Open JakeSCahill opened 10 months ago
kubectl exec redpanda-0 -n redpanda -c redpanda -- rpk cluster config get http_authentication -X user=superuser -X pass=secretpassword
Property 'http_authentication' not found
This is likely due to the helm chart having redpanda v23.2.17, and that config doesn't exist until v23.3.1-rc1
The AuthN failure when installing with admin_api_require_auth=true
is a bit strange, it looks like everything should be set up properly. I managed to use rpk topic create with credentials (which means the user exists), but not able to access the Admin API with the same credentials.
Installing without admin_api_require_auth=true
and then enabling it, also works as expected.
Encountering the same issue with Redpanda 24.1.1, helm chart 5.8.7.
On the values.yaml
, we've set SASL auth enabled with a superuser and also admin_api_require_auth
to be true.
The pods start running, but then we see the following error on the logs:
redpanda-post-upgrade-bcsbz redpanda-post-upgrade No changes were made: Validation errors:
redpanda-post-upgrade-bcsbz redpanda-post-upgrade * admin_api_require_auth: May only be set by a superuser
seems like the post-upgrade
job doesn't have the superuser credentials and so it can't apply the config changes.
Per @JakeSCahill advice, we've currently set our own job to run after the cluster is running and perform the config changes.
Tested in chart 5.9.0 and it's working now
Reopening, can't get this to work on 5.9.1 with the following values.yaml
:
auth:
sasl:
enabled: true
mechanism: SCRAM-SHA-256
users:
- name: admin
password: admin
mechanism: SCRAM-SHA-256
config:
cluster:
admin_api_require_auth: true
What happened?
By default when you set
auth.sasl.enabled=true
, the Schema Registry and HTTP Proxy listeners are configured with basic auth. However, the Admin API is not.You can enable it with
config.cluster.admin_api_require_auth=true
but this currently results in being unable to authenticate to the Admin API, even as a super user.~For 23.3, we will also need to set the cluster property
http_authentication='["BASIC"]'
but the chart doesn't currently seem to support setting that array. @BenPope saysBASIC
should be the default in RP.~ This is now fixed.What did you expect to happen?
You should be able to enable basic auth for the Admin API and authenticate using one of the available superusers.
How can we reproduce it (as minimally and precisely as possible)?. Please include values file.
With
admin_api_require_auth=true
:Cannot authenticate:
Values:
Anything else we need to know?
No response
Which are the affected charts?
No response
Chart Version(s)
Cloud provider
I was using kind
JIRA Link: K8S-72