redpanda icon indicating copy to clipboard operation
redpanda copied to clipboard

Extend mtls config tests ben

Open BenPope opened this issue 3 years ago • 2 comments

Cover letter

PRs such as #4501 and #5292 extended the authn and authz layers to support principal mapping rules. The result of those patches were new configs such as endpoint_authn_method and kafka_enable_authorization.

Therefore this PR extends our ACLs tests to check different permutations of authn/authz configs.

The params in this test are:

  • use_tls - Controls whether tls certs are used : True or False
  • use_sasl - Controls the value of enable_sasl RP config : True or False
  • enable_authz - Controls the value of kafka_enable_authorization RP config : None, True, or False
  • authn_method - Controls the broker level authentication_method (e.g., mtls_identity) : sasl, mtls_identity, or None
  • client_auth - Controls the value of require_client_auth RP config : True or False

That makes 72 tests covered in this PR.

Closes https://github.com/redpanda-data/redpanda/issues/5682 Closes #5739

Backport Required

  • [ ] not a bug fix
  • [ ] papercut/not impactful enough to backport
  • [ ] v22.2.x
  • [ ] v22.1.x
  • [ ] v21.11.x

UX changes

  • none

Release notes

  • Adds a test to check many permutations of authentication & authorization configs

BenPope avatar Aug 03 '22 21:08 BenPope

In the final step for #5739 , I'm seeing the error unable to produce record: TOPIC_AUTHORIZATION_FAILED: Not authorized to access topics: [Topic authorization failed.]. Is that expected?

It's not a crash :)

NyaliaLui avatar Aug 05 '22 17:08 NyaliaLui

Closed #5683 in favor of this PR since it has the updated patches and test changes.

NyaliaLui avatar Aug 05 '22 17:08 NyaliaLui

Closed by #5906

BenPope avatar Aug 10 '22 13:08 BenPope