Skip to content

Commit 137a397

Browse files
JakeSCahillJakeSCahill
authored
Update quickstart to create the SASL user (#476)
1 parent 3959f60 commit 137a397

File tree

1 file changed

+94
-40
lines changed

1 file changed

+94
-40
lines changed

‎modules/ai-agents/pages/mcp/remote/quickstart.adoc‎

Lines changed: 94 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,22 @@ This opens a browser window to authenticate. The token is saved locally inside y
5858
----
5959
rpk topic create events --partitions 3 --replicas 3
6060
----
61+
62+
. Create a user called `mcp` with a strong password:
63+
+
64+
[,bash]
65+
----
66+
rpk acl user create mcp --password <your-secure-password>
67+
----
68+
+
69+
Save the password securely. You need it later when configuring the MCP server.
70+
71+
. Grant the `mcp` user permissions to produce and consume from the `events` topic:
72+
+
73+
[,bash]
74+
----
75+
rpk acl create --allow-principal User:mcp --operation all --topic events
76+
----
6177
--
6278
6379
Data Plane API::
@@ -121,11 +137,43 @@ curl -X POST "https://<dataplane-api-url>/v1/topics" \
121137
-H "Authorization: Bearer <token>" \
122138
-H "Content-Type: application/json" \
123139
-d '{
124-
"topic": {
125-
"name": "events",
126-
"partition_count": 3,
127-
"replication_factor": 3
128-
}
140+
"name": "events",
141+
"partition_count": 3,
142+
"replication_factor": 3
143+
}'
144+
----
145+
146+
. Make a request to link:/api/doc/cloud-dataplane/operation/operation-userservice_createuser[`POST /v1/users`] to create a user called `mcp`:
147+
+
148+
[,bash]
149+
----
150+
curl -X POST "https://<dataplane-api-url>/v1/users" \
151+
-H "Authorization: Bearer <token>" \
152+
-H "Content-Type: application/json" \
153+
-d '{
154+
"name": "mcp",
155+
"password": "<your-secure-password>",
156+
"mechanism": "SASL_MECHANISM_SCRAM_SHA_256"
157+
}'
158+
----
159+
+
160+
Save the password securely. You need it later when configuring the MCP server.
161+
162+
. Make a request to link:/api/doc/cloud-dataplane/operation/operation-aclservice_createacl[`POST /v1/acls`] to grant the `mcp` user permissions to produce and consume from the `events` topic:
163+
+
164+
[,bash]
165+
----
166+
curl -X POST "https://<dataplane-api-url>/v1/acls" \
167+
-H "Authorization: Bearer <token>" \
168+
-H "Content-Type: application/json" \
169+
-d '{
170+
"resource_type": "RESOURCE_TYPE_TOPIC",
171+
"resource_name": "events",
172+
"resource_pattern_type": "RESOURCE_PATTERN_TYPE_LITERAL",
173+
"principal": "User:mcp",
174+
"host": "*",
175+
"operation": "OPERATION_ALL",
176+
"permission_type": "PERMISSION_TYPE_ALLOW"
129177
}'
130178
----
131179
--
@@ -169,7 +217,9 @@ The template populates the configuration with YAML for the tool definition.
169217
170218
. From the *Template* dropdown, select *Redpanda Output*.
171219
+
172-
The template populates the configuration for publishing to Redpanda. Authentication is handled automatically by the MCP server's service account.
220+
The template populates the configuration for publishing to Redpanda and a section for adding the required secrets is displayed.
221+
222+
. Enter the values for the `mcp` user's credentials in the *Add Required Secrets* section.
173223
174224
. Click *Lint* to check the configuration. You should see no errors.
175225
@@ -186,27 +236,37 @@ It may take a few seconds to start. The status changes from *Starting* to *Runni
186236
Data Plane API::
187237
+
188238
--
189-
. Create a service account using the link:/api/doc/cloud-controlplane/operation/operation-serviceaccountservice_createserviceaccount[Control Plane API]:
239+
. Create a secret for the username:
190240
+
191241
[,bash]
192242
----
193-
curl -X POST "https://api.redpanda.com/v1/service-accounts" \
243+
curl -X POST "https://<dataplane-api-url>/v1/secrets" \
194244
-H "Authorization: Bearer <token>" \
195245
-H "Content-Type: application/json" \
196246
-d '{
197-
"service_account": {
198-
"name": "mcp-server-demo",
199-
"description": "Service account for MCP server demo"
200-
}
247+
"id": "MCP_USERNAME",
248+
"scopes": ["SCOPE_MCP_SERVER"],
249+
"secret_data": "bWNw"
201250
}'
202251
----
203252
+
204-
The response includes `client_id` and `client_secret`. Save these values.
205-
206-
. Store the service account credentials in the xref:develop:connect/configuration/secret-management.adoc[Secrets Store]:
253+
The `secret_data` value `bWNw` is the base64-encoded string `mcp`.
207254
+
208-
* Create secret `REDPANDA_SA_CLIENT_ID` with the service account `client_id`.
209-
* Create secret `REDPANDA_SA_CLIENT_SECRET` with the service account `client_secret`.
255+
Create a secret for the password:
256+
+
257+
[,bash]
258+
----
259+
curl -X POST "https://<dataplane-api-url>/v1/secrets" \
260+
-H "Authorization: Bearer <token>" \
261+
-H "Content-Type: application/json" \
262+
-d '{
263+
"id": "MCP_PASSWORD",
264+
"scopes": ["SCOPE_MCP_SERVER"],
265+
"secret_data": "<base64-encoded-password>"
266+
}'
267+
----
268+
+
269+
Replace `<base64-encoded-password>` with your password encoded in base64. You can encode it with: `echo -n '<your-secure-password>' | base64`.
210270
211271
. Using the Data Plane API URL from the previous section, make a request to link:/api/doc/cloud-dataplane/operation/operation-mcpserverservice_createmcpserver[`POST /v1/redpanda-connect/mcp-servers`] to create the MCP server:
212272
+
@@ -216,30 +276,24 @@ curl -X POST "https://<dataplane-api-url>/v1/redpanda-connect/mcp-servers" \
216276
-H "Authorization: Bearer <token>" \
217277
-H "Content-Type: application/json" \
218278
-d '{
219-
"mcp_server": {
220-
"display_name": "event-data-generator",
221-
"description": "Generates fake user event data and publishes it to Redpanda topics",
222-
"tags": {
223-
"owner": "platform",
224-
"env": "demo"
225-
},
226-
"resources": {
227-
"memory_shares": "400M",
228-
"cpu_shares": "100m"
229-
},
230-
"service_account": {
231-
"client_id": "${secrets.REDPANDA_SA_CLIENT_ID}",
232-
"client_secret": "${secrets.REDPANDA_SA_CLIENT_SECRET}"
279+
"display_name": "event-data-generator",
280+
"description": "Generates fake user event data and publishes it to Redpanda topics",
281+
"tags": {
282+
"owner": "platform",
283+
"env": "demo"
284+
},
285+
"resources": {
286+
"memory_shares": "400M",
287+
"cpu_shares": "100m"
288+
},
289+
"tools": {
290+
"generate_input": {
291+
"component_type": "COMPONENT_TYPE_INPUT",
292+
"config_yaml": "generate:\n interval: 1s\n mapping: |\n root.user_id = \"user\" + random_int(min: 1, max: 1000).string()\n root.event_type = [\"login\", \"logout\", \"purchase\", \"view\"].index(random_int(max: 3))\n root.timestamp = now().ts_format(\"2006-01-02T15:04:05Z07:00\")"
233293
},
234-
"tools": {
235-
"generate_input": {
236-
"component_type": "COMPONENT_TYPE_INPUT",
237-
"config_yaml": "generate:\n interval: 1s\n mapping: |\n root.user_id = \"user\" + random_int(min: 1, max: 1000).string()\n root.event_type = [\"login\", \"logout\", \"purchase\", \"view\"].index(random_int(max: 3))\n root.timestamp = now().ts_format(\"2006-01-02T15:04:05Z07:00\")"
238-
},
239-
"redpanda_output": {
240-
"component_type": "COMPONENT_TYPE_OUTPUT",
241-
"config_yaml": "redpanda:\n seed_brokers: [ \"${REDPANDA_BROKERS}\" ]\n topic: events\n tls:\n enabled: true\n"
242-
}
294+
"redpanda_output": {
295+
"component_type": "COMPONENT_TYPE_OUTPUT",
296+
"config_yaml": "redpanda:\n seed_brokers: [ \"${REDPANDA_BROKERS}\" ]\n topic: events\n tls:\n enabled: true\n sasl:\n - mechanism: SCRAM-SHA-256\n username: \"${secrets.MCP_USERNAME}\"\n password: \"${secrets.MCP_PASSWORD}\"\n"
243297
}
244298
}
245299
}'

0 commit comments

Comments
 (0)