Deploy a SASL_PLAIN Kafka listener & test notifications against it #2300

delthas · 2025-12-24T10:52:27Z

bert-e · 2025-12-24T10:52:30Z

Hello delthas,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
`/after_pull_request`	Wait for the given pull request id to be merged before continuing with the current one.
`/bypass_author_approval`	Bypass the pull request author's approval	⭐
`/bypass_build_status`	Bypass the build and test status	⭐
`/bypass_commit_size`	Bypass the check on the size of the changeset `TBA`	⭐
`/bypass_incompatible_branch`	Bypass the check on the source branch prefix	⭐
`/bypass_jira_check`	Bypass the Jira issue check	⭐
`/bypass_peer_approval`	Bypass the pull request peers' approval	⭐
`/bypass_leader_approval`	Bypass the pull request leaders' approval	⭐
`/approve`	Instruct Bert-E that the author has approved the pull request.		✍️
`/create_pull_requests`	Allow the creation of integration pull requests.
`/create_integration_branches`	Allow the creation of integration branches.
`/no_octopus`	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
`/unanimity`	Change review acceptance criteria from `one reviewer at least` to `all reviewers`
`/wait`	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
`/help`	Print Bert-E's manual in the pull request.
`/status`	Print Bert-E's current status in the pull request `TBA`
`/clear`	Remove all comments from Bert-E from the history `TBA`
`/retry`	Re-start a fresh build `TBA`
`/build`	Re-start a fresh build `TBA`
`/force_reset`	Delete integration branches & pull requests, and restart merge process from the beginning.
`/reset`	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

Copilot

Pull request overview

This PR adds support for testing SASL_PLAIN authenticated Kafka listeners with bucket notifications. It configures a new Kafka listener with SASL authentication and creates the necessary test infrastructure to verify notifications work with authenticated Kafka endpoints.

Adds a third notification destination with SASL_PLAIN authentication support
Configures a new Kafka listener on port 9095 with SASL authentication
Extends test parameters and environment variables to support authenticated notifications

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/ctst/world/Zenko.ts	Adds interface properties for authenticated notification destination configuration
tests/ctst/steps/notifications.ts	Implements test step for setting up an authenticated notification destination
.github/workflows/end2end.yaml	Defines environment variables for authenticated destination credentials and topic
.github/scripts/end2end/run-e2e-ctst.sh	Passes authenticated notification parameters to test world configuration
.github/scripts/end2end/configure-e2e.sh	Adds Kafka topic creation for authenticated notification destination
.github/scripts/end2end/configure-e2e-ctst.sh	Configures SASL_PLAIN Kafka listener and creates authenticated notification topic
.github/scripts/end2end/configs/notification_destinations.yaml	Defines ZenkoNotificationTarget with basic authentication credentials

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

tests/ctst/steps/notifications.ts

.github/scripts/end2end/configure-e2e-ctst.sh

Copilot · 2025-12-24T10:58:59Z

.github/scripts/end2end/configs/notification_destinations.yaml

+  auth: basic
+  basic:


The authentication type is specified as 'basic', but Kafka typically uses SASL authentication mechanisms. The field name 'basic' for the authentication credentials section (lines 41-43) may not align with Kafka's SASL_PLAIN mechanism. Verify that this authentication configuration is compatible with the SASL_PLAIN listener configured in configure-e2e-ctst.sh, or consider using more Kafka-specific terminology like 'sasl' instead of 'basic'.

Suggested change

auth: basic

basic:

auth: sasl

sasl:

looking at ZKOP pr, this is currently plain

should we call this field sasl instead, as recommended by Copilot? (or sasl-plain)

bert-e · 2025-12-24T12:30:38Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Issue: ZENKO-5106 Signed-off-by: Thomas Flament <[email protected]>

Signed-off-by: Thomas Flament <[email protected]>

delthas · 2025-12-29T16:21:07Z

Test failure appears to be unrelated: https://github.com/scality/Zenko/actions/runs/20574693679/job/59089167866#step:10:57882

2025-12-29T15:46:43.5917709Z Failures:
2025-12-29T15:46:43.5919230Z 
2025-12-29T15:46:43.5932481Z 1) Scenario: Replicate objects created before creating the replication rule # features/crrReplicationS3utils.feature:17
2025-12-29T15:46:43.5934141Z    ✔ Before # hooks/Logger.ts:39
2025-12-29T15:46:43.5934864Z    ✔ Before # hooks/versionTags.ts:5
2025-12-29T15:46:43.5935688Z    ✔ Before # common/hooks.ts:36
2025-12-29T15:46:43.5936910Z    ✔ Given an existing bucket "source-bucket-1" "with" versioning, "without" ObjectLock "without" retention mode # common/common.ts:140
2025-12-29T15:46:43.5938501Z    ✔ And an object "source-object-1" that "exists" # common/common.ts:374
2025-12-29T15:46:43.5939409Z    ✔ And a replication configuration to "awsbackendmismatch" location # common/common.ts:263
2025-12-29T15:46:43.5940262Z    ✔ When the job to replicate existing objects with status "NEW" is executed # steps/replication.ts:16
2025-12-29T15:46:43.5942424Z    ✖ Then the object replication should "succeed" within 300 seconds # steps/replication.ts:66
2025-12-29T15:46:43.5943870Z        AssertionError [ERR_ASSERTION]: Timeout: Object 'source-object-1' is still in pending/processing state after timeout
2025-12-29T15:46:43.5945061Z            at Zenko.<anonymous> (/ctst/steps/replication.ts:115:16)
2025-12-29T15:46:43.5946134Z            at processTicksAndRejections (node:internal/process/task_queues:95:5)
2025-12-29T15:46:43.5947426Z    - And the replicated object should be the same as the source object # steps/replication.ts:118
2025-12-29T15:46:43.5948470Z    ✔ After # common/hooks.ts:63
2025-12-29T15:46:43.5949143Z    ✔ After # hooks/Logger.ts:63
2025-12-29T15:46:43.5949522Z 
2025-12-29T15:46:43.5950166Z 2) Scenario: Re-replicate objects that failed to replicate # features/crrReplicationS3utils.feature:29
2025-12-29T15:46:43.5951256Z    ✔ Before # hooks/Logger.ts:39
2025-12-29T15:46:43.5951954Z    ✔ Before # hooks/versionTags.ts:5
2025-12-29T15:46:43.5952688Z    ✔ Before # common/hooks.ts:36
2025-12-29T15:46:43.5954249Z    ✔ Given an existing bucket "source-bucket2" "with" versioning, "without" ObjectLock "without" retention mode # common/common.ts:140
2025-12-29T15:46:43.5955986Z    ✔ And a replication configuration to "awsbackendreplicationctstfail" location # common/common.ts:263
2025-12-29T15:46:43.5957390Z    ✔ And a deleted destination bucket on that location # steps/replication.ts:176
2025-12-29T15:46:43.5958563Z    ✔ And an object "source-object-2" that "exists" # common/common.ts:374
2025-12-29T15:46:43.5959809Z    ✖ Then the object replication should "fail" within 500 seconds # steps/replication.ts:66
2025-12-29T15:46:43.5961216Z        AssertionError [ERR_ASSERTION]: Timeout: Object 'source-object-2' is still in pending/processing state after timeout
2025-12-29T15:46:43.5962476Z            at Zenko.<anonymous> (/ctst/steps/replication.ts:115:16)
2025-12-29T15:46:43.5963479Z            at processTicksAndRejections (node:internal/process/task_queues:95:5)
2025-12-29T15:46:43.5964828Z    - When the destination bucket on the location is created again # steps/replication.ts:198
2025-12-29T15:46:43.5966141Z    - And the job to replicate existing objects with status "FAILED" is executed # steps/replication.ts:16
2025-12-29T15:46:43.5967146Z    - Then the object replication should "succeed" within 300 seconds # steps/replication.ts:66
2025-12-29T15:46:43.5967876Z    - And the replicated object should be the same as the source object # steps/replication.ts:118
2025-12-29T15:46:43.5968491Z    ✔ After # common/hooks.ts:63
2025-12-29T15:46:43.5968900Z    ✔ After # hooks/Logger.ts:63
2025-12-29T15:46:43.5969116Z

delthas · 2025-12-30T13:24:11Z

Finally passed after 3 retries.

tests/ctst/steps/notifications.ts

bert-e · 2026-01-07T14:23:17Z

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.

…t it

Signed-off-by: Thomas Flament <[email protected]>

…t it

.github/workflows/end2end.yaml

tests/ctst/features/bucket-notifications/notifications.feature

SylvainSenechal

Might be worth to see what happens with the same test that you added, but unauthenticated.
given a non-authenticated notification
then i should not receive a notifciation

but maybe annoying to setup and not worth it, whatever

tests/ctst/steps/notifications.ts

…t it

francoisferrand · 2026-01-12T07:00:17Z

PR has conflicts (deps.yaml I guess), needs to be rebased...

francoisferrand · 2026-01-12T07:01:44Z

.github/scripts/end2end/configure-e2e-ctst.sh

+ {"op": "replace", "path": "/spec/readOnlyConfig", "value": $config}
+]')
+kubectl patch kafkacluster "$KAFKA_CLUSTER" --type='json' -p="$KAFKA_PATCH"
+kubectl wait --for=jsonpath='{.status.state}'=ClusterRunning --timeout 10m kafkacluster "$KAFKA_CLUSTER"


patching the existing cluster is not safe, as it is "owned" by ZKOP: which should in theory reconcile it back to the expected state... maybe it works due to some "happy" bug in ZKOP which does not notice the discrepency.

should we not just deploy another kafka cluster, to be on the safe side? (and avoid future flakiness...)

francoisferrand · 2026-01-12T07:03:09Z

solution/deps.yaml

 # yq eval 'sortKeys(.)' -i deps.yaml
 backbeat:
-  sourceRegistry: ghcr.io/scality
+  sourceRegistry: ghcr.io/scality/playground/delthas


to be updated before merging

delthas requested a review from Copilot December 24, 2025 10:52

Copilot started reviewing on behalf of delthas December 24, 2025 10:52 View session

Copilot AI reviewed Dec 24, 2025

View reviewed changes

delthas force-pushed the improvement/ZENKO-5106/kafka-sasl-plain branch from 47079c0 to 84be537 Compare December 24, 2025 12:24

scality deleted a comment from bert-e Dec 24, 2025

delthas force-pushed the improvement/ZENKO-5106/kafka-sasl-plain branch 3 times, most recently from 8c5d50f to de82fb9 Compare December 24, 2025 16:33

Copilot AI reviewed Dec 24, 2025

View reviewed changes

delthas force-pushed the improvement/ZENKO-5106/kafka-sasl-plain branch from de82fb9 to f2cb766 Compare December 29, 2025 10:07

delthas added 2 commits December 29, 2025 15:03

Deploy a SASL_PLAIN Kafka listener & test notifications against it

4db9f72

Issue: ZENKO-5106 Signed-off-by: Thomas Flament <[email protected]>

[Do not merge] Build with custom dependency branches

a091dc4

Signed-off-by: Thomas Flament <[email protected]>

delthas force-pushed the improvement/ZENKO-5106/kafka-sasl-plain branch from f2cb766 to a091dc4 Compare December 29, 2025 14:04

delthas requested review from a team, SylvainSenechal and francoisferrand December 30, 2025 13:24

francoisferrand reviewed Jan 6, 2026

View reviewed changes

tests/ctst/steps/notifications.ts Outdated Show resolved Hide resolved

scality deleted a comment from bert-e Jan 7, 2026

delthas added 2 commits January 7, 2026 15:33

fixup! Deploy a SASL_PLAIN Kafka listener & test notifications agains…

22d0a30

…t it

[Do not merge] Clean the yarn cache if corrupted

3d0d560

Signed-off-by: Thomas Flament <[email protected]>

delthas force-pushed the improvement/ZENKO-5106/kafka-sasl-plain branch from f1789f5 to 3d0d560 Compare January 7, 2026 16:20

fixup! Deploy a SASL_PLAIN Kafka listener & test notifications agains…

20a175e

…t it

SylvainSenechal reviewed Jan 7, 2026

View reviewed changes

.github/workflows/end2end.yaml Show resolved Hide resolved

SylvainSenechal reviewed Jan 7, 2026

View reviewed changes

tests/ctst/features/bucket-notifications/notifications.feature Outdated Show resolved Hide resolved

SylvainSenechal approved these changes Jan 7, 2026

View reviewed changes

SylvainSenechal reviewed Jan 7, 2026

View reviewed changes

tests/ctst/steps/notifications.ts Show resolved Hide resolved

fixup! Deploy a SASL_PLAIN Kafka listener & test notifications agains…

f42b9d3

…t it

francoisferrand reviewed Jan 12, 2026

View reviewed changes

Deploy a SASL_PLAIN Kafka listener & test notifications against it #2300

Are you sure you want to change the base?

Deploy a SASL_PLAIN Kafka listener & test notifications against it #2300

Uh oh!

Conversation

delthas commented Dec 24, 2025

Uh oh!

bert-e commented Dec 24, 2025

Hello delthas,

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Dec 24, 2025

Choose a reason for hiding this comment

Uh oh!

francoisferrand Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bert-e commented Dec 24, 2025

Waiting for approval

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

delthas commented Dec 29, 2025

Uh oh!

delthas commented Dec 30, 2025

Uh oh!

Uh oh!

bert-e commented Jan 7, 2026

Request integration branches

Uh oh!

Uh oh!

Uh oh!

SylvainSenechal left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

francoisferrand commented Jan 12, 2026

Uh oh!

francoisferrand Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

francoisferrand Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

francoisferrand Jan 12, 2026 •

edited

Loading

francoisferrand Jan 12, 2026 •

edited

Loading