From 6c642f9d92370d7dbe1cff428a5b9a9668ae20fc Mon Sep 17 00:00:00 2001 From: Lari Hotari Date: Tue, 16 Jan 2024 00:06:44 +0200 Subject: [PATCH 1/5] Add support for proxyRoles --- charts/pulsar/templates/broker-configmap.yaml | 6 ++++++ charts/pulsar/templates/proxy-configmap.yaml | 4 ++++ charts/pulsar/values.yaml | 2 ++ 3 files changed, 12 insertions(+) diff --git a/charts/pulsar/templates/broker-configmap.yaml b/charts/pulsar/templates/broker-configmap.yaml index c02a4dfd..3ed807d5 100644 --- a/charts/pulsar/templates/broker-configmap.yaml +++ b/charts/pulsar/templates/broker-configmap.yaml @@ -113,7 +113,13 @@ data: authenticationEnabled: "true" {{- if .Values.auth.authorization.enabled }} authorizationEnabled: "true" + {{- if .Values.auth.useProxyRoles }} + superUserRoles: {{ omit .Values.auth.superUsers "proxy" | values | sortAlpha | join "," }} + proxyRoles: {{ .Values.auth.superUsers.proxy }} + {{- else }} superUserRoles: {{ .Values.auth.superUsers | values | sortAlpha | join "," }} + {{- end }} + {{- end }} {{- if eq .Values.auth.authentication.provider "jwt" }} # token authentication configuration diff --git a/charts/pulsar/templates/proxy-configmap.yaml b/charts/pulsar/templates/proxy-configmap.yaml index 5770abae..0d82d8b8 100644 --- a/charts/pulsar/templates/proxy-configmap.yaml +++ b/charts/pulsar/templates/proxy-configmap.yaml @@ -64,8 +64,12 @@ data: # disable authorization on proxy and forward authorization credentials to broker authorizationEnabled: "false" forwardAuthorizationCredentials: "true" + {{- if .Values.auth.useProxyRoles }} + superUserRoles: {{ omit .Values.auth.superUsers "proxy" | values | sortAlpha | join "," }} + {{- else }} superUserRoles: {{ .Values.auth.superUsers | values | sortAlpha | join "," }} {{- end }} + {{- end }} {{- if eq .Values.auth.authentication.provider "jwt" }} # token authentication configuration authenticationProviders: "org.apache.pulsar.broker.authentication.AuthenticationProviderToken" diff --git a/charts/pulsar/values.yaml b/charts/pulsar/values.yaml index 92f1da2b..9cdcc867 100644 --- a/charts/pulsar/values.yaml +++ b/charts/pulsar/values.yaml @@ -249,6 +249,8 @@ auth: proxy: "proxy-admin" # pulsar-admin client to broker/proxy communication client: "admin" + # omits the above proxy role from superusers and configures it as a proxy role + useProxyRoles: true ###################################################################### # External dependencies From e6db760760cbfb84ac4a9f6f9170f3b04da654a3 Mon Sep 17 00:00:00 2001 From: Lari Hotari Date: Tue, 16 Jan 2024 00:10:58 +0200 Subject: [PATCH 2/5] Test produce and consume via Pulsar proxy --- .ci/helm.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.ci/helm.sh b/.ci/helm.sh index 3284b0fd..c05d9bf3 100644 --- a/.ci/helm.sh +++ b/.ci/helm.sh @@ -178,6 +178,9 @@ function ci::test_pulsar_producer_consumer() { ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-admin topics create-subscription -s test pulsar-ci/test/test-topic ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client produce -m "test-message" pulsar-ci/test/test-topic ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client consume -s test pulsar-ci/test/test-topic + ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-admin topics create-subscription -s test2 pulsar-ci/test/test-topic + ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client --url pulsar://pulsar-ci-proxy:6650 produce -m "test-message2" pulsar-ci/test/test-topic + ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client --url pulsar://pulsar-ci-proxy:6650 consume -s test2 pulsar-ci/test/test-topic } function ci::wait_function_running() { From 3d12e9bb138b65b955b6ae8c58b8fa0abcd96918 Mon Sep 17 00:00:00 2001 From: Lari Hotari Date: Tue, 16 Jan 2024 00:36:22 +0200 Subject: [PATCH 3/5] Use correct url for proxy when TLS is enabled --- .ci/helm.sh | 9 +++++++-- .github/workflows/pulsar-helm-chart-ci.yaml | 7 +++++++ 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/.ci/helm.sh b/.ci/helm.sh index c05d9bf3..5333b00a 100644 --- a/.ci/helm.sh +++ b/.ci/helm.sh @@ -179,8 +179,13 @@ function ci::test_pulsar_producer_consumer() { ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client produce -m "test-message" pulsar-ci/test/test-topic ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client consume -s test pulsar-ci/test/test-topic ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-admin topics create-subscription -s test2 pulsar-ci/test/test-topic - ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client --url pulsar://pulsar-ci-proxy:6650 produce -m "test-message2" pulsar-ci/test/test-topic - ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client --url pulsar://pulsar-ci-proxy:6650 consume -s test2 pulsar-ci/test/test-topic + if [[ "$PROXY_TLS" == "true" ]]; then + PROXY_URL="pulsar+ssl://pulsar-ci-proxy:6651" + else + PROXY_URL="pulsar://pulsar-ci-proxy:6650" + fi + ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client --url "${PROXY_URL}" produce -m "test-message2" pulsar-ci/test/test-topic + ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client --url "${PROXY_URL}" consume -s test2 pulsar-ci/test/test-topic } function ci::wait_function_running() { diff --git a/.github/workflows/pulsar-helm-chart-ci.yaml b/.github/workflows/pulsar-helm-chart-ci.yaml index 87781864..f7129f13 100644 --- a/.github/workflows/pulsar-helm-chart-ci.yaml +++ b/.github/workflows/pulsar-helm-chart-ci.yaml @@ -240,7 +240,14 @@ jobs: "jwt-symmetric") export SYMMETRIC=true ;; + "tls") + export PROXY_TLS=true + ;; + "broker-tls") + export PROXY_TLS=true + ;; esac + export TEST_SCENARIO=${{ matrix.testScenario.shortname }} .ci/chart_test.sh ${{ matrix.testScenario.values_file }} - name: Collect k8s logs on failure From 7f128ae70244e573ba583890be4d7e23f73bdb09 Mon Sep 17 00:00:00 2001 From: Lari Hotari Date: Tue, 16 Jan 2024 01:40:07 +0200 Subject: [PATCH 4/5] On the broker, let the proxy role remain a superuser role --- charts/pulsar/templates/broker-configmap.yaml | 6 ++---- charts/pulsar/values.yaml | 3 ++- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/charts/pulsar/templates/broker-configmap.yaml b/charts/pulsar/templates/broker-configmap.yaml index 3ed807d5..ab903d14 100644 --- a/charts/pulsar/templates/broker-configmap.yaml +++ b/charts/pulsar/templates/broker-configmap.yaml @@ -113,13 +113,11 @@ data: authenticationEnabled: "true" {{- if .Values.auth.authorization.enabled }} authorizationEnabled: "true" + superUserRoles: {{ .Values.auth.superUsers | values | sortAlpha | join "," }} {{- if .Values.auth.useProxyRoles }} - superUserRoles: {{ omit .Values.auth.superUsers "proxy" | values | sortAlpha | join "," }} proxyRoles: {{ .Values.auth.superUsers.proxy }} - {{- else }} - superUserRoles: {{ .Values.auth.superUsers | values | sortAlpha | join "," }} {{- end }} - + {{- end }} {{- if eq .Values.auth.authentication.provider "jwt" }} # token authentication configuration diff --git a/charts/pulsar/values.yaml b/charts/pulsar/values.yaml index 9cdcc867..167b4c64 100644 --- a/charts/pulsar/values.yaml +++ b/charts/pulsar/values.yaml @@ -249,7 +249,8 @@ auth: proxy: "proxy-admin" # pulsar-admin client to broker/proxy communication client: "admin" - # omits the above proxy role from superusers and configures it as a proxy role + # omits the above proxy role from superusers on the proxy + # and configures it as a proxy role on the broker in addition to the superusers useProxyRoles: true ###################################################################### From 614e4f06ec194a952febe25bd102b426b091ee32 Mon Sep 17 00:00:00 2001 From: Lari Hotari Date: Tue, 16 Jan 2024 02:17:58 +0200 Subject: [PATCH 5/5] Use chart values for determining if TLS is enabled for proxy --- .ci/helm.sh | 11 ++++++++++- .github/workflows/pulsar-helm-chart-ci.yaml | 7 ------- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/.ci/helm.sh b/.ci/helm.sh index 5333b00a..4838e4e4 100644 --- a/.ci/helm.sh +++ b/.ci/helm.sh @@ -164,6 +164,15 @@ function ci::install_pulsar_chart() { # ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bash -c 'until [ "$(curl -L http://pulsar-ci-proxy:8080/status.html)" == "OK" ]; do sleep 3; done' } +helm_values_cached="" + +function ci::helm_values_for_deployment() { + if [[ -z "${helm_values_cached}" ]]; then + helm_values_cached=$(helm get values -n ${NAMESPACE} ${CLUSTER} -a -o yaml) + fi + printf "%s" "${helm_values_cached}" +} + function ci::test_pulsar_producer_consumer() { sleep 120 ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bash -c 'until nslookup pulsar-ci-broker; do sleep 3; done' @@ -179,7 +188,7 @@ function ci::test_pulsar_producer_consumer() { ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client produce -m "test-message" pulsar-ci/test/test-topic ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client consume -s test pulsar-ci/test/test-topic ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-admin topics create-subscription -s test2 pulsar-ci/test/test-topic - if [[ "$PROXY_TLS" == "true" ]]; then + if [[ "$(ci::helm_values_for_deployment | yq .tls.proxy.enabled)" == "true" ]]; then PROXY_URL="pulsar+ssl://pulsar-ci-proxy:6651" else PROXY_URL="pulsar://pulsar-ci-proxy:6650" diff --git a/.github/workflows/pulsar-helm-chart-ci.yaml b/.github/workflows/pulsar-helm-chart-ci.yaml index f7129f13..87781864 100644 --- a/.github/workflows/pulsar-helm-chart-ci.yaml +++ b/.github/workflows/pulsar-helm-chart-ci.yaml @@ -240,14 +240,7 @@ jobs: "jwt-symmetric") export SYMMETRIC=true ;; - "tls") - export PROXY_TLS=true - ;; - "broker-tls") - export PROXY_TLS=true - ;; esac - export TEST_SCENARIO=${{ matrix.testScenario.shortname }} .ci/chart_test.sh ${{ matrix.testScenario.values_file }} - name: Collect k8s logs on failure