confluentinc / cp-ansible

Ansible playbooks for the Confluent Platform
Apache License 2.0
42 stars 405 forks source link

Change get token behaviour to use certs only in when component is in cert auth only mode #1820

Closed rrbadiani closed 2 weeks ago

rrbadiani commented 2 weeks ago

Description

There were 3 ways to get token oauth creds, ldap creds, certs only.

The conditions used to decide the method to Get token before this PR ->

if oauth is enabled we use oauth creds else if auth_mode is mtls then use certs to get a token else use ldap credentials

Now after this PR the logic to pick this method of getting a token will be

if oauth and not cert_auth_only then use oauth credentials else if auth_mode mtls or cert auth only then use certs else use ldap credentials

Fixes # (issue)

Type of change

How Has This Been Tested?

kraft zk

Checklist:

confluent-cla-assistant[bot] commented 2 weeks ago

:tada: All Contributor License Agreements have been signed. Ready to merge.
Please push an empty commit if you would like to re-run the checks to verify CLA status for all contributors.

mansisinha commented 2 weeks ago

Where are the kafka_connect_mds_cert_auth_only and similar variables defined for other cp components?

rrbadiani commented 2 weeks ago

kafka_connect_mds_cert_auth_only

they are already in 7.8.x code. this Pr is to use those variables to decide how we get the token. in the Earlier Pr they were used to skip defining the ldap client credentials on components but continued to use them in fetch the token.