CORE-14878: Migrate "Users" Admin API v1 Security Endpoints to v2 ConnectRPC API #29174
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -21,11 +21,62 @@ import "proto/redpanda/core/pbgen/rpc.proto"; | |
| import "google/api/field_behavior.proto"; | ||
| import "google/api/resource.proto"; | ||
| import "google/protobuf/timestamp.proto"; | ||
| import "google/protobuf/field_mask.proto"; | ||
|
|
||
| option (pbgen.cpp_namespace) = "proto::admin"; | ||
|
|
||
| // The SecurityService provides security-related operations. | ||
| service SecurityService { | ||
| // CreateScramCredential | ||
| // | ||
| // Create a SCRAM credential. | ||
| rpc CreateScramCredential(CreateScramCredentialRequest) | ||
| returns (CreateScramCredentialResponse) { | ||
| option (pbgen.rpc) = { | ||
| authz: SUPERUSER | ||
| }; | ||
| } | ||
|
|
||
| // GetScramCredential | ||
| // | ||
| // Retrieve a SCRAM credential. | ||
| rpc GetScramCredential(GetScramCredentialRequest) | ||
| returns (GetScramCredentialResponse) { | ||
| option (pbgen.rpc) = { | ||
| authz: SUPERUSER | ||
| }; | ||
| } | ||
|
|
||
| // ListScramCredentials | ||
| // | ||
| // List all SCRAM credentials. | ||
| rpc ListScramCredentials(ListScramCredentialsRequest) | ||
| returns (ListScramCredentialsResponse) { | ||
| option (pbgen.rpc) = { | ||
| authz: SUPERUSER | ||
| }; | ||
| } | ||
|
|
||
| // UpdateScramCredential | ||
| // | ||
| // Update a SCRAM credential. | ||
| rpc UpdateScramCredential(UpdateScramCredentialRequest) | ||
| returns (UpdateScramCredentialResponse) { | ||
| option (pbgen.rpc) = { | ||
| authz: SUPERUSER | ||
| }; | ||
| } | ||
|
|
||
| // DeleteScramCredential | ||
| // | ||
| // Delete a SCRAM credential. | ||
| rpc DeleteScramCredential(DeleteScramCredentialRequest) | ||
| returns (DeleteScramCredentialResponse) { | ||
| option (pbgen.rpc) = { | ||
| authz: SUPERUSER | ||
| }; | ||
| } | ||
|
|
||
| // CreateRole | ||
| // | ||
| // Create a new Role resource. | ||
|
|
@@ -134,6 +185,34 @@ service SecurityService { | |
| /* Resources */ | ||
| // ============================================= | ||
|
|
||
| // The ScramCredential resource used for SCRAM authentication. | ||
| message ScramCredential { | ||
| option (google.api.resource) = { | ||
| type: "redpanda.core.admin.SecurityService/ScramCredential" | ||
| pattern: "scram_credentials/{scram_credential}" | ||
| }; | ||
|
|
||
| // The name of the SCRAM credential. | ||
| string name = 1 [ | ||
| (google.api.field_behavior) = REQUIRED, | ||
| (google.api.field_behavior) = IMMUTABLE | ||
| ]; | ||
|
|
||
| // The SCRAM mechanism. | ||
| enum ScramMechanism { | ||
| SCRAM_MECHANISM_UNSPECIFIED = 0; | ||
| SCRAM_MECHANISM_SCRAM_SHA_256 = 1; | ||
| SCRAM_MECHANISM_SCRAM_SHA_512 = 2; | ||
| } | ||
|
|
||
| // The SCRAM mechanism used for this credential. | ||
| ScramMechanism mechanism = 2; | ||
|
|
||
| // The password for the SCRAM credential. | ||
| string password = 3 | ||
| [debug_redact = true, (google.api.field_behavior) = INPUT_ONLY]; | ||
|
Comment on lines
+211
to
+213
Contributor
There was a problem hiding this comment. I think we should also add a redpanda/proto/redpanda/core/admin/v2/shadow_link.proto Lines 466 to 469 in c3e36a2 I do think this may result in having to make controller updates to store the timestamp. |
||
| } | ||
|
|
||
| // The Role resource represents a security role with associated members. | ||
| message Role { | ||
| option (google.api.resource) = { | ||
|
|
@@ -155,6 +234,83 @@ message Role { | |
| /* RPC Requests and Responses */ | ||
| // ============================================= | ||
|
|
||
| // CreateScramCredentialRequest is the request for the CreateScramCredential | ||
| // RPC. | ||
| message CreateScramCredentialRequest { | ||
| // The SCRAM credential to create. | ||
| ScramCredential scram_credential = 1 | ||
| [(google.api.field_behavior) = REQUIRED]; | ||
| } | ||
|
|
||
| // CreateScramCredentialResponse is the response from the CreateScramCredential | ||
| // RPC. | ||
| message CreateScramCredentialResponse { | ||
| // The created SCRAM credential. | ||
| ScramCredential scram_credential = 1; | ||
| } | ||
|
|
||
| // GetScramCredentialRequest is the request for the GetScramCredential RPC. | ||
| message GetScramCredentialRequest { | ||
| // The name of the SCRAM credential to retrieve. | ||
| string name = 1 [ | ||
| (google.api.field_behavior) = REQUIRED, | ||
| (google.api.resource_reference) = { | ||
| type: "redpanda.core.admin.SecurityService/ScramCredential" | ||
| } | ||
| ]; | ||
| } | ||
|
|
||
| // GetScramCredentialResponse is the response from the GetScramCredential RPC. | ||
| message GetScramCredentialResponse { | ||
| // The requested SCRAM credential. | ||
| ScramCredential scram_credential = 1; | ||
| } | ||
|
|
||
| // ListScramCredentialsRequest is the request for the ListScramCredentials RPC. | ||
| message ListScramCredentialsRequest {} | ||
|
|
||
| // ListScramCredentialsResponse is the response from the ListScramCredentials | ||
| // RPC. | ||
| message ListScramCredentialsResponse { | ||
| // The list of SCRAM credentials. | ||
| repeated ScramCredential scram_credentials = 1; | ||
| } | ||
|
|
||
| // UpdateScramCredentialRequest is the request for the UpdateScramCredential | ||
| // RPC. | ||
| message UpdateScramCredentialRequest { | ||
| // The SCRAM credential to update. | ||
| ScramCredential scram_credential = 1 | ||
| [(google.api.field_behavior) = REQUIRED]; | ||
|
|
||
| // The list of fields to update | ||
| // See [AIP-134](https://google.aip.dev/134) for how to use `field_mask` | ||
| google.protobuf.FieldMask update_mask = 2; | ||
| } | ||
|
|
||
| // UpdateScramCredentialResponse is the response from the UpdateScramCredential | ||
| // RPC. | ||
| message UpdateScramCredentialResponse { | ||
| // The updated SCRAM credential. | ||
| ScramCredential scram_credential = 1; | ||
| } | ||
|
|
||
| // DeleteScramCredentialRequest is the request for the DeleteScramCredential | ||
| // RPC. | ||
| message DeleteScramCredentialRequest { | ||
| // The name of the SCRAM credential to delete. | ||
| string name = 1 [ | ||
| (google.api.field_behavior) = REQUIRED, | ||
| (google.api.resource_reference) = { | ||
| type: "redpanda.core.admin.SecurityService/ScramCredential" | ||
| } | ||
| ]; | ||
| } | ||
|
|
||
| // DeleteScramCredentialResponse is the response from the DeleteScramCredential | ||
| // RPC. | ||
| message DeleteScramCredentialResponse {} | ||
|
|
||
| // CreateRoleRequest is the request for the CreateRole RPC. | ||
| message CreateRoleRequest { | ||
| // The Role to create. | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I wonder if it would be useful to extract this to a common area of security. Maybe a security_types.proto