Skip to content

Commit cf2da91

Browse files
kbatuigasFeediver1
kbatuigas
and
Feediver1
authored
mTLS+SASL support on AWS (#362)
* mTLS+SASL support on AWS * Apply suggestions from automated review * Rework authentication method bullet points * Missing placeholder value * Minor edit * Minor edit per review * Apply suggestions from code review Co-authored-by: Joyce Fee <[email protected]> --------- Co-authored-by: Joyce Fee <[email protected]>
1 parent c815039 commit cf2da91

File tree

2 files changed

+30
-16
lines changed

2 files changed

+30
-16
lines changed

‎modules/get-started/pages/whats-new-cloud.adoc‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@ This page lists new features added to Redpanda Cloud.
99

1010
== July 2025
1111

12+
=== mTLS and SASL authentication for Kafka API on AWS
13+
14+
You can now enable mTLS and SASL authentication simultaneously for the Kafka API on AWS clusters. If you enable both mTLS and SASL on AWS clusters, Redpanda creates two distinct listeners: an mTLS listener operating on one port and a SASL listener operating on a different port.
15+
16+
See xref:security:cloud-authentication.adoc#service-authentication[Authentication] for details on available authentication methods in Redpanda Cloud.
17+
1218
=== Azure Private Link in the UI: GA
1319

1420
You can now xref:networking:azure-private-link-in-ui.adoc[configure Azure Private Link] for a new BYOC or Dedicated cluster using the Cloud UI. The Azure Private Link service is generally available (GA) in both the Cloud UI and the Cloud API.

‎modules/security/pages/cloud-authentication.adoc‎

Lines changed: 24 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -68,14 +68,22 @@ Each Redpanda Cloud data plane runs its own dedicated agent,
6868
which authenticates and connects against the control plane over a single TLS 1.2
6969
encrypted TCP connection.
7070

71-
Different Redpanda APIs support different authentication methods. For GCP, you can simultaneously enable mTLS and SASL for Kafka API, and mTLS and Basic authentication for the HTTP APIs (HTTP Proxy and Schema Registry). If you enable both mTLS and SASL on GCP clusters, Redpanda creates two distinct listeners: an mTLS listener operating on one port and a SASL listener operating on a different port.
71+
Different Redpanda APIs support different authentication methods:
7272

73-
.Redpanda APIs authentication methods
73+
* Kafka API: Redpanda Cloud supports both SASL (over TLS 1.2) and <<mtls,mTLS>> authentication for Kafka clients connecting to Redpanda clusters over the TCP endpoint or listener.
74+
* HTTP Proxy and Schema Registry: Redpanda Cloud supports HTTP Basic Authentication (encrypted over TLS 1.2) and <<mtls,mTLS>> for client authentication.
75+
76+
For AWS and GCP, you can simultaneously enable mTLS and SASL for Kafka API, and mTLS and Basic authentication for the HTTP APIs (HTTP Proxy and Schema Registry). If you enable both mTLS and SASL, Redpanda creates two distinct listeners: an mTLS listener operating on one port and a SASL listener operating on a different port.
77+
78+
.Redpanda API authentication methods
7479
[%collapsible]
7580
|===
7681
|Cloud provider |API |Supported authentication methods
7782

78-
.3+|AWS
83+
.3+a|AWS
84+
85+
See <<enable-mtls-and-sasl,Enable mTLS and SASL>>
86+
7987
|Kafka API
8088
a|
8189
* SASL
@@ -95,7 +103,7 @@ a|
95103

96104
.3+a|GCP
97105

98-
See <<enable-mtls-and-sasl,Enable mTLS and SASL>>.
106+
See <<enable-mtls-and-sasl,Enable mTLS and SASL>>
99107

100108
|Kafka API
101109
a|
@@ -130,12 +138,6 @@ a|
130138
* Basic authentication
131139
|===
132140

133-
* Kafka API: Redpanda Cloud enables SASL/SCRAM authentication
134-
over TLS 1.2 as well as <<mtls,mTLS>> to authenticate Kafka clients connecting to Redpanda clusters over
135-
the TCP endpoint or listener.
136-
* HTTP Proxy and Schema Registry: Authentication is done through an
137-
HTTP Basic Authentication header encrypted over TLS 1.2.
138-
139141
The following features use IAM policies to generate
140142
dynamic and short-lived credentials to interact with cloud provider APIs:
141143

@@ -163,7 +165,7 @@ If you want to enable mTLS authentication:
163165
* You must use the Cloud API to create a new mTLS-enabled cluster.
164166
* You must also use the Cloud API to update an existing cluster to switch to mTLS authentication for Kafka API.
165167
* You can use the Cloud UI to update an existing cluster to switch to mTLS authentication for HTTP Proxy and Schema Registry only.
166-
* To enable mTLS and SASL (or Basic authentication) simultaneously on GCP clusters, you must use the Cloud API to create a new cluster or update an existing cluster.
168+
* To enable mTLS and SASL (or Basic authentication) simultaneously, you must use the Cloud API to create a new cluster or update an existing cluster.
167169

168170
To configure service authentication in your cluster using the Cloud API, you must have the following:
169171

@@ -224,7 +226,7 @@ NOTE: The following example enables mTLS for Kafka API. To enable mTLS for HTTP
224226
CLUSTER_CREATE_BODY=`cat << EOF
225227
{
226228
"cluster": {
227-
"cloud_provider": "CLOUD_PROVIDER_GCP",
229+
"cloud_provider": "<cloud-provider>",
228230
"connection_type": "CONNECTION_TYPE_PRIVATE",
229231
"name": "<cluster-name>",
230232
"resource_group_id": "<resource-group-id>",
@@ -258,6 +260,9 @@ Make sure to replace the following variables:
258260
|`<cluster-id>`
259261
|ID of the Redpanda cluster.
260262
263+
|`<cloud-provider>`
264+
|Cloud provider for the cluster (`CLOUD_PROVIDER_AWS` or `CLOUD_PROVIDER_GCP`).
265+
261266
|`<cluster-name>`
262267
|Name of the Redpanda cluster.
263268
@@ -274,7 +279,7 @@ Make sure to replace the following variables:
274279
|The zones where the cluster is created. For example, `["us-central1-a", "us-central1-b", "us-central1-c"]`.
275280
276281
|`<tier>`
277-
|The usage tier of the cluster. For example, .
282+
|The xref:reference:tiers/index.adoc[usage tier of the cluster].
278283
279284
|`<cluster-type>`
280285
|The Redpanda cluster type, `TYPE_BYOC` or `TYPE_DEDICATED`.
@@ -364,7 +369,7 @@ When the operation state is `COMPLETED`, you can <<verify-mtls,verify that mTLS
364369

365370
=== Enable mTLS and SASL
366371

367-
NOTE: Enabling mTLS and SASL simultaneously is available for GCP clusters only. To unlock this feature for your account, contact your Customer Success Manager.
372+
NOTE: You can enable mTLS and SASL simultaneously for AWS and GCP clusters only. To unlock this feature for your account, contact your Customer Success Manager.
368373

369374
You can choose to enable mTLS and SASL simultaneously for the Kafka API, and mTLS and Basic authentication for HTTP Proxy and Schema Registry. The `sasl` field in the API request examples toggle both SASL and Basic authentication.
370375

@@ -384,7 +389,7 @@ You can enable mTLS and SASL or Basic authentication for any combination of the
384389
CLUSTER_CREATE_BODY=`cat << EOF
385390
{
386391
"cluster": {
387-
"cloud_provider": "CLOUD_PROVIDER_GCP",
392+
"cloud_provider": "<cloud-provider>",
388393
"connection_type": "CONNECTION_TYPE_PRIVATE",
389394
"name": "<cluster-name>",
390395
"resource_group_id": "<resource-group-id>",
@@ -439,6 +444,9 @@ Make sure to replace the following variables:
439444
|`<cluster-id>`
440445
|ID of Redpanda cluster.
441446
447+
|`<cloud-provider>`
448+
|Cloud provider for the cluster (`CLOUD_PROVIDER_AWS` or `CLOUD_PROVIDER_GCP`).
449+
442450
|`<cluster-name>`
443451
|Name of the Redpanda cluster.
444452
@@ -455,7 +463,7 @@ Make sure to replace the following variables:
455463
|The zones where the cluster is created. For example, `["us-central1-a", "us-central1-b", "us-central1-c"]`.
456464
457465
|`<tier>`
458-
|The usage tier of the cluster. For example, .
466+
|The xref:reference:tiers/index.adoc[usage tier of the cluster].
459467
460468
|`<cluster-type>`
461469
|The Redpanda cluster type, `TYPE_BYOC` or `TYPE_DEDICATED`.

0 commit comments

Comments
 (0)