Skip to content

Support configuring "proxyRoles" in broker #430

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lhotari merged 5 commits into from
Jan 16, 2024
Merged

Support configuring "proxyRoles" in broker #430

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6c642f9
Add support for proxyRoles
lhotari Jan 15, 2024
e6db760
Test produce and consume via Pulsar proxy
lhotari Jan 15, 2024
3d12e9b
Use correct url for proxy when TLS is enabled
lhotari Jan 15, 2024
7f128ae
On the broker, let the proxy role remain a superuser role
lhotari Jan 15, 2024
614e4f0
Use chart values for determining if TLS is enabled for proxy
lhotari Jan 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions .ci/helm.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,15 @@ function ci::install_pulsar_chart() {
# ${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bash -c 'until [ "$(curl -L http://pulsar-ci-proxy:8080/status.html)" == "OK" ]; do sleep 3; done'
}

helm_values_cached=""

function ci::helm_values_for_deployment() {
if [[ -z "${helm_values_cached}" ]]; then
helm_values_cached=$(helm get values -n ${NAMESPACE} ${CLUSTER} -a -o yaml)
fi
printf "%s" "${helm_values_cached}"
}

function ci::test_pulsar_producer_consumer() {
sleep 120
${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bash -c 'until nslookup pulsar-ci-broker; do sleep 3; done'
Expand All @@ -178,6 +187,14 @@ function ci::test_pulsar_producer_consumer() {
${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-admin topics create-subscription -s test pulsar-ci/test/test-topic
${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client produce -m "test-message" pulsar-ci/test/test-topic
${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client consume -s test pulsar-ci/test/test-topic
${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-admin topics create-subscription -s test2 pulsar-ci/test/test-topic
if [[ "$(ci::helm_values_for_deployment | yq .tls.proxy.enabled)" == "true" ]]; then
PROXY_URL="pulsar+ssl://pulsar-ci-proxy:6651"
else
PROXY_URL="pulsar://pulsar-ci-proxy:6650"
fi
${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client --url "${PROXY_URL}" produce -m "test-message2" pulsar-ci/test/test-topic
${KUBECTL} exec -n ${NAMESPACE} ${CLUSTER}-toolset-0 -- bin/pulsar-client --url "${PROXY_URL}" consume -s test2 pulsar-ci/test/test-topic
}

function ci::wait_function_running() {
Expand Down
4 changes: 4 additions & 0 deletions charts/pulsar/templates/broker-configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,10 @@ data:
{{- if .Values.auth.authorization.enabled }}
authorizationEnabled: "true"
superUserRoles: {{ .Values.auth.superUsers | values | sortAlpha | join "," }}
{{- if .Values.auth.useProxyRoles }}
proxyRoles: {{ .Values.auth.superUsers.proxy }}
{{- end }}

{{- end }}
{{- if eq .Values.auth.authentication.provider "jwt" }}
# token authentication configuration
Expand Down
4 changes: 4 additions & 0 deletions charts/pulsar/templates/proxy-configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,8 +64,12 @@ data:
# disable authorization on proxy and forward authorization credentials to broker
authorizationEnabled: "false"
forwardAuthorizationCredentials: "true"
{{- if .Values.auth.useProxyRoles }}
superUserRoles: {{ omit .Values.auth.superUsers "proxy" | values | sortAlpha | join "," }}
{{- else }}
superUserRoles: {{ .Values.auth.superUsers | values | sortAlpha | join "," }}
{{- end }}
{{- end }}
{{- if eq .Values.auth.authentication.provider "jwt" }}
# token authentication configuration
authenticationProviders: "org.apache.pulsar.broker.authentication.AuthenticationProviderToken"
Expand Down
3 changes: 3 additions & 0 deletions charts/pulsar/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -249,6 +249,9 @@ auth:
proxy: "proxy-admin"
# pulsar-admin client to broker/proxy communication
client: "admin"
# omits the above proxy role from superusers on the proxy
# and configures it as a proxy role on the broker in addition to the superusers
useProxyRoles: true

######################################################################
# External dependencies
Expand Down