Explicitly always set mechanism in users.txt (#546)

* Explicitly always set mechanism in users.txt

* Regenerate golden file

* Add changelog

* Run task generate

Author: andrewstucki

.changes/unreleased/charts-redpanda-Fixed-20250321-091820.yaml

@@ -0,0 +1,4 @@
+project: charts/redpanda
+kind: Fixed
+body: Fixed an issue where not explicitly specifying a SASL auth mechanism when SASL is enabled caused Console to fail to start up.
+time: 2025-03-21T09:18:20.535475-04:00

charts/redpanda/CHANGELOG.md

@@ -25,6 +25,7 @@ and is generated by [Changie](https://github.com/miniscruff/changie).
   When Redpanda custom resource has enabled RBAC the reconciliation was blocked due
   ClusterRoleBinding referencing not yet created ClusterRole.
 
+* Fixed an issue where not explicitly specifying a SASL auth mechanism when SASL is enabled caused Console to fail to start up.
 
 ## v5.9.20 - 2025-02-06
 ### Changed

charts/redpanda/secrets.go

@@ -172,13 +172,19 @@ func SecretSASLUsers(dot *helmette.Dot) *corev1.Secret {
 			StringData: map[string]string{},
 		}
 		usersTxt := []string{}
+
+		defaultMechanism := DefaultSASLMechanism
+		if values.Auth.SASL.Mechanism != "" {
+			defaultMechanism = values.Auth.SASL.Mechanism
+		}
+
 		// Working around lack of support for += or strings.Join at the moment
 		for _, user := range values.Auth.SASL.Users {
-			if helmette.Empty(user.Mechanism) {
-				usersTxt = append(usersTxt, fmt.Sprintf("%s:%s", user.Name, user.Password))
-			} else {
-				usersTxt = append(usersTxt, fmt.Sprintf("%s:%s:%s", user.Name, user.Password, user.Mechanism))
+			mechanism := defaultMechanism
+			if !helmette.Empty(user.Mechanism) {
+				mechanism = user.Mechanism
 			}
+			usersTxt = append(usersTxt, fmt.Sprintf("%s:%s:%s", user.Name, user.Password, mechanism))
 		}
 		secret.StringData["users.txt"] = helmette.Join("\n", usersTxt)
 		return secret

charts/redpanda/templates/_secrets.go.tpl

@@ -57,12 +57,16 @@
 {{- if (and (and (ne $values.auth.sasl.secretRef "") $values.auth.sasl.enabled) (gt ((get (fromJson (include "_shims.len" (dict "a" (list $values.auth.sasl.users) ))) "r") | int) (0 | int))) -}}
 {{- $secret := (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Secret" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" $values.auth.sasl.secretRef "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "type" "Opaque" "stringData" (dict ) )) -}}
 {{- $usersTxt := (list ) -}}
+{{- $defaultMechanism := "SCRAM-SHA-512" -}}
+{{- if (ne $values.auth.sasl.mechanism "") -}}
+{{- $defaultMechanism = $values.auth.sasl.mechanism -}}
+{{- end -}}
 {{- range $_, $user := $values.auth.sasl.users -}}
-{{- if (empty $user.mechanism) -}}
-{{- $usersTxt = (concat (default (list ) $usersTxt) (list (printf "%s:%s" $user.name $user.password))) -}}
-{{- else -}}
-{{- $usersTxt = (concat (default (list ) $usersTxt) (list (printf "%s:%s:%s" $user.name $user.password $user.mechanism))) -}}
+{{- $mechanism := $defaultMechanism -}}
+{{- if (not (empty $user.mechanism)) -}}
+{{- $mechanism = $user.mechanism -}}
 {{- end -}}
+{{- $usersTxt = (concat (default (list ) $usersTxt) (list (printf "%s:%s:%s" $user.name $user.password $mechanism))) -}}
 {{- end -}}
 {{- if $_is_returning -}}
 {{- break -}}
@@ -93,9 +97,9 @@
 {{- break -}}
 {{- end -}}
 {{- $secretName := (printf "%s-bootstrap-user" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) -}}
-{{- $_203_existing_4_ok_5 := (get (fromJson (include "_shims.lookup" (dict "a" (list "v1" "Secret" $dot.Release.Namespace $secretName) ))) "r") -}}
-{{- $existing_4 := (index $_203_existing_4_ok_5 0) -}}
-{{- $ok_5 := (index $_203_existing_4_ok_5 1) -}}
+{{- $_209_existing_4_ok_5 := (get (fromJson (include "_shims.lookup" (dict "a" (list "v1" "Secret" $dot.Release.Namespace $secretName) ))) "r") -}}
+{{- $existing_4 := (index $_209_existing_4_ok_5 0) -}}
+{{- $ok_5 := (index $_209_existing_4_ok_5 1) -}}
 {{- if $ok_5 -}}
 {{- $_is_returning = true -}}
 {{- (dict "r" $existing_4) | toJson -}}

charts/redpanda/testdata/template-cases.golden.txtar

@@ -83086,7 +83086,7 @@ metadata:
   namespace: default
 stringData:
   users.txt: |-
-    empty-mechanism:valid
+    empty-mechanism:valid:SCRAM-SHA-512
     mechanism-256:valid:SCRAM-SHA-256
     mechanism-512:valid:SCRAM-SHA-512
 type: Opaque