Examples with SimpleAclRule io.strimzi.operator.user.model.acl.SimpleAclRule used on opensource projects

Example 21 with SimpleAclRule

use of io.strimzi.operator.user.model.acl.SimpleAclRule in project strimzi-kafka-operator by strimzi.

the class KafkaUserOperatorTest method testReconcileExistingScramShaUser.

@Test
public void testReconcileExistingScramShaUser(VertxTestContext context) {
    CrdOperator mockCrdOps = mock(CrdOperator.class);
    SecretOperator mockSecretOps = mock(SecretOperator.class);
    SimpleAclOperator aclOps = mock(SimpleAclOperator.class);
    ScramCredentialsOperator scramOps = mock(ScramCredentialsOperator.class);
    QuotasOperator quotasOps = mock(QuotasOperator.class);
    KafkaUserOperator op = new KafkaUserOperator(vertx, mockCertManager, mockCrdOps, mockSecretOps, scramOps, quotasOps, aclOps, ResourceUtils.createUserOperatorConfig());
    KafkaUser user = ResourceUtils.createKafkaUserScramSha();
    Secret userCert = ResourceUtils.createUserSecretScramSha();
    String password = new String(Base64.getDecoder().decode(userCert.getData().get(KafkaUserModel.KEY_PASSWORD)));
    ArgumentCaptor<String> secretNamespaceCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<String> secretNameCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<Secret> secretCaptor = ArgumentCaptor.forClass(Secret.class);
    when(mockSecretOps.reconcile(any(), secretNamespaceCaptor.capture(), secretNameCaptor.capture(), secretCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<String> scramUserCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<String> scramPasswordCaptor = ArgumentCaptor.forClass(String.class);
    when(scramOps.reconcile(any(), scramUserCaptor.capture(), scramPasswordCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<String> aclNameCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<Set<SimpleAclRule>> aclRulesCaptor = ArgumentCaptor.forClass(Set.class);
    when(aclOps.reconcile(any(), aclNameCaptor.capture(), aclRulesCaptor.capture())).thenReturn(Future.succeededFuture());
    when(mockSecretOps.getAsync(anyString(), eq(user.getMetadata().getName()))).thenReturn(Future.succeededFuture(userCert));
    when(mockCrdOps.get(eq(user.getMetadata().getNamespace()), eq(user.getMetadata().getName()))).thenReturn(user);
    when(mockCrdOps.getAsync(anyString(), anyString())).thenReturn(Future.succeededFuture(user));
    when(mockCrdOps.updateStatusAsync(any(), any(KafkaUser.class))).thenReturn(Future.succeededFuture());
    when(quotasOps.reconcile(any(), any(), any())).thenReturn(Future.succeededFuture());
    Checkpoint async = context.checkpoint();
    op.reconcile(new Reconciliation("test-trigger", KafkaUser.RESOURCE_KIND, ResourceUtils.NAMESPACE, ResourceUtils.NAME)).onComplete(context.succeeding(v -> context.verify(() -> {
        List<String> capturedNames = secretNameCaptor.getAllValues();
        assertThat(capturedNames, hasSize(1));
        assertThat(capturedNames.get(0), is(ResourceUtils.NAME));
        List<String> capturedNamespaces = secretNamespaceCaptor.getAllValues();
        assertThat(capturedNamespaces, hasSize(1));
        assertThat(capturedNamespaces.get(0), is(ResourceUtils.NAMESPACE));
        List<Secret> capturedSecrets = secretCaptor.getAllValues();
        assertThat(capturedSecrets, hasSize(1));
        Secret captured = capturedSecrets.get(0);
        assertThat(captured.getMetadata().getName(), is(user.getMetadata().getName()));
        assertThat(captured.getMetadata().getNamespace(), is(user.getMetadata().getNamespace()));
        assertThat(captured.getMetadata().getLabels(), is(Labels.fromMap(user.getMetadata().getLabels()).withKubernetesName(KafkaUserModel.KAFKA_USER_OPERATOR_NAME).withKubernetesInstance(ResourceUtils.NAME).withKubernetesPartOf(ResourceUtils.NAME).withKubernetesManagedBy(KafkaUserModel.KAFKA_USER_OPERATOR_NAME).withStrimziKind(KafkaUser.RESOURCE_KIND).toMap()));
        assertThat(new String(Base64.getDecoder().decode(captured.getData().get(KafkaUserModel.KEY_PASSWORD))), is(password));
        assertThat(scramPasswordCaptor.getValue(), is(password));
        List<String> capturedAclNames = aclNameCaptor.getAllValues();
        assertThat(capturedAclNames, hasSize(2));
        assertThat(capturedAclNames.get(0), is(KafkaUserModel.getTlsUserName(ResourceUtils.NAME)));
        assertThat(capturedAclNames.get(1), is(KafkaUserModel.getScramUserName(ResourceUtils.NAME)));
        List<Set<SimpleAclRule>> capturedAcls = aclRulesCaptor.getAllValues();
        assertThat(capturedAcls, hasSize(2));
        Set<SimpleAclRule> aclRules = capturedAcls.get(1);
        assertThat(aclRules, hasSize(ResourceUtils.createExpectedSimpleAclRules(user).size()));
        assertThat(aclRules, is(ResourceUtils.createExpectedSimpleAclRules(user)));
        assertThat(capturedAcls.get(0), is(nullValue()));
        async.flag();
    })));
}

Example 22 with SimpleAclRule

use of io.strimzi.operator.user.model.acl.SimpleAclRule in project strimzi-kafka-operator by strimzi.

the class SimpleAclOperator method getAsync.

/**
 * Returns Set of ACLs applying to single user.
 *
 * @param reconciliation The reconciliation
 * @param username  Name of the user.
 *
 * @return The Set of ACLs applying to single user.
 */
private Future<Set<SimpleAclRule>> getAsync(Reconciliation reconciliation, String username) {
    LOGGER.debugCr(reconciliation, "Searching for ACL rules of user {}", username);
    KafkaPrincipal principal = new KafkaPrincipal("User", username);
    AclBindingFilter aclBindingFilter = new AclBindingFilter(ResourcePatternFilter.ANY, new AccessControlEntryFilter(principal.toString(), null, AclOperation.ANY, AclPermissionType.ANY));
    return Util.kafkaFutureToVertxFuture(reconciliation, vertx, adminClient.describeAcls(aclBindingFilter).values()).compose(aclBindings -> {
        Set<SimpleAclRule> result = new HashSet<>(aclBindings.size());
        LOGGER.debugCr(reconciliation, "ACL rules for user {}", username);
        for (AclBinding aclBinding : aclBindings) {
            LOGGER.debugOp("{}", aclBinding);
            result.add(SimpleAclRule.fromAclBinding(aclBinding));
        }
        return Future.succeededFuture(result);
    });
}

Example 23 with SimpleAclRule

use of io.strimzi.operator.user.model.acl.SimpleAclRule in project strimzi-kafka-operator by strimzi.

the class SimpleAclOperatorIT method get.

@Override
Set<SimpleAclRule> get(String username) {
    KafkaPrincipal principal = new KafkaPrincipal("User", username);
    AclBindingFilter aclBindingFilter = new AclBindingFilter(ResourcePatternFilter.ANY, new AccessControlEntryFilter(principal.toString(), null, org.apache.kafka.common.acl.AclOperation.ANY, AclPermissionType.ANY));
    Collection<AclBinding> aclBindings;
    try {
        aclBindings = adminClient.describeAcls(aclBindingFilter).values().get();
    } catch (InterruptedException | ExecutionException e) {
        throw new RuntimeException("Failed to get ACLs", e);
    }
    Set<SimpleAclRule> result = new HashSet<>(aclBindings.size());
    for (AclBinding aclBinding : aclBindings) {
        result.add(SimpleAclRule.fromAclBinding(aclBinding));
    }
    return result.isEmpty() ? null : result;
}

Example 24 with SimpleAclRule

use of io.strimzi.operator.user.model.acl.SimpleAclRule in project strimzi by strimzi.

the class SimpleAclOperatorIT method getOriginal.

@Override
Set<SimpleAclRule> getOriginal() {
    Set<SimpleAclRule> acls = new HashSet<>();
    acls.add(new SimpleAclRule(AclRuleType.ALLOW, new SimpleAclRuleResource("my-topic", SimpleAclRuleResourceType.TOPIC, AclResourcePatternType.LITERAL), "*", AclOperation.DESCRIBE));
    acls.add(new SimpleAclRule(AclRuleType.ALLOW, new SimpleAclRuleResource("my-topic", SimpleAclRuleResourceType.TOPIC, AclResourcePatternType.LITERAL), "*", AclOperation.READ));
    acls.add(new SimpleAclRule(AclRuleType.ALLOW, new SimpleAclRuleResource("my-group", SimpleAclRuleResourceType.GROUP, AclResourcePatternType.LITERAL), "*", AclOperation.READ));
    return acls;
}

Example 25 with SimpleAclRule

use of io.strimzi.operator.user.model.acl.SimpleAclRule in project strimzi by strimzi.

the class KafkaUserOperatorTest method testReconcileExistingScramShaUser.

@Test
public void testReconcileExistingScramShaUser(VertxTestContext context) {
    CrdOperator mockCrdOps = mock(CrdOperator.class);
    SecretOperator mockSecretOps = mock(SecretOperator.class);
    SimpleAclOperator aclOps = mock(SimpleAclOperator.class);
    ScramCredentialsOperator scramOps = mock(ScramCredentialsOperator.class);
    QuotasOperator quotasOps = mock(QuotasOperator.class);
    KafkaUserOperator op = new KafkaUserOperator(vertx, mockCertManager, mockCrdOps, mockSecretOps, scramOps, quotasOps, aclOps, ResourceUtils.createUserOperatorConfig());
    KafkaUser user = ResourceUtils.createKafkaUserScramSha();
    Secret userCert = ResourceUtils.createUserSecretScramSha();
    String password = new String(Base64.getDecoder().decode(userCert.getData().get(KafkaUserModel.KEY_PASSWORD)));
    ArgumentCaptor<String> secretNamespaceCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<String> secretNameCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<Secret> secretCaptor = ArgumentCaptor.forClass(Secret.class);
    when(mockSecretOps.reconcile(any(), secretNamespaceCaptor.capture(), secretNameCaptor.capture(), secretCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<String> scramUserCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<String> scramPasswordCaptor = ArgumentCaptor.forClass(String.class);
    when(scramOps.reconcile(any(), scramUserCaptor.capture(), scramPasswordCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<String> aclNameCaptor = ArgumentCaptor.forClass(String.class);
    ArgumentCaptor<Set<SimpleAclRule>> aclRulesCaptor = ArgumentCaptor.forClass(Set.class);
    when(aclOps.reconcile(any(), aclNameCaptor.capture(), aclRulesCaptor.capture())).thenReturn(Future.succeededFuture());
    when(mockSecretOps.getAsync(anyString(), eq(user.getMetadata().getName()))).thenReturn(Future.succeededFuture(userCert));
    when(mockCrdOps.get(eq(user.getMetadata().getNamespace()), eq(user.getMetadata().getName()))).thenReturn(user);
    when(mockCrdOps.getAsync(anyString(), anyString())).thenReturn(Future.succeededFuture(user));
    when(mockCrdOps.updateStatusAsync(any(), any(KafkaUser.class))).thenReturn(Future.succeededFuture());
    when(quotasOps.reconcile(any(), any(), any())).thenReturn(Future.succeededFuture());
    Checkpoint async = context.checkpoint();
    op.reconcile(new Reconciliation("test-trigger", KafkaUser.RESOURCE_KIND, ResourceUtils.NAMESPACE, ResourceUtils.NAME)).onComplete(context.succeeding(v -> context.verify(() -> {
        List<String> capturedNames = secretNameCaptor.getAllValues();
        assertThat(capturedNames, hasSize(1));
        assertThat(capturedNames.get(0), is(ResourceUtils.NAME));
        List<String> capturedNamespaces = secretNamespaceCaptor.getAllValues();
        assertThat(capturedNamespaces, hasSize(1));
        assertThat(capturedNamespaces.get(0), is(ResourceUtils.NAMESPACE));
        List<Secret> capturedSecrets = secretCaptor.getAllValues();
        assertThat(capturedSecrets, hasSize(1));
        Secret captured = capturedSecrets.get(0);
        assertThat(captured.getMetadata().getName(), is(user.getMetadata().getName()));
        assertThat(captured.getMetadata().getNamespace(), is(user.getMetadata().getNamespace()));
        assertThat(captured.getMetadata().getLabels(), is(Labels.fromMap(user.getMetadata().getLabels()).withKubernetesName(KafkaUserModel.KAFKA_USER_OPERATOR_NAME).withKubernetesInstance(ResourceUtils.NAME).withKubernetesPartOf(ResourceUtils.NAME).withKubernetesManagedBy(KafkaUserModel.KAFKA_USER_OPERATOR_NAME).withStrimziKind(KafkaUser.RESOURCE_KIND).toMap()));
        assertThat(new String(Base64.getDecoder().decode(captured.getData().get(KafkaUserModel.KEY_PASSWORD))), is(password));
        assertThat(scramPasswordCaptor.getValue(), is(password));
        List<String> capturedAclNames = aclNameCaptor.getAllValues();
        assertThat(capturedAclNames, hasSize(2));
        assertThat(capturedAclNames.get(0), is(KafkaUserModel.getTlsUserName(ResourceUtils.NAME)));
        assertThat(capturedAclNames.get(1), is(KafkaUserModel.getScramUserName(ResourceUtils.NAME)));
        List<Set<SimpleAclRule>> capturedAcls = aclRulesCaptor.getAllValues();
        assertThat(capturedAcls, hasSize(2));
        Set<SimpleAclRule> aclRules = capturedAcls.get(1);
        assertThat(aclRules, hasSize(ResourceUtils.createExpectedSimpleAclRules(user).size()));
        assertThat(aclRules, is(ResourceUtils.createExpectedSimpleAclRules(user)));
        assertThat(capturedAcls.get(0), is(nullValue()));
        async.flag();
    })));
}