Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

kafka: allow disabling kerberos FAST in sarama client #6189

Merged
merged 1 commit into from
Oct 18, 2024

Conversation

jkyros
Copy link
Contributor

@jkyros jkyros commented Sep 26, 2024

This:

  • adds a kerberosDisableFAST field to the kafka scaler metadata, which can be used to disable sarama's/gokrb5's FAST negotiation for kerberos connections
  • populates said field from a kerberosDisableFAST field in the AuthConfig

Which will let a user disable FAST as part of their Kerberos configuration.

I'm not attached to any of the naming here, I just want the plumbing, right now we just can't manipulate this at all. 😄

Checklist

Fixes #6188

@jkyros jkyros requested a review from a team as a code owner September 26, 2024 06:01
@jkyros jkyros force-pushed the allow-disable-krb-fast branch from 3f28c8f to 8a27419 Compare September 26, 2024 15:36
@JorTurFer
Copy link
Member

JorTurFer commented Oct 6, 2024

/run-e2e kafka
Update: You can check the progress here

Copy link
Member

@JorTurFer JorTurFer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! PTAL @zroubalik @dttung2905

Copy link
Contributor

@dttung2905 dttung2905 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. I think we have a CI error (here)

=== FAIL: pkg/scalers TestParseElasticsearchMetadata/no_index_given (0.00s)
    elasticsearch_scaler_test.go:321: 
        	Error Trace:	/__w/keda/keda/pkg/scalers/elasticsearch_scaler_test.go:321
        	Error:      	"missing required parameter [\"index\"] in [authParams triggerMetadata]\nmissing required parameter [\"searchTemplateName\"] in [authParams triggerMetadata]\nmissing required parameter [\"valueLocation\"] in [authParams triggerMetadata]\nmissing required parameter [\"targetValue\"] in [authParams triggerMetadata]\nboth username and password must be provided when addresses is used" does not contain "missing required parameter \"index\""
        	Test:       	TestParseElasticsearchMetadata/no_index_given

I don't think its related to our changes. @JorTurFer Could you help to confirm this too?

Our sarama client has kerberos FAST negotiation turned on by default,
but there are KDCs that can't handle FAST negotiation and will fail.
There is an option to configure this on the sarama client, but we didn't
expose it anywhere, so users couldn't get to it.

This just adds an additional auth parameter to AuthConfig to expose that
configuration option so users who need to shut off FAST are able to do
so.

Signed-off-by: John Kyros <[email protected]>
@jkyros jkyros force-pushed the allow-disable-krb-fast branch from 8a27419 to 18264ad Compare October 14, 2024 20:12
@jkyros
Copy link
Contributor Author

jkyros commented Oct 14, 2024

rebased and resolved CHANGELOG conflict 😄

@JorTurFer
Copy link
Member

JorTurFer commented Oct 16, 2024

/run-e2e kafka
Update: You can check the progress here

@JorTurFer
Copy link
Member

PTAL @kedacore/keda-core-contributors

@zroubalik zroubalik enabled auto-merge (squash) October 18, 2024 11:58
@zroubalik zroubalik disabled auto-merge October 18, 2024 13:42
@zroubalik zroubalik merged commit 4fdf649 into kedacore:main Oct 18, 2024
18 of 19 checks passed
rickbrouwer pushed a commit to rickbrouwer/keda that referenced this pull request Oct 21, 2024
Our sarama client has kerberos FAST negotiation turned on by default,
but there are KDCs that can't handle FAST negotiation and will fail.
There is an option to configure this on the sarama client, but we didn't
expose it anywhere, so users couldn't get to it.

This just adds an additional auth parameter to AuthConfig to expose that
configuration option so users who need to shut off FAST are able to do
so.

Signed-off-by: John Kyros <[email protected]>
mpechner-akasa pushed a commit to nrichardson-akasa/keda that referenced this pull request Nov 29, 2024
Our sarama client has kerberos FAST negotiation turned on by default,
but there are KDCs that can't handle FAST negotiation and will fail.
There is an option to configure this on the sarama client, but we didn't
expose it anywhere, so users couldn't get to it.

This just adds an additional auth parameter to AuthConfig to expose that
configuration option so users who need to shut off FAST are able to do
so.

Signed-off-by: John Kyros <[email protected]>
Signed-off-by: michael pechner <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Kafka Scaler: Allow disabling Kerberos FAST negotiation to allow use with KDCs that don't support FAST
4 participants