.model.template.PodManagementPolicy)
ContainerTemplate(io.strimzi.api.kafka.model.template.ContainerTemplate)
Container(io.fabric8.kubernetes.api.model.Container)
WeightedPodAffinityTerm(io.fabric8.kubernetes.api.model.WeightedPodAffinityTerm)
EphemeralStorageBuilder(io.strimzi.api.kafka.model.storage.EphemeralStorageBuilder)
CertificateParsingException(java.security.cert.CertificateParsingException)
HashMap(java.util.HashMap)
GenericKafkaListenerConfigurationBootstrap(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerConfigurationBootstrap)
MetricsAndLogging(io.strimzi.operator.common.MetricsAndLogging)
HashSet(java.util.HashSet)
HostAlias(io.fabric8.kubernetes.api.model.HostAlias)
JmxPrometheusExporterMetrics(io.strimzi.api.kafka.model.JmxPrometheusExporterMetrics)
JmxPrometheusExporterMetricsBuilder(io.strimzi.api.kafka.model.JmxPrometheusExporterMetricsBuilder)
InlineLogging(io.strimzi.api.kafka.model.InlineLogging)
MetricsConfig(io.strimzi.api.kafka.model.MetricsConfig)
TestUtils(io.strimzi.test.TestUtils)
Collections.singletonMap(java.util.Collections.singletonMap)
Service(io.fabric8.kubernetes.api.model.Service)
CertificateExpirationPolicy(io.strimzi.api.kafka.model.CertificateExpirationPolicy)
Volume(io.fabric8.kubernetes.api.model.Volume)
Matchers.hasEntry(org.hamcrest.Matchers.hasEntry)
CruiseControlConfigurationParameters(io.strimzi.operator.cluster.operator.resource.cruisecontrol.CruiseControlConfigurationParameters)
Collections.emptyMap(java.util.Collections.emptyMap)
TopologySpreadConstraint(io.fabric8.kubernetes.api.model.TopologySpreadConstraint)
TestUtils.set(io.strimzi.test.TestUtils.set)
LabelSelectorRequirementBuilder(io.fabric8.kubernetes.api.model.LabelSelectorRequirementBuilder)
NetworkPolicy(io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicy)
ServiceAccount(io.fabric8.kubernetes.api.model.ServiceAccount)
Kafka(io.strimzi.api.kafka.model.Kafka)
Collections(java.util.Collections)
Container(io.fabric8.kubernetes.api.model.Container)
CertSecretSourceBuilder(io.strimzi.api.kafka.model.CertSecretSourceBuilder)
GenericKafkaListenerBuilder(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerBuilder)
Kafka(io.strimzi.api.kafka.model.Kafka)
KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder)
StatefulSet(io.fabric8.kubernetes.api.model.apps.StatefulSet)
CertSecretSource(io.strimzi.api.kafka.model.CertSecretSource)
KafkaListenerAuthenticationOAuthBuilder(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder)
ParallelTest(io.strimzi.test.annotations.ParallelTest)
Example 29 with KafkaListenerAuthenticationOAuthBuilder
use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder in project strimzi-kafka-operator by strimzi.
the class KafkaClusterTest method testGenerateDeploymentWithOAuthWithClientSecretAndTls.
@ParallelTest
public void testGenerateDeploymentWithOAuthWithClientSecretAndTls() {
CertSecretSource cert1 = new CertSecretSourceBuilder().withSecretName("first-certificate").withCertificate("ca.crt").build();
CertSecretSource cert2 = new CertSecretSourceBuilder().withSecretName("second-certificate").withCertificate("tls.crt").build();
CertSecretSource cert3 = new CertSecretSourceBuilder().withSecretName("first-certificate").withCertificate("ca2.crt").build();
Kafka kafkaAssembly = new KafkaBuilder(ResourceUtils.createKafka(namespace, cluster, replicas, image, healthDelay, healthTimeout, jmxMetricsConfig, configuration, emptyMap())).editSpec().editKafka().withListeners(new GenericKafkaListenerBuilder().withName("plain").withPort(9092).withType(KafkaListenerType.INTERNAL).withTls(false).withAuth(new KafkaListenerAuthenticationOAuthBuilder().withClientId("my-client-id").withValidIssuerUri("http://valid-issuer").withIntrospectionEndpointUri("http://introspection").withNewClientSecret().withSecretName("my-secret-secret").withKey("my-secret-key").endClientSecret().withDisableTlsHostnameVerification(true).withTlsTrustedCertificates(cert1, cert2, cert3).build()).build()).endKafka().endSpec().build();
KafkaCluster kc = KafkaCluster.fromCrd(Reconciliation.DUMMY_RECONCILIATION, kafkaAssembly, VERSIONS);
StatefulSet sts = kc.generateStatefulSet(true, null, null, null);
Container cont = sts.getSpec().getTemplate().getSpec().getContainers().get(0);
assertThat(cont.getEnv().stream().filter(var -> "STRIMZI_PLAIN_9092_OAUTH_CLIENT_SECRET".equals(var.getName())).findFirst().orElseThrow().getValueFrom().getSecretKeyRef().getName(), is("my-secret-secret"));
assertThat(cont.getEnv().stream().filter(var -> "STRIMZI_PLAIN_9092_OAUTH_CLIENT_SECRET".equals(var.getName())).findFirst().orElseThrow().getValueFrom().getSecretKeyRef().getKey(), is("my-secret-key"));
// Volume mounts
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-plain-9092-0".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-plain-9092-certs/first-certificate-0"));
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-plain-9092-1".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-plain-9092-certs/second-certificate-1"));
assertThat(cont.getVolumeMounts().stream().filter(mount -> "oauth-plain-9092-2".equals(mount.getName())).findFirst().orElseThrow().getMountPath(), is(KafkaCluster.OAUTH_TRUSTED_CERTS_BASE_VOLUME_MOUNT + "/oauth-plain-9092-certs/first-certificate-2"));
// Volumes
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("ca.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-0".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-1".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().size(), is(1));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getKey(), is("ca2.crt"));
assertThat(sts.getSpec().getTemplate().getSpec().getVolumes().stream().filter(vol -> "oauth-plain-9092-2".equals(vol.getName())).findFirst().orElseThrow().getSecret().getItems().get(0).getPath(), is("tls.crt"));
}
Also used :
Quantity(io.fabric8.kubernetes.api.model.Quantity)
VolumeMount(io.fabric8.kubernetes.api.model.VolumeMount)
ExternalTrafficPolicy(io.strimzi.api.kafka.model.template.ExternalTrafficPolicy)
PersistentClaimStorageOverrideBuilder(io.strimzi.api.kafka.model.storage.PersistentClaimStorageOverrideBuilder)
IntOrString(io.fabric8.kubernetes.api.model.IntOrString)
Rack(io.strimzi.api.kafka.model.Rack)
GenericKafkaListenerConfigurationBrokerBuilder(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerConfigurationBrokerBuilder)
SecurityContextBuilder(io.fabric8.kubernetes.api.model.SecurityContextBuilder)
PodDisruptionBudget(io.fabric8.kubernetes.api.model.policy.v1.PodDisruptionBudget)
Collections.singletonList(java.util.Collections.singletonList)
ResourceRequirements(io.fabric8.kubernetes.api.model.ResourceRequirements)
KafkaResources(io.strimzi.api.kafka.model.KafkaResources)
Arrays.asList(java.util.Arrays.asList)
Map(java.util.Map)
ContainerEnvVar(io.strimzi.api.kafka.model.ContainerEnvVar)
KafkaJmxOptionsBuilder(io.strimzi.api.kafka.model.KafkaJmxOptionsBuilder)
LabelSelectorBuilder(io.fabric8.kubernetes.api.model.LabelSelectorBuilder)
CertSecretSource(io.strimzi.api.kafka.model.CertSecretSource)
JbodStorageBuilder(io.strimzi.api.kafka.model.storage.JbodStorageBuilder)
Matchers.allOf(org.hamcrest.Matchers.allOf)
Set(java.util.Set)
GenericKafkaListenerBuilder(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerBuilder)
HasMetadata(io.fabric8.kubernetes.api.model.HasMetadata)
GenericSecretSourceBuilder(io.strimzi.api.kafka.model.GenericSecretSourceBuilder)
PodSecurityContextBuilder(io.fabric8.kubernetes.api.model.PodSecurityContextBuilder)
Matchers.contains(org.hamcrest.Matchers.contains)
PasswordGenerator(io.strimzi.operator.common.PasswordGenerator)
HostAliasBuilder(io.fabric8.kubernetes.api.model.HostAliasBuilder)
KafkaListenerAuthenticationOAuthBuilder(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder)
PersistentVolumeClaim(io.fabric8.kubernetes.api.model.PersistentVolumeClaim)
Matchers.containsString(org.hamcrest.Matchers.containsString)
Assertions.assertThrows(org.junit.jupiter.api.Assertions.assertThrows)
Assertions.fail(org.junit.jupiter.api.Assertions.fail)
ClusterRoleBinding(io.fabric8.kubernetes.api.model.rbac.ClusterRoleBinding)
EnvVar(io.fabric8.kubernetes.api.model.EnvVar)
CoreMatchers.equalTo(org.hamcrest.CoreMatchers.equalTo)
ResourceRequirementsBuilder(io.fabric8.kubernetes.api.model.ResourceRequirementsBuilder)
IpFamily(io.strimzi.api.kafka.model.template.IpFamily)
LocalObjectReference(io.fabric8.kubernetes.api.model.LocalObjectReference)
OwnerReference(io.fabric8.kubernetes.api.model.OwnerReference)
GenericKafkaListenerConfigurationBootstrapBuilder(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerConfigurationBootstrapBuilder)
KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder)
ArrayList(java.util.ArrayList)
Matchers.hasProperty(org.hamcrest.Matchers.hasProperty)
PersistentClaimStorageBuilder(io.strimzi.api.kafka.model.storage.PersistentClaimStorageBuilder)
GenericKafkaListenerConfigurationBroker(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerConfigurationBroker)
SecurityContext(io.fabric8.kubernetes.api.model.SecurityContext)
KafkaVersionTestUtils(io.strimzi.operator.cluster.KafkaVersionTestUtils)
PodSpec(io.fabric8.kubernetes.api.model.PodSpec)
KafkaListenerAuthenticationCustomBuilder(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationCustomBuilder)
MatcherAssert.assertThat(org.hamcrest.MatcherAssert.assertThat)
CoreMatchers.nullValue(org.hamcrest.CoreMatchers.nullValue)
KafkaJmxAuthenticationPasswordBuilder(io.strimzi.api.kafka.model.KafkaJmxAuthenticationPasswordBuilder)
IOException(java.io.IOException)
StatefulSet(io.fabric8.kubernetes.api.model.apps.StatefulSet)
ConfigMap(io.fabric8.kubernetes.api.model.ConfigMap)
ContainerPort(io.fabric8.kubernetes.api.model.ContainerPort)
Reconciliation(io.strimzi.operator.common.Reconciliation)
Util(io.strimzi.operator.common.Util)
KafkaListenerType(io.strimzi.api.kafka.model.listener.arraylistener.KafkaListenerType)
SystemPropertyBuilder(io.strimzi.api.kafka.model.SystemPropertyBuilder)
ConfigMapKeySelectorBuilder(io.fabric8.kubernetes.api.model.ConfigMapKeySelectorBuilder)
NetworkPolicyPeer(io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeer)
OpenSslCertManager(io.strimzi.certs.OpenSslCertManager)
X509Certificate(java.security.cert.X509Certificate)
CoreMatchers.is(org.hamcrest.CoreMatchers.is)
CoreMatchers.hasItem(org.hamcrest.CoreMatchers.hasItem)
Storage(io.strimzi.api.kafka.model.storage.Storage)
ParallelSuite(io.strimzi.test.annotations.ParallelSuite)
CoreMatchers.notNullValue(org.hamcrest.CoreMatchers.notNullValue)
NetworkPolicyIngressRule(io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyIngressRule)
Route(io.fabric8.openshift.api.model.Route)
SystemProperty(io.strimzi.api.kafka.model.SystemProperty)
ResourceUtils(io.strimzi.operator.cluster.ResourceUtils)
KafkaAuthorizationKeycloakBuilder(io.strimzi.api.kafka.model.KafkaAuthorizationKeycloakBuilder)
IpFamilyPolicy(io.strimzi.api.kafka.model.template.IpFamilyPolicy)
ParallelTest(io.strimzi.test.annotations.ParallelTest)
Collections.emptyList(java.util.Collections.emptyList)
Collectors(java.util.stream.Collectors)
List(java.util.List)
CertSecretSourceBuilder(io.strimzi.api.kafka.model.CertSecretSourceBuilder)
Labels(io.strimzi.operator.common.model.Labels)
NodeAddressType(io.strimzi.api.kafka.model.listener.NodeAddressType)
RackBuilder(io.strimzi.api.kafka.model.RackBuilder)
Matchers.containsInAnyOrder(org.hamcrest.Matchers.containsInAnyOrder)
Ingress(io.fabric8.kubernetes.api.model.networking.v1.Ingress)
Secret(io.fabric8.kubernetes.api.model.Secret)
TopologySpreadConstraintBuilder(io.fabric8.kubernetes.api.model.TopologySpreadConstraintBuilder)
NetworkPolicyPeerBuilder(io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicyPeerBuilder)
PodManagementPolicy(io.strimzi.api.kafka.model.template.PodManagementPolicy)
ContainerTemplate(io.strimzi.api.kafka.model.template.ContainerTemplate)
Container(io.fabric8.kubernetes.api.model.Container)
WeightedPodAffinityTerm(io.fabric8.kubernetes.api.model.WeightedPodAffinityTerm)
EphemeralStorageBuilder(io.strimzi.api.kafka.model.storage.EphemeralStorageBuilder)
CertificateParsingException(java.security.cert.CertificateParsingException)
HashMap(java.util.HashMap)
GenericKafkaListenerConfigurationBootstrap(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerConfigurationBootstrap)
MetricsAndLogging(io.strimzi.operator.common.MetricsAndLogging)
HashSet(java.util.HashSet)
HostAlias(io.fabric8.kubernetes.api.model.HostAlias)
JmxPrometheusExporterMetrics(io.strimzi.api.kafka.model.JmxPrometheusExporterMetrics)
JmxPrometheusExporterMetricsBuilder(io.strimzi.api.kafka.model.JmxPrometheusExporterMetricsBuilder)
InlineLogging(io.strimzi.api.kafka.model.InlineLogging)
MetricsConfig(io.strimzi.api.kafka.model.MetricsConfig)
TestUtils(io.strimzi.test.TestUtils)
Collections.singletonMap(java.util.Collections.singletonMap)
Service(io.fabric8.kubernetes.api.model.Service)
CertificateExpirationPolicy(io.strimzi.api.kafka.model.CertificateExpirationPolicy)
Volume(io.fabric8.kubernetes.api.model.Volume)
Matchers.hasEntry(org.hamcrest.Matchers.hasEntry)
CruiseControlConfigurationParameters(io.strimzi.operator.cluster.operator.resource.cruisecontrol.CruiseControlConfigurationParameters)
Collections.emptyMap(java.util.Collections.emptyMap)
TopologySpreadConstraint(io.fabric8.kubernetes.api.model.TopologySpreadConstraint)
TestUtils.set(io.strimzi.test.TestUtils.set)
LabelSelectorRequirementBuilder(io.fabric8.kubernetes.api.model.LabelSelectorRequirementBuilder)
NetworkPolicy(io.fabric8.kubernetes.api.model.networking.v1.NetworkPolicy)
ServiceAccount(io.fabric8.kubernetes.api.model.ServiceAccount)
Kafka(io.strimzi.api.kafka.model.Kafka)
Collections(java.util.Collections)
Container(io.fabric8.kubernetes.api.model.Container)
CertSecretSourceBuilder(io.strimzi.api.kafka.model.CertSecretSourceBuilder)
GenericKafkaListenerBuilder(io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerBuilder)
Kafka(io.strimzi.api.kafka.model.Kafka)
KafkaBuilder(io.strimzi.api.kafka.model.KafkaBuilder)
StatefulSet(io.fabric8.kubernetes.api.model.apps.StatefulSet)
CertSecretSource(io.strimzi.api.kafka.model.CertSecretSource)
KafkaListenerAuthenticationOAuthBuilder(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder)
ParallelTest(io.strimzi.test.annotations.ParallelTest)
Example 30 with KafkaListenerAuthenticationOAuthBuilder
use of io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder in project strimzi by strimzi.
the class KafkaBrokerConfigurationBuilderTest method testOAuthOptions.
@ParallelTest
public void testOAuthOptions() {
KafkaListenerAuthenticationOAuth auth = new KafkaListenerAuthenticationOAuthBuilder().withValidIssuerUri("http://valid-issuer").withCheckIssuer(false).withCheckAudience(true).withJwksEndpointUri("http://jwks-endpoint").withIntrospectionEndpointUri("http://introspection-endpoint").withUserInfoEndpointUri("http://userinfo-endpoint").withJwksExpirySeconds(160).withJwksRefreshSeconds(50).withJwksMinRefreshPauseSeconds(5).withEnableECDSA(true).withUserNameClaim("preferred_username").withFallbackUserNameClaim("client_id").withFallbackUserNamePrefix("client-account-").withCheckAccessTokenType(false).withClientId("my-kafka-id").withAccessTokenIsJwt(false).withValidTokenType("access_token").withDisableTlsHostnameVerification(true).withMaxSecondsWithoutReauthentication(3600).withEnablePlain(true).withTokenEndpointUri("http://token").withCustomClaimCheck("@.aud && @.aud == 'something'").withConnectTimeoutSeconds(30).withReadTimeoutSeconds(60).withClientAudience("kafka").withClientScope("messaging").build();
List<String> expectedOptions = new ArrayList<>(5);
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CLIENT_ID, "my-kafka-id"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_VALID_ISSUER_URI, "http://valid-issuer"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CHECK_ISSUER, false));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CHECK_AUDIENCE, true));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CUSTOM_CLAIM_CHECK, "@.aud && @.aud == 'something'"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_SCOPE, "messaging"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_AUDIENCE, "kafka"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_JWKS_ENDPOINT_URI, "http://jwks-endpoint"));
expectedOptions.add(String.format("%s=\"%d\"", ServerConfig.OAUTH_JWKS_REFRESH_SECONDS, 50));
expectedOptions.add(String.format("%s=\"%d\"", ServerConfig.OAUTH_JWKS_EXPIRY_SECONDS, 160));
expectedOptions.add(String.format("%s=\"%d\"", ServerConfig.OAUTH_JWKS_REFRESH_MIN_PAUSE_SECONDS, 5));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_INTROSPECTION_ENDPOINT_URI, "http://introspection-endpoint"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_USERINFO_ENDPOINT_URI, "http://userinfo-endpoint"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_USERNAME_CLAIM, "preferred_username"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_FALLBACK_USERNAME_CLAIM, "client_id"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_FALLBACK_USERNAME_PREFIX, "client-account-"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_ACCESS_TOKEN_IS_JWT, false));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CHECK_ACCESS_TOKEN_TYPE, false));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_VALID_TOKEN_TYPE, "access_token"));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM, ""));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_CONNECT_TIMEOUT_SECONDS, 30));
expectedOptions.add(String.format("%s=\"%s\"", ServerConfig.OAUTH_READ_TIMEOUT_SECONDS, 60));
// enablePlain and tokenEndpointUri are handled separately from getOAuthOptions
List<String> actualOptions = KafkaBrokerConfigurationBuilder.getOAuthOptions(auth);
assertThat(actualOptions, is(equalTo(expectedOptions)));
}
Also used :
ArrayList(java.util.ArrayList)
KafkaListenerAuthenticationOAuth(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuth)
CoreMatchers.containsString(org.hamcrest.CoreMatchers.containsString)
KafkaListenerAuthenticationOAuthBuilder(io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder)
ParallelTest(io.strimzi.test.annotations.ParallelTest)
Aggregations
KafkaListenerAuthenticationOAuthBuilder (io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuthBuilder)64
ParallelTest (io.strimzi.test.annotations.ParallelTest)64
KafkaListenerAuthenticationOAuth (io.strimzi.api.kafka.model.listener.KafkaListenerAuthenticationOAuth)44
GenericKafkaListenerBuilder (io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListenerBuilder)20
GenericKafkaListener (io.strimzi.api.kafka.model.listener.arraylistener.GenericKafkaListener)12
Kafka (io.strimzi.api.kafka.model.Kafka)10
KafkaBuilder (io.strimzi.api.kafka.model.KafkaBuilder)10
Container (io.fabric8.kubernetes.api.model.Container)8
StatefulSet (io.fabric8.kubernetes.api.model.apps.StatefulSet)8
ArrayList (java.util.ArrayList)8
ConfigMap (io.fabric8.kubernetes.api.model.ConfigMap)6
ConfigMapKeySelectorBuilder (io.fabric8.kubernetes.api.model.ConfigMapKeySelectorBuilder)6
ContainerPort (io.fabric8.kubernetes.api.model.ContainerPort)6
EnvVar (io.fabric8.kubernetes.api.model.EnvVar)6
HasMetadata (io.fabric8.kubernetes.api.model.HasMetadata)6
HostAlias (io.fabric8.kubernetes.api.model.HostAlias)6
HostAliasBuilder (io.fabric8.kubernetes.api.model.HostAliasBuilder)6
IntOrString (io.fabric8.kubernetes.api.model.IntOrString)6
LabelSelectorBuilder (io.fabric8.kubernetes.api.model.LabelSelectorBuilder)6
LabelSelectorRequirementBuilder (io.fabric8.kubernetes.api.model.LabelSelectorRequirementBuilder)6
