stackabletech / stackabletech/kafka-operator
Exclude TLS combinations that we don't want to support
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 28
- Forks
- 8
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 9
Description
Investigate if we want to allow users to enable mutual tls, without enabling tls. The current implementation allows this.
Background
Some Kafka integration tests (e.g. upgrade_zookeeper-3.9.2_upgrade_old-3.7.1_upgrade_new-3.8.0_use-client-tls-false_use-client-auth-tls-true_openshift-false) allow a combination that we may want to exclude. It sets internalSecretClass but not serverSecretClass:
{% if test_scenario['values']['use-client-auth-tls'] == 'true' %}
authentication:
- authenticationClass: test-kafka-client-auth-tls
{% endif %}
tls:
{% if test_scenario['values']['use-client-tls'] == 'true' %}
serverSecretClass: tls
{% else %}
serverSecretClass: null
{% endif %}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with tests/templates/kuttl/upgrade/02-install-kafka.yaml.j2 and trace how use-client-tls and use-client-auth-tls are used in the upgrade scenario. Review the operator's configuration handling to determine where this combination should be rejected or excluded. Done means the supported policy is explicit and the referenced scenario no longer permits an unsupported combination.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kafka, rust
- Domain
- backend, testing-qa
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100