[25.3] Security report and other additions to What's New #1450

kbatuigas · 2025-11-12T01:58:53Z

Description

Related (API docs) redpanda-data/api-docs#35

This pull request introduces documentation for a new Admin API endpoint, /v1/security/report, which generates a comprehensive security report for Redpanda clusters. The changes add usage instructions, output examples, and highlight the endpoint’s ability to report on TLS, authentication, authorization, and security alerts across all Redpanda interfaces. The updates are made across multiple documentation files to ensure users are aware of this feature and know how to use it for monitoring and auditing cluster security.

Security report endpoint documentation:

Added instructions and examples for generating a cluster-wide security report using the /v1/security/report Admin API endpoint in various documentation sections, including production readiness, authentication, HTTP Proxy, and Schema Registry. [1] [2] [3] [4]
Introduced a reusable partial, security-report.adoc, that provides a sample request and output for the security report endpoint, including details about interfaces and alerts for insecure configurations.
Updated the release notes to announce the new security report feature, describing its coverage of all Redpanda interfaces (Kafka, RPC, Admin, Schema Registry, HTTP Proxy).
Added a new section encouraging regular monitoring of security settings using the security report endpoint and guidance on investigating alerts.

Other documentation updates:

Minor improvements to the security documentation structure and descriptions, such as removing outdated notes and clarifying scope.
Small update to the compaction settings documentation to clarify how tombstone removal is coordinated across replicas.
Removed a legacy comment from the Admin API usage documentation for clarity.

Resolves https://redpandadata.atlassian.net/browse/DOC-1763, https://redpandadata.atlassian.net/browse/DOC-1195, https://redpandadata.atlassian.net/browse/DOC-1594
Review deadline: 18 Nov

Page previews

Security Report:
Authentication > Generate security report
Use the Schema Registry API
Use Redpanda with HTTP Proxy API
Production Readiness Checklist (Level 1 and Level 3)

Security report, Topic IDs and Compaction in What's New: https://deploy-preview-1450--redpanda-docs-preview.netlify.app/25.3/get-started/release-notes/redpanda/#security-report

Updates to tombstone removal: https://deploy-preview-1450--redpanda-docs-preview.netlify.app/25.3/manage/cluster-maintenance/compaction-settings/#tombstone-record-removal

Checks

New feature
Content gap
Support Follow-up
Small fix (typos, links, copyedits, etc)

coderabbitai · 2025-11-12T01:58:59Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch DOC-1594-security-report

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

netlify · 2025-11-12T01:58:59Z

✅ Deploy Preview for redpanda-docs-preview ready!

Name	Link
🔨 Latest commit	`632074c`
🔍 Latest deploy log	https://app.netlify.com/projects/redpanda-docs-preview/deploys/691d0ac894bef2000844c60f
😎 Deploy Preview	https://deploy-preview-1450--redpanda-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

modules/get-started/pages/release-notes/redpanda.adoc

IoannisRP

Apart from a minor comment, the security report sections look good 👍

modules/develop/partials/http-proxy.adoc

bashtanov

Compaction improvement pushed out of 25.3.1, might be in future minor and Compaction improvement pushed out of 25.3.1, might be in future minor LGTM

IoannisRP

lgtm

mattschumpert · 2025-11-14T22:19:55Z

modules/manage/pages/security/index.adoc

-NOTE: All concepts described in this section are compatible with Kafka and its client libraries and CLIs. This section does not cover ways you can protect your Redpanda cluster externally; for example, through network ACLs or private networks.
+[NOTE]
+====
+All concepts described in this section are compatible with Kafka and its client libraries and CLIs. This section does not cover ways you can protect your Redpanda cluster externally; for example, through network ACLs or private networks.


@kbatuigas I'm not sure this is accurate anymore technically since e.g. Schema Registry AuthZ isn't part of kafka and this whole section describes a bunch of stuff not part of kafka. I think we should just leave the second sentence and skip the first one.

Removed first sentence from note

mattschumpert · 2025-11-14T22:20:57Z

modules/manage/pages/security/index.adoc

+All concepts described in this section are compatible with Kafka and its client libraries and CLIs. This section does not cover ways you can protect your Redpanda cluster externally; for example, through network ACLs or private networks.
+
+
+Use the link:api/doc/admin/operation/operation-get_security_report[`/v1/security/report`] Admin API endpoint to generate a comprehensive security report for your cluster. This endpoint provides detailed information about TLS configuration, authentication methods, authorization status, and security alerts across all Redpanda interfaces (Kafka, RPC, Admin, Schema Registry, HTTP Proxy).


@kbatuigas having this in the info box at the top of the security section seems noisy and distracting to me. This is a very minor thing only for very advanced users. We should mention it but not let it steal the show.

Moved security report content out of note

mattschumpert · 2025-11-14T22:22:57Z

modules/manage/pages/use-admin-api.adoc

 --
 ====

+NOTE: Use the link:api/doc/admin/operation/operation-get_security_report[`/v1/security/report`] endpoint to generate a comprehensive security report for your cluster. This endpoint provides detailed information about TLS configuration, authentication methods, authorization status, and security alerts across all Redpanda interfaces, including the Admin API itself.


@kbatuigas this also feels out of place. this section is about the format and style of the admin API, not about one particular minor feature enabled through it.

I think the best place to introduce the security report API is probably at the bottom of the 'Authentication' section of Security docs (since its mostly reporting on the AUthN status of all the endpoints). It's fine to also included in the PP / SR pages as you have

Moved security report content to Authentication

modules/deploy/pages/redpanda/manual/production/production-readiness.adoc

Feediver1 · 2025-11-17T18:17:07Z

modules/deploy/pages/redpanda/manual/production/production-readiness.adoc


+=== Monitor security settings
+
+Regularly review your cluster's security settings using the link:api/doc/admin/operation/operation-get_security_report[`/v1/security/report`] Admin API endpoint. Investigate and address any issues identified in the alerts section.


Not sure if this is awaiting another PR to merge or something else, but this link gives a page not found error.

This link will work once redpanda-data/api-docs#35 is merged

modules/develop/partials/http-proxy.adoc

modules/manage/pages/schema-reg/schema-reg-api.adoc

Feediver1

Minor suggestions

Co-authored-by: Joyce Fee <[email protected]>

kbatuigas added 4 commits November 11, 2025 17:32

Note to use security report

c15e542

Add security report to What's New

c76dfd3

DOC-1195 Add topic identifiers to What's New

3e76a2c

DOC-1763 compaction for transaction markers

e2dd279

kbatuigas requested a review from a team as a code owner November 12, 2025 01:58

kbatuigas requested a review from IoannisRP November 12, 2025 16:46

kbatuigas changed the title ~~Doc 1594 security report~~ [25.3] Security report and other additions to What's New Nov 12, 2025

WillemKauf reviewed Nov 12, 2025

View reviewed changes

modules/get-started/pages/release-notes/redpanda.adoc Outdated Show resolved Hide resolved

kbatuigas added 2 commits November 12, 2025 17:03

Compaction improvement pushed out of 25.3.1, might be in future minor

4778354

Add security report to production readiness checklist

c117884

IoannisRP reviewed Nov 13, 2025

View reviewed changes

modules/develop/partials/http-proxy.adoc Outdated Show resolved Hide resolved

Apply suggestions from SME review

b7d69cd

kbatuigas requested review from IoannisRP and mattschumpert November 13, 2025 19:54

DOC-1808 Tombstone removal impacted by lagging replicas

7384229

bashtanov approved these changes Nov 14, 2025

View reviewed changes

IoannisRP reviewed Nov 14, 2025

View reviewed changes

mattschumpert approved these changes Nov 14, 2025

View reviewed changes

Apply suggestions from SME review

20d94be

Feediver1 reviewed Nov 17, 2025

View reviewed changes

modules/deploy/pages/redpanda/manual/production/production-readiness.adoc Outdated Show resolved Hide resolved

Feediver1 reviewed Nov 17, 2025

View reviewed changes

modules/develop/partials/http-proxy.adoc Show resolved Hide resolved

Feediver1 reviewed Nov 17, 2025

View reviewed changes

modules/manage/pages/schema-reg/schema-reg-api.adoc Show resolved Hide resolved

Feediver1 approved these changes Nov 17, 2025

View reviewed changes

kbatuigas and others added 2 commits November 18, 2025 15:30

Apply suggestions from code review

d83ef9e

Co-authored-by: Joyce Fee <[email protected]>

Apply suggestions from doc review

632074c

kbatuigas merged commit f70b1e9 into beta Nov 19, 2025
5 checks passed

kbatuigas deleted the DOC-1594-security-report branch November 19, 2025 00:22

paulohtb6 pushed a commit that referenced this pull request Nov 19, 2025

[25.3] Security report and other additions to What's New (#1450)

26c140d

Co-authored-by: Joyce Fee <[email protected]>

		All concepts described in this section are compatible with Kafka and its client libraries and CLIs. This section does not cover ways you can protect your Redpanda cluster externally; for example, through network ACLs or private networks.


		Use the link:api/doc/admin/operation/operation-get_security_report[`/v1/security/report`] Admin API endpoint to generate a comprehensive security report for your cluster. This endpoint provides detailed information about TLS configuration, authentication methods, authorization status, and security alerts across all Redpanda interfaces (Kafka, RPC, Admin, Schema Registry, HTTP Proxy).


		=== Monitor security settings

		Regularly review your cluster's security settings using the link:api/doc/admin/operation/operation-get_security_report[`/v1/security/report`] Admin API endpoint. Investigate and address any issues identified in the alerts section.

[25.3] Security report and other additions to What's New #1450

[25.3] Security report and other additions to What's New #1450

Uh oh!

Conversation

kbatuigas commented Nov 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Page previews

Checks

Uh oh!

coderabbitai bot commented Nov 12, 2025

Review skipped

Uh oh!

netlify bot commented Nov 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for redpanda-docs-preview ready!

Uh oh!

Uh oh!

IoannisRP left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bashtanov left a comment

Choose a reason for hiding this comment

Uh oh!

IoannisRP left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Feediver1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

kbatuigas commented Nov 12, 2025 •

edited

Loading

netlify bot commented Nov 12, 2025 •

edited

Loading