Skip to content

Commit 5552a4c

Browse files
chrissetochrisseto
committed
redpanda: abstract listener configurations
This commit slims down the `values.go` file of redpanda by consolidating all the disparate listener types into a single type with a type parameter for their authentication method. In doing so, two long standing buglets have been fixed: - The previously unused `kafkaEndpoint` parameter has been removed. - The pandaproxy / http listener's `authentication_method` has been removed as redpanda doesn't support auth on it.
1 parent 90710e2 commit 5552a4c

26 files changed

+510
-1726
lines changed

‎.changes/unreleased/charts-redpanda-Fixed-20250414-111129.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
project: charts/redpanda
2+
kind: Fixed
3+
body: '`authentication_method` is no longer set on `http_api` as redpanda itself does not support authentication on the http API.'
4+
time: 2025-04-14T11:11:29.214567-04:00

‎.changes/unreleased/charts-redpanda-Removed-20250414-110855.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
project: charts/redpanda
2+
kind: Removed
3+
body: The unrespected`kafkaEndpoint` listener parameter has been removed from `values.yaml`
4+
time: 2025-04-14T11:08:55.846041-04:00

‎charts/redpanda/CHANGELOG.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,13 +113,15 @@ of `enterprise.license` and `enterprise.licenseSecretRef`, respectively.
113113
- `statefulset.sidecars.resources` -> `statefulset.podTemplate.spec.containers[*].resources`
114114
- `statefulset.sidecars.securityContext` -> `statefulset.podTemplate.spec.containers[*].securityContext`
115115
* Removed regex validation of all image tags.
116+
* The unrespected`kafkaEndpoint` listener parameter has been removed from `values.yaml`
116117
### Fixed
117118
* Reverse order of applying resources to first create ClusterRole and then ClusterRoleBinding.
118119
When Redpanda custom resource has enabled RBAC the reconciliation was blocked due
119120
ClusterRoleBinding referencing not yet created ClusterRole.
120121

121122
* Fixed an issue where not explicitly specifying a SASL auth mechanism when SASL is enabled caused Console to fail to start up.
122123
* Prevent broker nodes from restarting when solely the cluster replica amount changes
124+
* `authentication_method` is no longer set on `http_api` as redpanda itself does not support authentication on the http API.
123125
* Fixed rack awareness by mounting a service account token to the initcontainer when rack awareness is enabled.
124126
* Broken `Issuer`s and `Certificate`s are no longer needlessly generated when `tls.<cert>.issuerRef` is provided.
125127
* Fixed the security contexts' of `set-datadir-ownership` and `set-tiered-storage-cache-dir-ownership`.

‎charts/redpanda/README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -331,7 +331,7 @@ Listener settings. Override global settings configured above for individual lis
331331
**Default:**
332332

333333
```
334-
{"admin":{"external":{"default":{"advertisedPorts":[31644],"port":9645,"tls":{"cert":"external"}}},"port":9644,"tls":{"cert":"default","requireClientAuth":false}},"http":{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30082],"authenticationMethod":null,"port":8083,"tls":{"cert":"external","requireClientAuth":false}}},"kafkaEndpoint":"default","port":8082,"tls":{"cert":"default","requireClientAuth":false}},"kafka":{"authenticationMethod":null,"external":{"default":{"advertisedPorts":[31092],"authenticationMethod":null,"port":9094,"tls":{"cert":"external"}}},"port":9093,"tls":{"cert":"default","requireClientAuth":false}},"rpc":{"port":33145,"tls":{"cert":"default","requireClientAuth":false}},"schemaRegistry":{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30081],"authenticationMethod":null,"port":8084,"tls":{"cert":"external","requireClientAuth":false}}},"kafkaEndpoint":"default","port":8081,"tls":{"cert":"default","requireClientAuth":false}}}
334+
{"admin":{"external":{"default":{"advertisedPorts":[31644],"port":9645,"tls":{"cert":"external"}}},"port":9644,"tls":{"cert":"default","requireClientAuth":false}},"http":{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30082],"authenticationMethod":null,"port":8083,"tls":{"cert":"external","requireClientAuth":false}}},"port":8082,"tls":{"cert":"default","requireClientAuth":false}},"kafka":{"authenticationMethod":null,"external":{"default":{"advertisedPorts":[31092],"authenticationMethod":null,"port":9094,"tls":{"cert":"external"}}},"port":9093,"tls":{"cert":"default","requireClientAuth":false}},"rpc":{"port":33145,"tls":{"cert":"default","requireClientAuth":false}},"schemaRegistry":{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30081],"authenticationMethod":null,"port":8084,"tls":{"cert":"external","requireClientAuth":false}}},"port":8081,"tls":{"cert":"default","requireClientAuth":false}}}
335335
```
336336

337337
### [listeners.admin](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.admin)
@@ -405,7 +405,7 @@ HTTP API listeners (aka PandaProxy).
405405
**Default:**
406406

407407
```
408-
{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30082],"authenticationMethod":null,"port":8083,"tls":{"cert":"external","requireClientAuth":false}}},"kafkaEndpoint":"default","port":8082,"tls":{"cert":"default","requireClientAuth":false}}
408+
{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30082],"authenticationMethod":null,"port":8083,"tls":{"cert":"external","requireClientAuth":false}}},"port":8082,"tls":{"cert":"default","requireClientAuth":false}}
409409
```
410410

411411
### [listeners.kafka](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.kafka)
@@ -453,7 +453,7 @@ Schema registry listeners.
453453
**Default:**
454454

455455
```
456-
{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30081],"authenticationMethod":null,"port":8084,"tls":{"cert":"external","requireClientAuth":false}}},"kafkaEndpoint":"default","port":8081,"tls":{"cert":"default","requireClientAuth":false}}
456+
{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30081],"authenticationMethod":null,"port":8084,"tls":{"cert":"external","requireClientAuth":false}}},"port":8081,"tls":{"cert":"default","requireClientAuth":false}}
457457
```
458458

459459
### [logging](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=logging)

‎charts/redpanda/chart_test.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -807,22 +807,22 @@ func mTLSValuesUsingCertManager() *redpanda.PartialValues {
807807
External: &redpanda.PartialExternalConfig{Enabled: ptr.To(false)},
808808
ClusterDomain: ptr.To("cluster.local"),
809809
Listeners: &redpanda.PartialListeners{
810-
Admin: &redpanda.PartialAdminListeners{
810+
Admin: &redpanda.PartialListenerConfig[redpanda.NoAuth]{
811811
TLS: &redpanda.PartialInternalTLS{
812812
RequireClientAuth: ptr.To(true),
813813
},
814814
},
815-
HTTP: &redpanda.PartialHTTPListeners{
815+
HTTP: &redpanda.PartialListenerConfig[redpanda.HTTPAuthenticationMethod]{
816816
TLS: &redpanda.PartialInternalTLS{
817817
RequireClientAuth: ptr.To(true),
818818
},
819819
},
820-
Kafka: &redpanda.PartialKafkaListeners{
820+
Kafka: &redpanda.PartialListenerConfig[redpanda.KafkaAuthenticationMethod]{
821821
TLS: &redpanda.PartialInternalTLS{
822822
RequireClientAuth: ptr.To(true),
823823
},
824824
},
825-
SchemaRegistry: &redpanda.PartialSchemaRegistryListeners{
825+
SchemaRegistry: &redpanda.PartialListenerConfig[redpanda.NoAuth]{
826826
TLS: &redpanda.PartialInternalTLS{
827827
RequireClientAuth: ptr.To(true),
828828
},
@@ -856,7 +856,7 @@ func mTLSValuesWithProvidedCerts(serverTLSSecretName, clientTLSSecretName string
856856
},
857857
},
858858
Listeners: &redpanda.PartialListeners{
859-
Admin: &redpanda.PartialAdminListeners{
859+
Admin: &redpanda.PartialListenerConfig[redpanda.NoAuth]{
860860
//External: redpanda.PartialExternalListeners[redpanda.PartialAdminExternal]{
861861
// "default": redpanda.PartialAdminExternal{Enabled: ptr.To(false), Port: ptr.To(int32(0))},
862862
//},
@@ -865,7 +865,7 @@ func mTLSValuesWithProvidedCerts(serverTLSSecretName, clientTLSSecretName string
865865
Cert: ptr.To("provided"),
866866
},
867867
},
868-
HTTP: &redpanda.PartialHTTPListeners{
868+
HTTP: &redpanda.PartialListenerConfig[redpanda.HTTPAuthenticationMethod]{
869869
//External: redpanda.PartialExternalListeners[redpanda.PartialHTTPExternal]{
870870
// "default": redpanda.PartialHTTPExternal{Enabled: ptr.To(false), Port: ptr.To(int32(0))},
871871
//},
@@ -874,7 +874,7 @@ func mTLSValuesWithProvidedCerts(serverTLSSecretName, clientTLSSecretName string
874874
Cert: ptr.To("provided"),
875875
},
876876
},
877-
Kafka: &redpanda.PartialKafkaListeners{
877+
Kafka: &redpanda.PartialListenerConfig[redpanda.KafkaAuthenticationMethod]{
878878
//External: redpanda.PartialExternalListeners[redpanda.PartialKafkaExternal]{
879879
// "default": redpanda.PartialKafkaExternal{Enabled: ptr.To(false), Port: ptr.To(int32(0))},
880880
//},
@@ -883,7 +883,7 @@ func mTLSValuesWithProvidedCerts(serverTLSSecretName, clientTLSSecretName string
883883
Cert: ptr.To("provided"),
884884
},
885885
},
886-
SchemaRegistry: &redpanda.PartialSchemaRegistryListeners{
886+
SchemaRegistry: &redpanda.PartialListenerConfig[redpanda.NoAuth]{
887887
//External: redpanda.PartialExternalListeners[redpanda.PartialSchemaRegistryExternal]{
888888
// "default": redpanda.PartialSchemaRegistryExternal{Enabled: ptr.To(false), Port: ptr.To(int32(0))},
889889
//},

‎charts/redpanda/ci/12-external-cert-secrets-values.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,6 @@ listeners:
5656
schemaRegistry:
5757
enabled: true
5858
port: 8081
59-
kafkaEndpoint: default
6059
tls:
6160
# Optional flag to override the global TLS enabled flag.
6261
# enabled: true
@@ -75,7 +74,6 @@ listeners:
7574
http:
7675
enabled: true
7776
port: 8082
78-
kafkaEndpoint: default
7977
tls:
8078
# Optional flag to override the global TLS enabled flag.
8179
# enabled: true

‎charts/redpanda/ci/40-empty-string-tls-novalues.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ listeners:
1717
authenticationMethod: none
1818
enabled: true
1919
external: {}
20-
kafkaEndpoint: kafka-default
2120
port: 8082
2221
tls:
2322
cert: ""

‎charts/redpanda/configmap.tpl.go‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -506,8 +506,13 @@ func kafkaClient(dot *helmette.Dot) map[string]any {
506506
func configureListeners(redpanda map[string]any, dot *helmette.Dot) {
507507
values := helmette.Unwrap[Values](dot.Values)
508508

509-
redpanda["admin"] = values.Listeners.Admin.Listeners()
510-
redpanda["kafka_api"] = values.Listeners.Kafka.Listeners(&values.Auth)
509+
var defaultKafkaAuth *KafkaAuthenticationMethod
510+
if values.Auth.SASL.Enabled {
511+
defaultKafkaAuth = ptr.To(SASLKafkaAuthenticationMethod)
512+
}
513+
514+
redpanda["admin"] = values.Listeners.Admin.Listeners(nil /* No auth on admin API */)
515+
redpanda["kafka_api"] = values.Listeners.Kafka.Listeners(defaultKafkaAuth)
511516
redpanda["rpc_server"] = rpcListeners(dot)
512517

513518
// Backwards compatibility layer, if any of the *_tls keys are an empty
@@ -534,7 +539,12 @@ func pandaProxyListener(dot *helmette.Dot) map[string]any {
534539

535540
pandaProxy := map[string]any{}
536541

537-
pandaProxy["pandaproxy_api"] = values.Listeners.HTTP.Listeners(values.Auth.IsSASLEnabled())
542+
var pandaProxyAuth *HTTPAuthenticationMethod
543+
if values.Auth.IsSASLEnabled() {
544+
pandaProxyAuth = ptr.To(BasicHTTPAuthenticationMethod)
545+
}
546+
547+
pandaProxy["pandaproxy_api"] = values.Listeners.HTTP.Listeners(pandaProxyAuth)
538548
pandaProxy["pandaproxy_api_tls"] = nil
539549
if tls := values.Listeners.HTTP.ListenersTLS(&values.TLS); len(tls) > 0 {
540550
pandaProxy["pandaproxy_api_tls"] = tls
@@ -546,8 +556,7 @@ func schemaRegistry(dot *helmette.Dot) map[string]any {
546556
values := helmette.Unwrap[Values](dot.Values)
547557

548558
schemaReg := map[string]any{}
549-
550-
schemaReg["schema_registry_api"] = values.Listeners.SchemaRegistry.Listeners(values.Auth.IsSASLEnabled())
559+
schemaReg["schema_registry_api"] = values.Listeners.SchemaRegistry.Listeners(nil /* No auth on admin API */)
551560
schemaReg["schema_registry_api_tls"] = nil
552561
if tls := values.Listeners.SchemaRegistry.ListenersTLS(&values.TLS); len(tls) > 0 {
553562
schemaReg["schema_registry_api_tls"] = tls
@@ -606,14 +615,6 @@ func createInternalListenerTLSCfg(tls *TLS, internal InternalTLS) map[string]any
606615
}
607616
}
608617

609-
func createInternalListenerCfg(port int32) map[string]any {
610-
return map[string]any{
611-
"name": "internal",
612-
"address": "0.0.0.0",
613-
"port": port,
614-
}
615-
}
616-
617618
// RedpandaAdditionalStartFlags returns a string slice of flags suitable for use
618619
// as `additional_start_flags`. User provided flags will override any of those
619620
// set by default.

‎charts/redpanda/service.loadbalancer.go‎

Lines changed: 4 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,6 @@ import (
1515

1616
corev1 "k8s.io/api/core/v1"
1717
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
18-
"k8s.io/apimachinery/pkg/util/intstr"
1918
"k8s.io/utils/ptr"
2019

2120
"github.com/redpanda-data/redpanda-operator/gotohelm/helmette"
@@ -84,65 +83,10 @@ func LoadBalancerServices(dot *helmette.Dot) []*corev1.Service {
8483
// in helm. TODO setup a linter that barks about this? Also a helper
8584
// for getting the sorted keys of a map?
8685
var ports []corev1.ServicePort
87-
for name, listener := range helmette.SortedMap(values.Listeners.Admin.External) {
88-
if !ptr.Deref(listener.Enabled, values.External.Enabled) {
89-
continue
90-
}
91-
92-
fallbackPorts := append(listener.AdvertisedPorts, values.Listeners.Admin.Port)
93-
94-
ports = append(ports, corev1.ServicePort{
95-
Name: fmt.Sprintf("admin-%s", name),
96-
Protocol: corev1.ProtocolTCP,
97-
TargetPort: intstr.FromInt32(listener.Port),
98-
Port: ptr.Deref(listener.NodePort, fallbackPorts[0]),
99-
})
100-
}
101-
102-
for name, listener := range helmette.SortedMap(values.Listeners.Kafka.External) {
103-
if !ptr.Deref(listener.Enabled, values.External.Enabled) {
104-
continue
105-
}
106-
107-
fallbackPorts := append(listener.AdvertisedPorts, listener.Port)
108-
109-
ports = append(ports, corev1.ServicePort{
110-
Name: fmt.Sprintf("kafka-%s", name),
111-
Protocol: corev1.ProtocolTCP,
112-
TargetPort: intstr.FromInt32(listener.Port),
113-
Port: ptr.Deref(listener.NodePort, fallbackPorts[0]),
114-
})
115-
}
116-
117-
for name, listener := range helmette.SortedMap(values.Listeners.HTTP.External) {
118-
if !ptr.Deref(listener.Enabled, values.External.Enabled) {
119-
continue
120-
}
121-
122-
fallbackPorts := append(listener.AdvertisedPorts, listener.Port)
123-
124-
ports = append(ports, corev1.ServicePort{
125-
Name: fmt.Sprintf("http-%s", name),
126-
Protocol: corev1.ProtocolTCP,
127-
TargetPort: intstr.FromInt32(listener.Port),
128-
Port: ptr.Deref(listener.NodePort, fallbackPorts[0]),
129-
})
130-
}
131-
132-
for name, listener := range helmette.SortedMap(values.Listeners.SchemaRegistry.External) {
133-
if !ptr.Deref(listener.Enabled, values.External.Enabled) {
134-
continue
135-
}
136-
137-
fallbackPorts := append(listener.AdvertisedPorts, listener.Port)
138-
139-
ports = append(ports, corev1.ServicePort{
140-
Name: fmt.Sprintf("schema-%s", name),
141-
Protocol: corev1.ProtocolTCP,
142-
TargetPort: intstr.FromInt32(listener.Port),
143-
Port: ptr.Deref(listener.NodePort, fallbackPorts[0]),
144-
})
145-
}
86+
ports = append(ports, values.Listeners.Admin.ServicePorts("admin", &values.External)...)
87+
ports = append(ports, values.Listeners.Kafka.ServicePorts("kafka", &values.External)...)
88+
ports = append(ports, values.Listeners.HTTP.ServicePorts("http", &values.External)...)
89+
ports = append(ports, values.Listeners.SchemaRegistry.ServicePorts("schema", &values.External)...)
14690

14791
svc := &corev1.Service{
14892
TypeMeta: metav1.TypeMeta{

0 commit comments

Comments
 (0)