Examples with SimpleAclRule io.strimzi.operator.user.model.acl.SimpleAclRule used on opensource projects

Example 11 with SimpleAclRule

use of io.strimzi.operator.user.model.acl.SimpleAclRule in project strimzi by strimzi.

the class SimpleAclOperator method getAclBindingFilters.

/**
 * Utility method for preparing AclBindingFilters for deleting ACLs
 *
 * @param username Name of the user
 * @param aclRules ACL rules which should be deleted
 *
 * @return The Future with reconcile result
 */
private Collection<AclBindingFilter> getAclBindingFilters(String username, Set<SimpleAclRule> aclRules) {
    KafkaPrincipal principal = new KafkaPrincipal("User", username);
    Collection<AclBindingFilter> aclBindingFilters = new ArrayList<>();
    for (SimpleAclRule rule : aclRules) {
        aclBindingFilters.add(rule.toKafkaAclBinding(principal).toFilter());
    }
    return aclBindingFilters;
}

Example 12 with SimpleAclRule

use of io.strimzi.operator.user.model.acl.SimpleAclRule in project strimzi by strimzi.

the class SimpleAclOperator method getAsync.

/**
 * Returns Set of ACLs applying to single user.
 *
 * @param reconciliation The reconciliation
 * @param username  Name of the user.
 *
 * @return The Set of ACLs applying to single user.
 */
private Future<Set<SimpleAclRule>> getAsync(Reconciliation reconciliation, String username) {
    LOGGER.debugCr(reconciliation, "Searching for ACL rules of user {}", username);
    KafkaPrincipal principal = new KafkaPrincipal("User", username);
    AclBindingFilter aclBindingFilter = new AclBindingFilter(ResourcePatternFilter.ANY, new AccessControlEntryFilter(principal.toString(), null, AclOperation.ANY, AclPermissionType.ANY));
    return Util.kafkaFutureToVertxFuture(reconciliation, vertx, adminClient.describeAcls(aclBindingFilter).values()).compose(aclBindings -> {
        Set<SimpleAclRule> result = new HashSet<>(aclBindings.size());
        LOGGER.debugCr(reconciliation, "ACL rules for user {}", username);
        for (AclBinding aclBinding : aclBindings) {
            LOGGER.debugOp("{}", aclBinding);
            result.add(SimpleAclRule.fromAclBinding(aclBinding));
        }
        return Future.succeededFuture(result);
    });
}

Example 13 with SimpleAclRule

use of io.strimzi.operator.user.model.acl.SimpleAclRule in project strimzi by strimzi.

the class SimpleAclOperatorIT method get.

@Override
Set<SimpleAclRule> get(String username) {
    KafkaPrincipal principal = new KafkaPrincipal("User", username);
    AclBindingFilter aclBindingFilter = new AclBindingFilter(ResourcePatternFilter.ANY, new AccessControlEntryFilter(principal.toString(), null, org.apache.kafka.common.acl.AclOperation.ANY, AclPermissionType.ANY));
    Collection<AclBinding> aclBindings;
    try {
        aclBindings = adminClient.describeAcls(aclBindingFilter).values().get();
    } catch (InterruptedException | ExecutionException e) {
        throw new RuntimeException("Failed to get ACLs", e);
    }
    Set<SimpleAclRule> result = new HashSet<>(aclBindings.size());
    for (AclBinding aclBinding : aclBindings) {
        result.add(SimpleAclRule.fromAclBinding(aclBinding));
    }
    return result.isEmpty() ? null : result;
}

Example 14 with SimpleAclRule

use of io.strimzi.operator.user.model.acl.SimpleAclRule in project strimzi by strimzi.

the class SimpleAclOperatorIT method getModified.

@Override
Set<SimpleAclRule> getModified() {
    Set<SimpleAclRule> acls = new HashSet<>();
    acls.add(new SimpleAclRule(AclRuleType.ALLOW, new SimpleAclRuleResource("my-topic", SimpleAclRuleResourceType.TOPIC, AclResourcePatternType.LITERAL), "*", AclOperation.DESCRIBE));
    acls.add(new SimpleAclRule(AclRuleType.ALLOW, new SimpleAclRuleResource("my-topic", SimpleAclRuleResourceType.TOPIC, AclResourcePatternType.LITERAL), "*", AclOperation.WRITE));
    acls.add(new SimpleAclRule(AclRuleType.ALLOW, new SimpleAclRuleResource("my-topic", SimpleAclRuleResourceType.TOPIC, AclResourcePatternType.LITERAL), "*", AclOperation.CREATE));
    return acls;
}

Example 15 with SimpleAclRule

use of io.strimzi.operator.user.model.acl.SimpleAclRule in project strimzi-kafka-operator by strimzi.

the class KafkaUserOperator method reconcileCredentialsQuotasAndAcls.

/**
 * Reconciles the credentials, quotas and ACLs
 *
 * @param reconciliation    Unique identification for the reconciliation
 * @param user              Model describing the KafkaUser
 * @param userStatus        Status subresource of the KafkaUser custom resource
 *
 * @return                  Future describing the result
 */
private CompositeFuture reconcileCredentialsQuotasAndAcls(Reconciliation reconciliation, KafkaUserModel user, KafkaUserStatus userStatus) {
    Set<SimpleAclRule> tlsAcls = null;
    Set<SimpleAclRule> scramOrNoneAcls = null;
    KafkaUserQuotas tlsQuotas = null;
    KafkaUserQuotas scramOrNoneQuotas = null;
    if (user.isTlsUser() || user.isTlsExternalUser()) {
        tlsAcls = user.getSimpleAclRules();
        tlsQuotas = user.getQuotas();
    } else if (user.isScramUser() || user.isNoneUser()) {
        scramOrNoneAcls = user.getSimpleAclRules();
        scramOrNoneQuotas = user.getQuotas();
    }
    // Reconcile the user SCRAM-SHA-512 credentials
    Future<ReconcileResult<String>> scramCredentialsFuture = scramCredentialsOperator.reconcile(reconciliation, user.getName(), user.getScramSha512Password());
    // Quotas need to reconciled for both regular and TLS username. It will be (possibly) set for one user and deleted for the other
    Future<ReconcileResult<KafkaUserQuotas>> tlsQuotasFuture = quotasOperator.reconcile(reconciliation, KafkaUserModel.getTlsUserName(reconciliation.name()), tlsQuotas);
    Future<ReconcileResult<KafkaUserQuotas>> quotasFuture = quotasOperator.reconcile(reconciliation, KafkaUserModel.getScramUserName(reconciliation.name()), scramOrNoneQuotas);
    // Reconcile the user secret generated by the user operator with the credentials
    Future<ReconcileResult<Secret>> userSecretFuture = reconcileUserSecret(reconciliation, user, userStatus);
    // ACLs need to reconciled for both regular and TLS username. It will be (possibly) set for one user and deleted for the other
    Future<ReconcileResult<Set<SimpleAclRule>>> aclsTlsUserFuture;
    Future<ReconcileResult<Set<SimpleAclRule>>> aclsScramUserFuture;
    if (config.isAclsAdminApiSupported()) {
        aclsTlsUserFuture = aclOperations.reconcile(reconciliation, KafkaUserModel.getTlsUserName(reconciliation.name()), tlsAcls);
        aclsScramUserFuture = aclOperations.reconcile(reconciliation, KafkaUserModel.getScramUserName(reconciliation.name()), scramOrNoneAcls);
    } else {
        aclsTlsUserFuture = Future.succeededFuture(ReconcileResult.noop(null));
        aclsScramUserFuture = Future.succeededFuture(ReconcileResult.noop(null));
    }
    return CompositeFuture.join(scramCredentialsFuture, tlsQuotasFuture, quotasFuture, aclsTlsUserFuture, aclsScramUserFuture, userSecretFuture);
}