confluent-kafka-go [AUTHN-1982] Implement OAuthBearer mechanism for Kafka client to fetch JWT token by communicating with SPIRE agent

[AUTHN-1982] Implement OAuthBearer mechanism for Kafka client to fetch JWT token by communicating with SPIRE agent

Open chang-you opened this issue 1 year ago • 1 comments

What is the purpose of the change

The goal of these changes is to write a test that integrates the Kafka client with a SPIRE server that runs in your local machine to fetch JWT token via the workload API.

Create handleJWTTokenRefreshEvent function to handle token refresh events
Create retrieveJWTToken function to fetch JWT from SPIRE agent
Import SPIFFE Workload API
Integrate OAuthBearer mechanism into Kafka Producer to enable secure communication

References

JIRA: https://confluentinc.atlassian.net/browse/AUTHN-1982

What will this work accomplish/help with?

This example test will serve as a guide for integrating Confluent’s Kafka Golang client with SPIRE to mint SPIFFE SVID’s in the form of JWT’s, this will be the client-side changes needed, we will have a separate ticket to implement the server-side changes where Kafka will be able to validate these credentials with SPIRE via the SPIRE agent/the SPIFFE workload API.

Verify the change

The test should run successfully against an actual Kafka cluster in that the followings are verified: 1- Authentication with a Kafka cluster works successfully. 2- Token refresh events are handled properly by fetching a new token every time the refresh event is fired.