search

shotover / shotover-proxy

L7 data-layer proxy
https://docs.shotover.io
Apache License 2.0
82 stars 16 forks source link

KafkaSinkCluster scram_over_mtls - improve token handling #1667

Closed rukai closed 1 week ago

rukai commented 1 month ago

prereq: https://github.com/shotover/shotover-proxy/issues/1656

In two separate PRs implement the following:

  1. Dont cache the delegation token within the KafkaSinkCluster instance. Instead refetch from the token task every time its needed. https://github.com/shotover/shotover-proxy/pull/1683
    • This ensures we dont use tokens that the task has already replaced, and is important for the next step.
    • This will look like removing the delegation_token field from AuthorizeScramOverMtls and then resolving the compiler issues by fetching the token from the task when its needed.
  2. Invalidate expired tokens, we should immediately expire a token that has been replaced. (This is not possible at the moment as Kafka doesn't allow users to expire delegation tokens for other users. See more details in https://github.com/shotover/shotover-proxy/pull/1685. Instead we added a comment into the code regarding this in https://github.com/shotover/shotover-proxy/pull/1686)
    • This will improve security and keep the list of tokens on the brokers clean which is useful if we ever need to manually revoke tokens.