Skip to content

Commit

Permalink
k8s: Remove require client authorization Admin API
Browse files Browse the repository at this point in the history
In the centralized configuration e2e test the cluster health can not be
retrieved if required client authorization is removed from Admin API. Nodes
that are running with mTLS configuration does not respond to operator get
health overview. If first out of N brokers is restarted and stops serving
Admin API with mTLS configuration, then rpk adminAPI implementation sends
http request to all in sequence get health overview. The problem is with
http client and TLS configuration as one out of N doesn not need client
certificate.
  • Loading branch information
Rafal Korepta committed Dec 1, 2022
1 parent c93d967 commit 2d775e6
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 9 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,6 @@ spec:
- port: 9644
tls:
enabled: true
requireClientAuth: true
pandaproxyApi:
- port: 8082
developerMode: true
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,10 @@ spec:
- port: 9644
tls:
enabled: true
requireClientAuth: true
pandaproxyApi:
- port: 8082
tls:
enabled: true
developerMode: true
additionalConfiguration:
redpanda.segment_appender_flush_timeout_ms: "1003"
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,6 @@ spec:
spec:
activeDeadlineSeconds: 90
volumes:
- name: tlsadmin
secret:
defaultMode: 420
secretName: centralized-configuration-tls-admin-api-client
- name: tlsadminca
secret:
defaultMode: 420
Expand All @@ -31,14 +27,12 @@ spec:
args:
- >
url=https://centralized-configuration-tls-0.centralized-configuration-tls.$NAMESPACE.svc.cluster.local:9644/v1/config
res=$(curl --cacert /etc/tls/certs/admin/ca/ca.crt --cert /etc/tls/certs/admin/tls.crt --key /etc/tls/certs/admin/tls.key --silent -L $url | grep -o '\"segment_appender_flush_timeout_ms\":[^,}]*' | grep -o '[^:]*$') &&
res=$(curl --cacert /etc/tls/certs/admin/ca/ca.crt --silent -L $url | grep -o '\"segment_appender_flush_timeout_ms\":[^,}]*' | grep -o '[^:]*$') &&
echo $res > /dev/termination-log &&
if [[ "$res" != "1003" ]]; then
exit 1;
fi
volumeMounts:
- mountPath: /etc/tls/certs/admin
name: tlsadmin
- mountPath: /etc/tls/certs/admin/ca
name: tlsadminca
restartPolicy: Never

0 comments on commit 2d775e6

Please sign in to comment.