Skip to content

Commit 26c140d

Browse files
kbatuigasFeediver1
authored and
paulohtb6
committed
[25.3] Security report and other additions to What's New (#1450)
Co-authored-by: Joyce Fee <[email protected]>
1 parent 2fb1887 commit 26c140d

File tree

9 files changed

+246
-2
lines changed

9 files changed

+246
-2
lines changed

‎modules/deploy/pages/redpanda/manual/production/production-readiness.adoc‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -318,6 +318,15 @@ In the logs, verify `enabled: 1`.
318318

319319
See also: xref:manage:security/listener-configuration.adoc#multiple-listeners[Multiple listeners]
320320

321+
[NOTE]
322+
====
323+
You can also use the link:api/doc/admin/operation/operation-get_security_report[`/v1/security/report`] Admin API endpoint to generate a security report for your cluster and verify TLS, authentication, and authorization settings:
324+
325+
```bash
326+
curl 'http://localhost:9644/v1/security/report'
327+
```
328+
====
329+
321330
[[redpanda-tuners]]
322331
=== Run Redpanda tuners
323332

@@ -643,6 +652,11 @@ Review your deployment automation. Specifically, if you need to reprovision a cl
643652

644653
Check that your xref:manage:audit-logging.adoc#audit-log-flow[audit logs] are forwarded to an enterprise security information and event management (SIEM) system.
645654

655+
=== Monitor security settings
656+
657+
Regularly review your cluster's security settings using the link:api/doc/admin/operation/operation-get_security_report[`/v1/security/report`] Admin API endpoint. Investigate and address any issues identified in the alerts section.
658+
659+
include::manage:partial$security-report.adoc[]
646660

647661
== Suggested reading
648662

‎modules/develop/partials/http-proxy.adoc‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1044,6 +1044,117 @@ res = requests.delete(
10441044
--
10451045
=====
10461046

1047+
== Authenticate with HTTP Proxy
1048+
1049+
HTTP Proxy supports authentication using SCRAM credentials or OIDC tokens.
1050+
The authentication method depends on
1051+
ifndef::env-cloud[]
1052+
the xref:reference:properties/broker-properties.adoc#http_proxy_auth_method[`authentication_method`] broker property and
1053+
endif::[]
1054+
the cluster's xref:reference:properties/cluster-properties.adoc#http_authentication[`http_authentication`] settings.
1055+
1056+
=== SCRAM Authentication
1057+
1058+
If HTTP Proxy is configured to support SASL, you can provide the SCRAM username and password as part of the Basic Authentication header in your request. For example, to list topics as an authenticated user:
1059+
1060+
[tabs]
1061+
=====
1062+
curl::
1063+
+
1064+
--
1065+
[,bash]
1066+
----
1067+
curl -s -u "<username>:<password>" "<host-address>:8082/topics"
1068+
----
1069+
1070+
--
1071+
NodeJS::
1072+
+
1073+
--
1074+
[,javascript]
1075+
----
1076+
let options = {
1077+
auth: { username: "<username>", password: "<password>" },
1078+
};
1079+
1080+
axios
1081+
.get(`${base_uri}/topics`, options)
1082+
.then(response => console.log(response.data))
1083+
.catch(error => console.error(error));
1084+
----
1085+
1086+
--
1087+
Python::
1088+
+
1089+
--
1090+
[,python]
1091+
----
1092+
auth = ("<username>", "<password>")
1093+
res = requests.get(f"{base_uri}/topics", auth=auth).json()
1094+
pretty(res)
1095+
----
1096+
1097+
--
1098+
=====
1099+
1100+
=== OIDC Authentication
1101+
1102+
If HTTP Proxy is configured to support OIDC, you can provide an OIDC token in the Authorization header. For example:
1103+
1104+
[tabs]
1105+
=====
1106+
curl::
1107+
+
1108+
--
1109+
[,bash]
1110+
----
1111+
curl -s -H "Authorization: Bearer <oidc-token>" "<host-address>:8082/topics"
1112+
----
1113+
1114+
--
1115+
NodeJS::
1116+
+
1117+
--
1118+
[,javascript]
1119+
----
1120+
let options = {
1121+
headers: { Authorization: `Bearer <oidc-token>` },
1122+
};
1123+
1124+
axios
1125+
.get(`${base_uri}/topics`, options)
1126+
.then(response => console.log(response.data))
1127+
.catch(error => console.error(error));
1128+
----
1129+
1130+
--
1131+
Python::
1132+
+
1133+
--
1134+
[,python]
1135+
----
1136+
headers = {"Authorization": "Bearer <oidc-token>"}
1137+
res = requests.get(f"{base_uri}/topics", headers=headers).json()
1138+
pretty(res)
1139+
----
1140+
1141+
--
1142+
=====
1143+
1144+
ifndef::env-cloud[]
1145+
For details about configuring OIDC authentication, see xref:manage:security/authentication.adoc#oidc-http[OIDC Authentication].
1146+
endif::[]
1147+
1148+
ifndef::env-cloud[]
1149+
== Generate a security report for HTTP Proxy
1150+
1151+
Use the link:api/doc/admin/operation/operation-get_security_report[`/v1/security/report`] Admin API endpoint to generate a comprehensive security report for your cluster. This endpoint provides detailed information about TLS configuration, authentication methods, authorization status, and security alerts across all Redpanda interfaces, including HTTP Proxy.
1152+
1153+
include::manage:partial$security-report.adoc[]
1154+
1155+
endif::[]
1156+
1157+
10471158
== Use Swagger with HTTP Proxy
10481159

10491160
You can use Swagger UI to test and interact with Redpanda HTTP Proxy endpoints.

‎modules/get-started/pages/release-notes/redpanda.adoc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,14 @@ Redpanda Schema Registry now supports an import mode that allows you to import e
4141
Starting with this release, import mode must be used when importing schemas. Read-write mode no longer allows specifying a schema ID and version when registering a schema.
4242
See xref:manage:schema-reg/schema-reg-api.adoc#set-schema-registry-mode[Use the Schema Registry API] for more information.
4343

44+
== Security report
45+
46+
You can now generate a security report for your Redpanda cluster using the link:api/doc/admin/operation/operation-get_security_report[`/v1/security/report`] Admin API endpoint. The report provides detailed information about TLS configuration, authentication methods, authorization status, and security alerts across all Redpanda interfaces (Kafka, RPC, Admin, Schema Registry, HTTP Proxy).
47+
48+
== Topic identifiers
49+
50+
Redpanda v25.3 implements topic identifiers using 16 byte UUIDs as proposed in https://cwiki.apache.org/confluence/display/KAFKA/KIP-516%3A+Topic+Identifiers[KIP-516^].
51+
4452
== Deprecations
4553

4654
Several TLSv1.2 and TLSv1.3 cipher suites have been deprecated. See xref:upgrade:deprecated/index.adoc[Deprecated Features].

‎modules/manage/pages/cluster-maintenance/compaction-settings.adoc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,8 @@ If obtaining a complete snapshot of the log, including tombstone records, is imp
154154

155155
On the other hand, if more frequent cleanup of tombstones is important for optimizing workloads and space management, consider setting a shorter tombstone retention, for example the typical default of 24 hours (86400000 ms).
156156

157+
Compaction and tombstone removal are coordinated across replicas, preventing inconsistencies and ensuring that deleted records are properly recognized by all readers. As a result, tombstone removal on one replica may be delayed if another replica is stopped or lagging.
158+
157159
== Compaction policy settings
158160

159161
The various cleanup policy settings rely on proper tuning of a cluster's compaction and retention policy options. The applicable settings are:

‎modules/manage/pages/schema-reg/schema-reg-api.adoc‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1176,6 +1176,15 @@ The `serialized` format returns the Protobuf schema in its wire binary format in
11761176
- For Protobuf, `serialized` and `ignore_extensions` are valid, but only `serialized` is currently supported; passing `ignore_extensions` returns a 501 Not Implemented error.
11771177
- Cross-schema conditions such as `resolved` with Protobuf or `serialized` with Avro are ignored and the schema is returned in the default format.
11781178

1179+
ifndef::env-cloud[]
1180+
== Generate a security report for Schema Registry
1181+
1182+
Use the link:api/doc/admin/operation/operation-get_security_report[`/v1/security/report`] Admin API endpoint to generate a comprehensive security report for your cluster. This endpoint provides detailed information about TLS configuration, authentication methods, authorization status, and security alerts across all Redpanda interfaces, including Schema Registry.
1183+
1184+
include::manage:partial$security-report.adoc[]
1185+
1186+
endif::[]
1187+
11791188
== Suggested reading
11801189
ifndef::env-cloud[]
11811190
* xref:manage:schema-reg/schema-reg-overview.adoc[]

‎modules/manage/pages/security/index.adoc‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,6 @@
44
:page-aliases: security:index.adoc, security:index/index.adoc
55
:page-categories: Management, Security
66

7+
{description}
78

8-
NOTE: All concepts described in this section are compatible with Kafka and its client libraries and CLIs. This section does not cover ways you can protect your Redpanda cluster externally; for example, through network ACLs or private networks.
9+
This section does not cover ways you can protect your Redpanda cluster externally; for example, through network ACLs or private networks.

‎modules/manage/pages/use-admin-api.adoc‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,6 @@ The base URL for all requests to the legacy endpoints is:
4040
http://<broker-address>:<admin-api-port>/v1/
4141
```
4242

43-
// TODO: Update link if necessary when v2 URLs are finalized
4443
For a full list of available endpoints, see the link:/api/doc/admin/v1/[Admin API Reference]. Select "v1" in the version selector to view legacy endpoints.
4544

4645
==== Example request

‎modules/manage/partials/authentication.adoc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1900,3 +1900,11 @@ redpanda:
19001900
authentication_method: none
19011901
----
19021902
endif::[]
1903+
1904+
== Generate security report
1905+
1906+
Use the link:api/doc/admin/operation/operation-get_security_report[`/v1/security/report`] endpoint to generate a comprehensive security report for your cluster. This endpoint provides detailed information about current TLS configuration, authentication methods, authorization status, and security alerts across all Redpanda interfaces (Kafka, RPC, Admin, Schema Registry, HTTP Proxy).
1907+
1908+
To generate a security report for your Redpanda cluster, run:
1909+
1910+
include::manage:partial$security-report.adoc[]

‎modules/manage/partials/security-report.adoc‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
.Input
2+
[source,bash]
3+
----
4+
curl 'http://localhost:9644/v1/security/report'
5+
----
6+
7+
.View output
8+
[%collapsible]
9+
====
10+
[source,bash,role=no-copy]
11+
----
12+
{
13+
"interfaces": {
14+
"kafka": [
15+
{
16+
"name": "test_kafka_listener",
17+
"host": "0.0.0.0",
18+
"port": 9092,
19+
"advertised_host": "0.0.0.0",
20+
"advertised_port": 9092,
21+
"tls_enabled": false,
22+
"mutual_tls_enabled": false,
23+
"authentication_method": "None",
24+
"authorization_enabled": false
25+
}
26+
],
27+
"rpc": {
28+
"host": "0.0.0.0",
29+
"port": 33145,
30+
"advertised_host": "127.0.0.1",
31+
"advertised_port": 33145,
32+
"tls_enabled": false,
33+
"mutual_tls_enabled": false
34+
},
35+
"admin": [
36+
{
37+
"name": "test_admin_listener",
38+
"host": "0.0.0.0",
39+
"port": 9644,
40+
"tls_enabled": false,
41+
"mutual_tls_enabled": false,
42+
"authentication_methods": [],
43+
"authorization_enabled": false
44+
}
45+
]
46+
},
47+
"alerts": [
48+
{
49+
"affected_interface": "kafka",
50+
"listener_name": "test_kafka_listener",
51+
"issue": "NO_TLS",
52+
"description": "\"kafka\" interface \"test_kafka_listener\" is not using TLS. This is insecure and not recommended."
53+
},
54+
{
55+
"affected_interface": "kafka",
56+
"listener_name": "test_kafka_listener",
57+
"issue": "NO_AUTHN",
58+
"description": "\"kafka\" interface \"test_kafka_listener\" is not using authentication. This is insecure and not recommended."
59+
},
60+
{
61+
"affected_interface": "kafka",
62+
"listener_name": "test_kafka_listener",
63+
"issue": "NO_AUTHZ",
64+
"description": "\"kafka\" interface \"test_kafka_listener\" is not using authorization. This is insecure and not recommended."
65+
},
66+
{
67+
"affected_interface": "rpc",
68+
"issue": "NO_TLS",
69+
"description": "\"rpc\" interface is not using TLS. This is insecure and not recommended."
70+
},
71+
{
72+
"affected_interface": "admin",
73+
"listener_name": "test_admin_listener",
74+
"issue": "NO_TLS",
75+
"description": "\"admin\" interface \"test_admin_listener\" is not using TLS. This is insecure and not recommended."
76+
},
77+
{
78+
"affected_interface": "admin",
79+
"listener_name": "test_admin_listener",
80+
"issue": "NO_AUTHZ",
81+
"description": "\"admin\" interface \"test_admin_listener\" is not using authorization. This is insecure and not recommended."
82+
},
83+
{
84+
"affected_interface": "admin",
85+
"listener_name": "test_admin_listener",
86+
"issue": "NO_AUTHN",
87+
"description": "\"admin\" interface \"test_admin_listener\" is not using authentication. This is insecure and not recommended."
88+
}
89+
]
90+
}
91+
----
92+
====

0 commit comments

Comments
 (0)