Skip to content

Commit d498036

Browse files
francoisferrandfrancoisferrand
committed
Merge branch 'origin/improvement/ZENKO-5194/fix-ci-cgroupv2-upgrade-zookeeper'
2 parents 5a5517b + fe54d77 commit d498036

File tree

9 files changed

+103
-28
lines changed

9 files changed

+103
-28
lines changed

‎.github/scripts/end2end/configs/notification_destinations.yaml‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ spec:
2929
apiVersion: zenko.io/v1alpha2
3030
kind: ZenkoNotificationTarget
3131
metadata:
32-
name: ${NOTIF_AUTH_DEST_NAME}
32+
name: ${NOTIF_PLAIN_DEST_NAME}
3333
labels:
3434
app.kubernetes.io/instance: ${ZENKO_NAME}
3535
spec:
@@ -41,3 +41,22 @@ spec:
4141
plain:
4242
username: ${NOTIF_AUTH_DEST_USERNAME}
4343
password: ${NOTIF_AUTH_DEST_PASSWORD}
44+
45+
---
46+
47+
apiVersion: zenko.io/v1alpha2
48+
kind: ZenkoNotificationTarget
49+
metadata:
50+
name: ${NOTIF_SCRAM_DEST_NAME}
51+
labels:
52+
app.kubernetes.io/instance: ${ZENKO_NAME}
53+
spec:
54+
type: kafka
55+
host: ${NOTIF_KAFKA_AUTH_HOST}
56+
port: ${NOTIF_KAFKA_SCRAM_PORT}
57+
destinationTopic: ${NOTIF_SCRAM_DEST_TOPIC}
58+
auth: scram
59+
scram:
60+
username: ${NOTIF_SCRAM_DEST_USERNAME}
61+
password: ${NOTIF_SCRAM_DEST_PASSWORD}
62+
mechanism: SHA-512

‎.github/scripts/end2end/configure-e2e-ctst.sh‎

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
#!/bin/bash
22
set -exu
33

4+
# Get kafka image name and tag
5+
KAFKA_REGISTRY_NAME=$(yq eval ".kafka.sourceRegistry" ../../../solution/deps.yaml)
6+
KAFKA_IMAGE_NAME=$(yq eval ".kafka.image" ../../../solution/deps.yaml)
7+
KAFKA_IMAGE_TAG=$(yq eval ".kafka.tag" ../../../solution/deps.yaml)
8+
KAFKA_IMAGE=$KAFKA_REGISTRY_NAME/$KAFKA_IMAGE_NAME:$KAFKA_IMAGE_TAG
9+
410
# Setup test environment variables
511
export ZENKO_NAME=${1:-"end2end"}
612
# Getting kafka host from backbeat's config
@@ -14,8 +20,9 @@ export NOTIF_KAFKA_PORT=${KAFKA_HOST_PORT#*:}
1420
export NOTIF_KAFKA_AUTH_HOST="${ZENKO_NAME}-base-queue-auth-0"
1521
export NOTIF_KAFKA_AUTH_HOST_PORT="$NOTIF_KAFKA_AUTH_HOST:$NOTIF_KAFKA_PORT"
1622
export NOTIF_KAFKA_AUTH_PORT=9094
23+
export NOTIF_KAFKA_SCRAM_PORT=9095
1724

18-
# Add an extra SASL_PLAIN Kafka listener, to support testing authenticated Kafka for bucket notifications
25+
# Add extra SASL_PLAIN & SASL_SCRAM Kafka listeners, to support testing authenticated Kafka for bucket notifications
1926
kubectl get zookeepercluster "${ZENKO_NAME}-base-quorum" -o json | jq '.
2027
| .metadata |= {namespace, name: "\(.name)-auth" }
2128
| del(.spec.labels)
@@ -30,10 +37,16 @@ kubectl wait --for=jsonpath='{.status.readyReplicas}'=1 --timeout 10m zookeeperc
3037
kubectl get kafkacluster "${ZENKO_NAME}-base-queue" -o json | jq '.
3138
| .metadata |= {namespace, name: "\(.name)-auth" }
3239
| del(.status)
33-
| .spec.listenersConfig.internalListeners |= . + [{containerPort: 9094, name: "auth", type: "sasl_plaintext", usedForInnerBrokerCommunication: false}]
40+
| .spec.listenersConfig.internalListeners |= . + [
41+
{containerPort: 9094, name: "auth", type: "sasl_plaintext", usedForInnerBrokerCommunication: false},
42+
{containerPort: 9095, name: "scram", type: "sasl_plaintext", usedForInnerBrokerCommunication: false}
43+
]
3444
| .spec.readOnlyConfig |= (. + "
35-
sasl.enabled.mechanisms=PLAIN
45+
sasl.enabled.mechanisms=PLAIN,SCRAM-SHA-512
46+
listener.name.auth.sasl.enabled.mechanisms=PLAIN
3647
listener.name.auth.plain.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username=\"'"$NOTIF_AUTH_DEST_USERNAME"'\" password=\"'"$NOTIF_AUTH_DEST_PASSWORD"'\" user_'"$NOTIF_AUTH_DEST_USERNAME"'=\"'"$NOTIF_AUTH_DEST_PASSWORD"'\";
48+
listener.name.scram.sasl.enabled.mechanisms=SCRAM-SHA-512
49+
listener.name.scram.scram-sha-512.sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username=\"'"$NOTIF_SCRAM_DEST_USERNAME"'\" password=\"'"$NOTIF_SCRAM_DEST_PASSWORD"'\" user_'"$NOTIF_SCRAM_DEST_USERNAME"'=\"'"$NOTIF_SCRAM_DEST_PASSWORD"'\";
3750
")
3851
| del(.spec.brokerConfigGroups.default.storageConfigs[].pvcSpec)
3952
| .spec.brokerConfigGroups.default.storageConfigs[].emptyDir |= {medium: "Memory"}
@@ -42,6 +55,19 @@ listener.name.auth.plain.sasl.jaas.config=org.apache.kafka.common.security.plain
4255
' | kubectl apply -f -
4356
kubectl wait --for=jsonpath='{.status.state}'=ClusterRunning --timeout 10m kafkacluster "${ZENKO_NAME}-base-queue-auth"
4457

58+
# Create SCRAM credentials for the SCRAM listener
59+
kubectl run kafka-config \
60+
--image=$KAFKA_IMAGE \
61+
--pod-running-timeout=5m \
62+
--rm \
63+
--restart=Never \
64+
--attach=True \
65+
--command -- bash -c \
66+
"kafka-configs.sh --bootstrap-server $NOTIF_KAFKA_AUTH_HOST_PORT \
67+
--alter --add-config 'SCRAM-SHA-512=[password=$NOTIF_SCRAM_DEST_PASSWORD]' \
68+
--entity-type users \
69+
--entity-name $NOTIF_SCRAM_DEST_USERNAME"
70+
4571
UUID=$(kubectl get secret -l app.kubernetes.io/name=backbeat-config,app.kubernetes.io/instance=end2end \
4672
-o jsonpath='{.items[0].data.config\.json}' | base64 -di | jq .extensions.replication.topic)
4773
UUID=${UUID%.*}
@@ -57,12 +83,6 @@ kubectl wait --for condition=DeploymentInProgress=true --timeout 10m zenko/${ZEN
5783
kubectl wait --for condition=DeploymentFailure=false --timeout 10m zenko/${ZENKO_NAME}
5884
kubectl wait --for condition=DeploymentInProgress=false --timeout 10m zenko/${ZENKO_NAME}
5985

60-
# Get kafka image name and tag
61-
KAFKA_REGISTRY_NAME=$(yq eval ".kafka.sourceRegistry" ../../../solution/deps.yaml)
62-
KAFKA_IMAGE_NAME=$(yq eval ".kafka.image" ../../../solution/deps.yaml)
63-
KAFKA_IMAGE_TAG=$(yq eval ".kafka.tag" ../../../solution/deps.yaml)
64-
KAFKA_IMAGE=$KAFKA_REGISTRY_NAME/$KAFKA_IMAGE_NAME:$KAFKA_IMAGE_TAG
65-
6686
# Cold location topic
6787
AZURE_ARCHIVE_STATUS_TOPIC="${UUID}.cold-status-e2e-azure-archive"
6888
AZURE_ARCHIVE_STATUS_TOPIC_2_NV="${UUID}.cold-status-e2e-azure-archive-2-non-versioned"
@@ -80,6 +100,7 @@ kubectl run kafka-topics \
80100
"kafka-topics.sh --create --topic $NOTIF_DEST_TOPIC --bootstrap-server $KAFKA_HOST_PORT --if-not-exists ; \
81101
kafka-topics.sh --create --topic $NOTIF_ALT_DEST_TOPIC --bootstrap-server $KAFKA_HOST_PORT --if-not-exists ; \
82102
kafka-topics.sh --create --topic $NOTIF_AUTH_DEST_TOPIC --bootstrap-server $NOTIF_KAFKA_AUTH_HOST_PORT --if-not-exists ; \
103+
kafka-topics.sh --create --topic $NOTIF_SCRAM_DEST_TOPIC --bootstrap-server $NOTIF_KAFKA_AUTH_HOST_PORT --if-not-exists ; \
83104
kafka-topics.sh --create --topic $AZURE_ARCHIVE_STATUS_TOPIC --partitions 10 --bootstrap-server $KAFKA_HOST_PORT --if-not-exists ; \
84105
kafka-topics.sh --create --topic $AZURE_ARCHIVE_STATUS_TOPIC_2_NV --partitions 10 --bootstrap-server $KAFKA_HOST_PORT --if-not-exists ; \
85106
kafka-topics.sh --create --topic $AZURE_ARCHIVE_STATUS_TOPIC_2_V --partitions 10 --bootstrap-server $KAFKA_HOST_PORT --if-not-exists ; \

‎.github/scripts/end2end/run-e2e-ctst.sh‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,11 @@ KAFKA_HOST_PORT=$(kubectl get secret -l app.kubernetes.io/name=backbeat-config,a
6161
KAFKA_HOST_PORT=${KAFKA_HOST_PORT:1:-1}
6262
KAFKA_PORT=${KAFKA_HOST_PORT#*:}
6363

64+
# Subtle: we push to the authenticated Kafka through SASL/PLAIN and SASL/SCRAM,
65+
# as defined in notification_destinations.yaml, but we check the resulting
66+
# notification in the tests through the unauthenticated listener.
67+
# This is why we reuse the base Kafka port here, rather than 9094/9095.
68+
# This variable is used for checking the notifications only.
6469
KAFKA_AUTH_HOST="end2end-base-queue-auth-0"
6570
KAFKA_AUTH_HOST_PORT="$KAFKA_AUTH_HOST:$KAFKA_PORT"
6671

@@ -97,10 +102,10 @@ WORLD_PARAMETERS="$(jq -c <<EOF
97102
"NotificationDestinationTopic":"${NOTIF_DEST_TOPIC}",
98103
"NotificationDestinationAlt":"${NOTIF_ALT_DEST_NAME}",
99104
"NotificationDestinationTopicAlt":"${NOTIF_ALT_DEST_TOPIC}",
100-
"NotificationDestinationAuth":"${NOTIF_AUTH_DEST_NAME}",
101-
"NotificationDestinationTopicAuth":"${NOTIF_AUTH_DEST_TOPIC}",
102-
"NotificationDestinationAuthUsername":"${NOTIF_AUTH_DEST_USERNAME}",
103-
"NotificationDestinationAuthPassword":"${NOTIF_AUTH_DEST_PASSWORD}",
105+
"NotificationDestinationPlain":"${NOTIF_PLAIN_DEST_NAME}",
106+
"NotificationDestinationTopicPlain":"${NOTIF_AUTH_DEST_TOPIC}",
107+
"NotificationDestinationScram":"${NOTIF_SCRAM_DEST_NAME}",
108+
"NotificationDestinationTopicScram":"${NOTIF_SCRAM_DEST_TOPIC}",
104109
"KafkaExternalIps": "${KAFKA_EXTERNAL_IP:-}",
105110
"PrometheusService":"${PROMETHEUS_NAME}-operated.default.svc.cluster.local",
106111
"KafkaHosts":"${KAFKA_HOST_PORT}",

‎.github/workflows/end2end.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,10 +95,14 @@ env:
9595
NOTIF_DEST_TOPIC: "destination-topic-1"
9696
NOTIF_ALT_DEST_NAME: "destination2"
9797
NOTIF_ALT_DEST_TOPIC: "destination-topic-2"
98-
NOTIF_AUTH_DEST_NAME: "destination3"
98+
NOTIF_PLAIN_DEST_NAME: "destination3"
9999
NOTIF_AUTH_DEST_TOPIC: "destination-topic-3"
100100
NOTIF_AUTH_DEST_USERNAME: "admin"
101101
NOTIF_AUTH_DEST_PASSWORD: "admin-secret"
102+
NOTIF_SCRAM_DEST_NAME: "destination4"
103+
NOTIF_SCRAM_DEST_TOPIC: "destination-topic-4"
104+
NOTIF_SCRAM_DEST_USERNAME: "admin"
105+
NOTIF_SCRAM_DEST_PASSWORD: "admin-secret"
102106
SUBDOMAIN: "zenko.local"
103107
DR_SUBDOMAIN: "dr.zenko.local"
104108
SKOPEO_PATH: "/tmp"

‎solution/deps.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ backbeat:
66
dashboard: backbeat/backbeat-dashboards
77
image: backbeat
88
policy: backbeat/backbeat-policies
9-
tag: 9.1.5
9+
tag: 9.1.7
1010
envsubst: BACKBEAT_TAG
1111
busybox:
1212
image: busybox
@@ -130,10 +130,10 @@ vault:
130130
zenko-operator:
131131
sourceRegistry: ghcr.io/scality
132132
image: zenko-operator
133-
tag: v1.8.2
133+
tag: v1.8.3
134134
envsubst: ZENKO_OPERATOR_TAG
135135
zookeeper:
136-
sourceRegistry: pravega
136+
sourceRegistry: ghcr.io/adobe/zookeeper-operator
137137
image: zookeeper
138-
tag: 0.2.15
138+
tag: 3.8.4-0.2.15-adobe-20250923
139139
envsubst: ZOOKEEPER_TAG

‎solution/kafka/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ RUN tar -xzf $kafka_distro
2222
RUN rm -r kafka_$scala_version-$kafka_version/bin/windows
2323

2424
####################################################################################################
25-
FROM eclipse-temurin:17.0.3_7-jre
25+
FROM eclipse-temurin:17.0.18_8-jre
2626

2727
ARG scala_version=2.13
2828
ARG kafka_version=3.1.0

‎tests/ctst/features/bucket-notifications/notifications.feature‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,24 @@ Feature: Bucket notifications
100100
@BucketNotification
101101
Scenario Outline: Receive notification for configured events in authenticated notification destinations
102102
Given a "<versioningConfiguration>" bucket
103-
And one authenticated notification destination
103+
And one PLAIN authenticated notification destination
104+
When i subscribe to "<subscribedNotificationType>" notifications for destination <destination>
105+
And a "<notificationType>" event is triggered "<enable>" "<filterType>"
106+
Then i should "<shouldReceive>" a notification for "<notificationType>" event in destination <destination>
107+
108+
Examples:
109+
| versioningConfiguration | subscribedNotificationType | notificationType | enable | filterType | shouldReceive | destination |
110+
| Non versioned | s3:ObjectCreated:* | s3:ObjectCreated:Put | without | filter | receive | 0 |
111+
| Versioned | s3:ObjectCreated:* | s3:ObjectCreated:Copy | without | filter | receive | 0 |
112+
| Versioning suspended | s3:ObjectCreated:* | s3:ObjectCreated:Put | without | filter | receive | 0 |
113+
114+
@2.6.0
115+
@PreMerge
116+
@Flaky
117+
@BucketNotification
118+
Scenario Outline: Receive notification for configured events in SCRAM authenticated notification destinations
119+
Given a "<versioningConfiguration>" bucket
120+
And one SCRAM authenticated notification destination
104121
When i subscribe to "<subscribedNotificationType>" notifications for destination <destination>
105122
And a "<notificationType>" event is triggered "<enable>" "<filterType>"
106123
Then i should "<shouldReceive>" a notification for "<notificationType>" event in destination <destination>

‎tests/ctst/steps/notifications.ts‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -122,11 +122,20 @@ Given('one notification destination', function (this: Zenko) {
122122
);
123123
});
124124

125-
Given('one authenticated notification destination', function (this: Zenko) {
125+
Given('one PLAIN authenticated notification destination', function (this: Zenko) {
126126
setNotificationDestination(
127127
this,
128-
this.parameters.NotificationDestinationAuth,
129-
this.parameters.NotificationDestinationTopicAuth,
128+
this.parameters.NotificationDestinationPlain,
129+
this.parameters.NotificationDestinationTopicPlain,
130+
this.parameters.KafkaAuthHosts,
131+
);
132+
});
133+
134+
Given('one SCRAM authenticated notification destination', function (this: Zenko) {
135+
setNotificationDestination(
136+
this,
137+
this.parameters.NotificationDestinationScram,
138+
this.parameters.NotificationDestinationTopicScram,
130139
this.parameters.KafkaAuthHosts,
131140
);
132141
});

‎tests/ctst/world/Zenko.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -55,10 +55,10 @@ export interface ZenkoWorldParameters extends ClientOptions {
5555
NotificationDestinationTopic: string;
5656
NotificationDestinationAlt: string;
5757
NotificationDestinationTopicAlt: string;
58-
NotificationDestinationAuth: string;
59-
NotificationDestinationTopicAuth: string;
60-
NotificationDestinationAuthUsername: string;
61-
NotificationDestinationAuthPassword: string;
58+
NotificationDestinationPlain: string;
59+
NotificationDestinationTopicPlain: string;
60+
NotificationDestinationScram: string;
61+
NotificationDestinationTopicScram: string;
6262
KafkaExternalIps: string;
6363
KafkaHosts: string;
6464
KafkaAuthHosts: string;

0 commit comments

Comments
 (0)