Skip to content

Commit e411837

Browse files
kbatuigasJakeSCahill
kbatuigas
and
JakeSCahill
authored
[25.3] Security report Admin API (#35)
* Add security report endpoint * Minor edit * Rephrase * Minor edits --------- Co-authored-by: Jake Cahill <[email protected]>
1 parent 5858177 commit e411837

File tree

1 file changed

+237
-1
lines changed

1 file changed

+237
-1
lines changed

‎admin/admin.yaml‎

Lines changed: 237 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -546,7 +546,54 @@ paths:
546546
content:
547547
application/json:
548548
schema:
549-
$ref: '#/components/schemas/oidc_keys_cache_invalidate_error_response'
549+
$ref: '#/components/schemas/oidc_keys_cache_invalidate_error_response'
550+
/v1/security/report:
551+
get:
552+
tags:
553+
- Security
554+
summary: Get security report
555+
description: |
556+
Get a comprehensive security report for the cluster, including information about
557+
security configurations such as authentication methods, TLS settings, and security alerts for all interfaces (Kafka, RPC, Admin, Schema Registry,
558+
HTTP Proxy).
559+
operationId: get_security_report
560+
responses:
561+
'200':
562+
description: Security report
563+
content:
564+
application/json:
565+
schema:
566+
type: object
567+
properties:
568+
interfaces:
569+
type: object
570+
properties:
571+
kafka:
572+
type: array
573+
items:
574+
$ref: '#/components/schemas/kafka_interface_security_report'
575+
rpc:
576+
$ref: '#/components/schemas/rpc_interface_security_report'
577+
admin:
578+
type: array
579+
items:
580+
$ref: '#/components/schemas/admin_interface_security_report'
581+
schema_registry:
582+
type: array
583+
items:
584+
$ref: '#/components/schemas/schema_registry_interface_security_report'
585+
schema_registry_client:
586+
$ref: '#/components/schemas/client_security_report'
587+
pandaproxy:
588+
type: array
589+
items:
590+
$ref: '#/components/schemas/pandaproxy_interface_security_report'
591+
audit_log_client:
592+
$ref: '#/components/schemas/client_security_report'
593+
alerts:
594+
type: array
595+
items:
596+
$ref: '#/components/schemas/security_report_alert'
550597
/v1/status/ready:
551598
get:
552599
tags:
@@ -6021,6 +6068,190 @@ components:
60216068
id:
60226069
type: integer
60236070
format: int32
6071+
security_report_alert:
6072+
type: object
6073+
properties:
6074+
affected_interface:
6075+
type: string
6076+
enum:
6077+
- kafka
6078+
- rpc
6079+
- admin
6080+
- schema_registry
6081+
- schema_registry_client
6082+
- pandaproxy
6083+
- audit_log_client
6084+
listener_name:
6085+
description: The listener name of the affected interface, if provided
6086+
type: string
6087+
issue:
6088+
type: string
6089+
enum:
6090+
- NO_TLS
6091+
- NO_AUTHN
6092+
- NO_AUTHZ
6093+
- SASL_PLAIN
6094+
- PP_CONFIGURED_CLIENT
6095+
- INSECURE_MIN_TLS_VERSION
6096+
- TLS_RENEGOTIATION
6097+
description:
6098+
description: Human-readable description of the alert
6099+
type: string
6100+
required:
6101+
- issue
6102+
- description
6103+
kafka_interface_security_report:
6104+
description: Security report for Kafka API interface
6105+
type: object
6106+
properties:
6107+
name:
6108+
type: string
6109+
host:
6110+
type: string
6111+
port:
6112+
type: integer
6113+
advertised_host:
6114+
type: string
6115+
advertised_port:
6116+
type: integer
6117+
tls_enabled:
6118+
type: boolean
6119+
mutual_tls_enabled:
6120+
type: boolean
6121+
authentication_method:
6122+
type: string
6123+
enum:
6124+
- SASL
6125+
- mTLS
6126+
- None
6127+
authorization_enabled:
6128+
type: boolean
6129+
supported_sasl_mechanisms:
6130+
type: array
6131+
items:
6132+
type: string
6133+
rpc_interface_security_report:
6134+
description: Security report for RPC interface
6135+
type: object
6136+
properties:
6137+
host:
6138+
type: string
6139+
port:
6140+
type: integer
6141+
advertised_host:
6142+
type: string
6143+
advertised_port:
6144+
type: integer
6145+
tls_enabled:
6146+
type: boolean
6147+
mutual_tls_enabled:
6148+
type: boolean
6149+
admin_interface_security_report:
6150+
description: Security report for Admin API interface
6151+
type: object
6152+
properties:
6153+
name:
6154+
type: string
6155+
host:
6156+
type: string
6157+
port:
6158+
type: integer
6159+
tls_enabled:
6160+
type: boolean
6161+
mutual_tls_enabled:
6162+
type: boolean
6163+
authentication_methods:
6164+
type: array
6165+
items:
6166+
type: string
6167+
enum:
6168+
- BASIC
6169+
- OIDC
6170+
authorization_enabled:
6171+
type: boolean
6172+
schema_registry_interface_security_report:
6173+
description: Security report for Schema Registry interface
6174+
type: object
6175+
properties:
6176+
name:
6177+
type: string
6178+
host:
6179+
type: string
6180+
port:
6181+
type: integer
6182+
tls_enabled:
6183+
type: boolean
6184+
mutual_tls_enabled:
6185+
type: boolean
6186+
authentication_methods:
6187+
type: array
6188+
items:
6189+
type: string
6190+
enum:
6191+
- BASIC
6192+
- OIDC
6193+
authorization_enabled:
6194+
type: boolean
6195+
pandaproxy_interface_security_report:
6196+
description: Security report for HTTP Proxy (Pandaproxy) interface
6197+
type: object
6198+
properties:
6199+
name:
6200+
type: string
6201+
host:
6202+
type: string
6203+
port:
6204+
type: integer
6205+
advertised_host:
6206+
type: string
6207+
advertised_port:
6208+
type: integer
6209+
tls_enabled:
6210+
type: boolean
6211+
mutual_tls_enabled:
6212+
type: boolean
6213+
authentication_methods:
6214+
type: array
6215+
items:
6216+
type: string
6217+
enum:
6218+
- BASIC
6219+
- OIDC
6220+
authorization_enabled:
6221+
type: boolean
6222+
configured_authentication_method:
6223+
type: string
6224+
enum:
6225+
- None
6226+
- SCRAM_Configured
6227+
- SCRAM_Proxied
6228+
host_port:
6229+
type: object
6230+
properties:
6231+
host:
6232+
type: string
6233+
port:
6234+
type: integer
6235+
client_security_report:
6236+
description: Security report for Kafka client interface
6237+
type: object
6238+
properties:
6239+
kafka_listener_name:
6240+
type: string
6241+
brokers:
6242+
type: array
6243+
items:
6244+
$ref: '#/components/schemas/host_port'
6245+
tls_enabled:
6246+
type: boolean
6247+
mutual_tls_enabled:
6248+
type: boolean
6249+
configured_authentication_method:
6250+
type: string
6251+
enum:
6252+
- None
6253+
- SCRAM_Configured
6254+
- SCRAM_Ephemeral
60246255
tags:
60256256
- name: Authentication
60266257
description: |
@@ -6061,6 +6292,11 @@ tags:
60616292
Debug a Redpanda cluster.
60626293
60636294
For details about debugging in the latest version of Redpanda version, see [Cluster Diagnostics](https://docs.redpanda.com/docs/manage/cluster-maintenance/cluster-diagnostics/).
6295+
- name: Security
6296+
description: |
6297+
Security management and reporting endpoints.
6298+
6299+
Monitor security configurations and generate security reports.
60646300
- name: Services
60656301
description: Manage Redpanda services.
60666302
- name: Unstable APIs

0 commit comments

Comments
 (0)