redpanda
redpanda copied to clipboard
mTLS Authz test: user migrates entire cluster to mTLS
- Start with enable_sasl=true
- Set authentication_method=mtls_identity for all brokers
- Set kafka_mtls_principal_mapping_rules and kafka_enable_authorization=true. This will enable authZ across the cluster.
- Check that authZ still works on all brokers and mTLS identity is used for authN.
Manual tests were successful on a 3 broker cluster where I executed rolling restarts.
One test migrated a cluster to use authentication_method=sasl and another manual test used authentication_method=mtls_identity and a principal mapping rule of RULE:^O=Redpanda,CN=(cluster_describe|redpanda.service.admin|admin)$/$1/. Both tests successfully executed a simple authz/authn check using rpk acl list
The automated test in #5784 needs some improvements because it is not using rolling restarts.