Skip to content

Commit 78e2911

Browse files
andrewstuckiandrewstucki
authored
Add support for v1 clusters for users, roles, topics, and schemas (#1120)
* Add support for v1 clusters for users, roles, and schemas * Add topic controller watches and make initialization similar to other controllers * Fix step references * Fix versioning * swap to vectorized-based regex * Fix up features
1 parent 9e08d14 commit 78e2911

File tree

20 files changed

+780
-162
lines changed

20 files changed

+780
-162
lines changed

‎acceptance/clusters/roles/cluster.yaml‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎acceptance/clusters/vectorized/sasl/cluster.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
apiVersion: redpanda.vectorized.io/v1alpha1
2+
kind: Cluster
3+
metadata:
4+
name: sasl
5+
spec:
6+
image: "redpandadata/redpanda"
7+
version: "v25.2.1"
8+
replicas: 1
9+
enableSasl: true
10+
resources:
11+
requests:
12+
cpu: "100m"
13+
memory: 256Mi
14+
limits:
15+
cpu: "100m"
16+
memory: 256Mi
17+
configuration:
18+
rpcServer:
19+
port: 33145
20+
kafkaApi:
21+
- port: 9092
22+
adminApi:
23+
- port: 9644
24+
developerMode: true
25+
additionalCommandlineArguments:
26+
dump-memory-diagnostics-on-alloc-failure-kind: all
27+
abort-on-seastar-bad-alloc: ''

‎acceptance/features/role-crds.feature‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
1-
@cluster:roles
1+
@cluster:sasl
22
Feature: Role CRDs
33
Background: Cluster available
4-
Given cluster "roles" is available
4+
Given cluster "sasl" is available
55

66
@skip:gke @skip:aks @skip:eks
77
Scenario: Manage roles
8-
Given there is no role "admin-role" in cluster "roles"
9-
And there are the following pre-existing users in cluster "roles"
8+
Given there is no role "admin-role" in cluster "sasl"
9+
And there are the following pre-existing users in cluster "sasl"
1010
| name | password | mechanism |
1111
| alice | password | SCRAM-SHA-256 |
1212
| bob | password | SCRAM-SHA-256 |
1313
When I apply Kubernetes manifest:
1414
"""
1515
# tag::manage-roles-with-principals[]
16-
# In this example manifest, a role called "admin-role" is created in a cluster called "roles".
16+
# In this example manifest, a role called "admin-role" is created in a cluster called "sasl".
1717
# The role includes two principals (alice and bob) who will inherit the role's permissions.
1818
---
1919
apiVersion: cluster.redpanda.com/v1alpha2
@@ -23,27 +23,27 @@ Feature: Role CRDs
2323
spec:
2424
cluster:
2525
clusterRef:
26-
name: roles
26+
name: sasl
2727
principals:
2828
- User:alice
2929
- User:bob
3030
# end::manage-roles-with-principals[]
3131
"""
3232
And role "admin-role" is successfully synced
33-
Then role "admin-role" should exist in cluster "roles"
34-
And role "admin-role" should have members "alice and bob" in cluster "roles"
33+
Then role "admin-role" should exist in cluster "sasl"
34+
And role "admin-role" should have members "alice and bob" in cluster "sasl"
3535

3636
@skip:gke @skip:aks @skip:eks
3737
Scenario: Manage roles with authorization
38-
Given there is no role "read-only-role" in cluster "roles"
39-
And there are the following pre-existing users in cluster "roles"
38+
Given there is no role "read-only-role" in cluster "sasl"
39+
And there are the following pre-existing users in cluster "sasl"
4040
| name | password | mechanism |
4141
| charlie | password | SCRAM-SHA-256 |
42-
When I create topic "public-test" in cluster "roles"
42+
When I create topic "public-test" in cluster "sasl"
4343
And I apply Kubernetes manifest:
4444
"""
4545
# tag::manage-roles-with-authorization[]
46-
# In this example manifest, a role called "read-only-role" is created in a cluster called "roles".
46+
# In this example manifest, a role called "read-only-role" is created in a cluster called "sasl".
4747
# The role includes authorization rules that allow reading from topics with names starting with "public-".
4848
---
4949
apiVersion: cluster.redpanda.com/v1alpha2
@@ -53,7 +53,7 @@ Feature: Role CRDs
5353
spec:
5454
cluster:
5555
clusterRef:
56-
name: roles
56+
name: sasl
5757
principals:
5858
- User:charlie
5959
authorization:
@@ -67,16 +67,16 @@ Feature: Role CRDs
6767
# end::manage-roles-with-authorization[]
6868
"""
6969
And role "read-only-role" is successfully synced
70-
Then role "read-only-role" should exist in cluster "roles"
71-
And role "read-only-role" should have ACLs for topic pattern "public-" in cluster "roles"
72-
And "charlie" should be able to read from topic "public-test" in cluster "roles"
70+
Then role "read-only-role" should exist in cluster "sasl"
71+
And role "read-only-role" should have ACLs for topic pattern "public-" in cluster "sasl"
72+
And "charlie" should be able to read from topic "public-test" in cluster "sasl"
7373

7474
@skip:gke @skip:aks @skip:eks
7575
Scenario: Manage authorization-only roles
76-
Given there are the following pre-existing users in cluster "roles"
76+
Given there are the following pre-existing users in cluster "sasl"
7777
| name | password | mechanism |
7878
| travis | password | SCRAM-SHA-256 |
79-
And there is a pre-existing role "travis-role" in cluster "roles"
79+
And there is a pre-existing role "travis-role" in cluster "sasl"
8080
When I apply Kubernetes manifest:
8181
"""
8282
# tag::manage-authz-only-roles[]
@@ -91,7 +91,7 @@ Feature: Role CRDs
9191
spec:
9292
cluster:
9393
clusterRef:
94-
name: roles
94+
name: sasl
9595
principals:
9696
- User:travis
9797
authorization:
@@ -106,5 +106,5 @@ Feature: Role CRDs
106106
"""
107107
And role "travis-role" is successfully synced
108108
And I delete the CRD role "travis-role"
109-
Then there should still be role "travis-role" in cluster "roles"
110-
And there should be no ACLs for role "travis-role" in cluster "roles"
109+
Then there should still be role "travis-role" in cluster "sasl"
110+
And there should be no ACLs for role "travis-role" in cluster "sasl"

‎acceptance/features/vectorized-role-crds.feature‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
@cluster:vectorized/sasl
2+
Feature: Vectorized Role CRDs
3+
Background: Cluster available
4+
Given vectorized cluster "sasl" is available
5+
6+
@skip:gke @skip:aks @skip:eks
7+
Scenario: Manage vectorized roles
8+
Given there is no role "admin-role" in vectorized cluster "sasl"
9+
And there are the following pre-existing users in vectorized cluster "sasl"
10+
| name | password | mechanism |
11+
| alice | password | SCRAM-SHA-256 |
12+
| bob | password | SCRAM-SHA-256 |
13+
When I apply Kubernetes manifest:
14+
"""
15+
---
16+
apiVersion: cluster.redpanda.com/v1alpha2
17+
kind: Role
18+
metadata:
19+
name: admin-role
20+
spec:
21+
cluster:
22+
clusterRef:
23+
group: redpanda.vectorized.io
24+
kind: Cluster
25+
name: sasl
26+
principals:
27+
- User:alice
28+
- User:bob
29+
"""
30+
And role "admin-role" is successfully synced
31+
Then role "admin-role" should exist in vectorized cluster "sasl"
32+
And role "admin-role" should have members "alice and bob" in vectorized cluster "sasl"
33+
34+
@skip:gke @skip:aks @skip:eks
35+
Scenario: Manage vectorized roles with authorization
36+
Given there is no role "read-only-role" in vectorized cluster "sasl"
37+
And there are the following pre-existing users in vectorized cluster "sasl"
38+
| name | password | mechanism |
39+
| charlie | password | SCRAM-SHA-256 |
40+
When I create topic "public-test" in vectorized cluster "sasl"
41+
And I apply Kubernetes manifest:
42+
"""
43+
---
44+
apiVersion: cluster.redpanda.com/v1alpha2
45+
kind: Role
46+
metadata:
47+
name: read-only-role
48+
spec:
49+
cluster:
50+
clusterRef:
51+
group: redpanda.vectorized.io
52+
kind: Cluster
53+
name: sasl
54+
principals:
55+
- User:charlie
56+
authorization:
57+
acls:
58+
- type: allow
59+
resource:
60+
type: topic
61+
name: public-
62+
patternType: prefixed
63+
operations: [Read, Describe]
64+
"""
65+
And role "read-only-role" is successfully synced
66+
Then role "read-only-role" should exist in vectorized cluster "sasl"
67+
And role "read-only-role" should have ACLs for topic pattern "public-" in vectorized cluster "sasl"
68+
And "charlie" should be able to read from topic "public-test" in vectorized cluster "sasl"
69+
70+
@skip:gke @skip:aks @skip:eks
71+
Scenario: Manage vectorized authorization-only roles
72+
Given there are the following pre-existing users in vectorized cluster "sasl"
73+
| name | password | mechanism |
74+
| travis | password | SCRAM-SHA-256 |
75+
And there is a pre-existing role "travis-role" in vectorized cluster "sasl"
76+
When I apply Kubernetes manifest:
77+
"""
78+
---
79+
apiVersion: cluster.redpanda.com/v1alpha2
80+
kind: Role
81+
metadata:
82+
name: travis-role
83+
spec:
84+
cluster:
85+
clusterRef:
86+
group: redpanda.vectorized.io
87+
kind: Cluster
88+
name: sasl
89+
principals:
90+
- User:travis
91+
authorization:
92+
acls:
93+
- type: allow
94+
resource:
95+
type: topic
96+
name: some-topic
97+
patternType: prefixed
98+
operations: [Read]
99+
"""
100+
And role "travis-role" is successfully synced
101+
And I delete the CRD role "travis-role"
102+
Then there should still be role "travis-role" in vectorized cluster "sasl"
103+
And there should be no ACLs for role "travis-role" in vectorized cluster "sasl"

‎acceptance/main_test.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
"github.com/redpanda-data/redpanda-operator/harpoon/providers"
2626
redpandav1alpha1 "github.com/redpanda-data/redpanda-operator/operator/api/redpanda/v1alpha1"
2727
redpandav1alpha2 "github.com/redpanda-data/redpanda-operator/operator/api/redpanda/v1alpha2"
28+
vectorizedv1alpha1 "github.com/redpanda-data/redpanda-operator/operator/api/vectorized/v1alpha1"
2829
operatorchart "github.com/redpanda-data/redpanda-operator/operator/chart"
2930
"github.com/redpanda-data/redpanda-operator/pkg/helm"
3031
"github.com/redpanda-data/redpanda-operator/pkg/otelutil"
@@ -60,7 +61,7 @@ var setupSuite = sync.OnceValues(func() (*framework.Suite, error) {
6061
"quay.io/jetstack/cert-manager-startupapicheck:v1.14.2",
6162
"quay.io/jetstack/cert-manager-webhook:v1.14.2",
6263
}...).
63-
WithSchemeFunctions(redpandav1alpha1.Install, redpandav1alpha2.Install).
64+
WithSchemeFunctions(vectorizedv1alpha1.Install, redpandav1alpha1.Install, redpandav1alpha2.Install).
6465
WithHelmChart("https://charts.jetstack.io", "jetstack", "cert-manager", helm.InstallOptions{
6566
Name: "cert-manager",
6667
Namespace: "cert-manager",
@@ -88,9 +89,16 @@ var setupSuite = sync.OnceValues(func() (*framework.Suite, error) {
8889
Repository: ptr.To(imageRepo),
8990
},
9091
CRDs: &operatorchart.PartialCRDs{
92+
Enabled: ptr.To(true),
93+
Experimental: ptr.To(true),
94+
},
95+
VectorizedControllers: &operatorchart.PartialVectorizedControllers{
9196
Enabled: ptr.To(true),
9297
},
9398
AdditionalCmdFlags: []string{
99+
// For the v1 controllers since otherwise we'll attempt to always
100+
// pull the locally built operator which will result in errors
101+
"--configurator-image-pull-policy=IfNotPresent",
94102
// These are needed for running decommissioning tests.
95103
"--additional-controllers=nodeWatcher,decommission",
96104
"--unbind-pvcs-after=5s",

‎acceptance/steps/cluster.go‎

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"context"
1414
"fmt"
1515
"math/rand/v2"
16+
"strings"
1617
"time"
1718

1819
"github.com/redpanda-data/common-go/rpadmin"
@@ -24,9 +25,52 @@ import (
2425

2526
framework "github.com/redpanda-data/redpanda-operator/harpoon"
2627
redpandav1alpha2 "github.com/redpanda-data/redpanda-operator/operator/api/redpanda/v1alpha2"
28+
vectorizedv1alpha1 "github.com/redpanda-data/redpanda-operator/operator/api/vectorized/v1alpha1"
2729
)
2830

29-
func checkClusterAvailability(ctx context.Context, t framework.TestingT, clusterName string) {
31+
func checkClusterAvailability(ctx context.Context, t framework.TestingT, version, clusterName string) {
32+
version = strings.TrimSpace(version)
33+
34+
if version == "vectorized" {
35+
checkV1ClusterAvailability(ctx, t, clusterName)
36+
return
37+
}
38+
checkV2ClusterAvailability(ctx, t, clusterName)
39+
}
40+
41+
func checkV1ClusterAvailability(ctx context.Context, t framework.TestingT, clusterName string) {
42+
var cluster vectorizedv1alpha1.Cluster
43+
44+
key := t.ResourceKey(clusterName)
45+
46+
t.Logf("Checking cluster %q is ready", clusterName)
47+
require.Eventually(t, func() bool {
48+
require.NoError(t, t.Get(ctx, key, &cluster))
49+
hasConditionQuiescent := hasV1Condition(vectorizedv1alpha1.ClusterCondition{
50+
Type: vectorizedv1alpha1.OperatorQuiescentConditionType,
51+
Status: corev1.ConditionTrue,
52+
}, cluster.Status.Conditions)
53+
54+
hasCondition := hasConditionQuiescent
55+
56+
t.Logf(`Checking cluster resource conditions contains "OperatorQuiescent"? %v`, hasCondition)
57+
return hasCondition
58+
}, 5*time.Minute, 5*time.Second, "%s", delayLog(func() string {
59+
return fmt.Sprintf(`Cluster %q never contained the condition reason "OperatorQuiescent", final Conditions: %+v`, key.String(), cluster.Status.Conditions)
60+
}))
61+
t.Logf("Cluster %q is ready!", clusterName)
62+
}
63+
64+
func hasV1Condition(expected vectorizedv1alpha1.ClusterCondition, conditions []vectorizedv1alpha1.ClusterCondition) bool {
65+
for _, condition := range conditions {
66+
if expected.Type == condition.Type && expected.Status == condition.Status {
67+
return true
68+
}
69+
}
70+
return false
71+
}
72+
73+
func checkV2ClusterAvailability(ctx context.Context, t framework.TestingT, clusterName string) {
3074
var cluster redpandav1alpha2.Redpanda
3175

3276
key := t.ResourceKey(clusterName)

0 commit comments

Comments
 (0)