[improve][client] AuthenticationAthenz supports Copper Argos

[massakam]

Motivation

Athenz has a mechanism called Copper Argos. This means that ZTS distributes an X.509 certificate and private key pair to each service, which it can use to identify itself to other services within the organization.
https://github.com/AthenZ/athenz/blob/master/docs/copper_argos.md

However, the current Pulsar's authentication plugin for Athenz cannot accept X.509 certificates as parameters, so we cannot use Copper Argos.

Modifications

Add the parameters x509CertChain and caCert to the AuthenticationAthenz class of the Athenz authentication plugin. If an X.509 certificate is passed as a parameter, it assumes Copper Argos is used and instantiates an SSLContext and creates a ZTSClient based on it. Existing users of this plugin will not be affected by this change.

Verifying this change

• Make sure that the change passes the CI checks.

Documentation

• doc
• doc-required
• doc-not-needed
• doc-complete

[codecov-commenter]

Codecov Report

Merging #19445 (29c19a0) into master (016e7f0) will increase coverage by 39.07%.
The diff coverage is 51.78%.

@@              Coverage Diff              @@
##             master   #19445       +/-   ##
=============================================
+ Coverage     24.75%   63.83%   +39.07%     
- Complexity      288     3475     +3187     
=============================================
  Files          1579     1832      +253     
  Lines        121841   134145    +12304     
  Branches      13304    14760     +1456     
=============================================
+ Hits          30164    85626    +55462     
+ Misses        87240    40775    -46465     
- Partials       4437     7744     +3307     

Flag	Coverage Δ
inttests	24.78% <50.00%> (+0.03%)	⬆️
systests	25.49% <58.33%> (?)
unittests	61.17% <51.78%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
.../pulsar/client/impl/auth/AuthenticationAthenz.java	59.45% <50.00%> (ø)
...va/org/apache/pulsar/broker/service/ServerCnx.java	56.15% <58.33%> (+24.49%)	⬆️
...in/java/org/apache/pulsar/common/api/AuthData.java	71.42% <0.00%> (ø)
.../apache/pulsar/broker/namespace/LookupOptions.java	87.50% <0.00%> (ø)
...apache/pulsar/common/util/SafeCollectionUtils.java	0.00% <0.00%> (ø)
...pache/pulsar/common/configuration/BindAddress.java	22.22% <0.00%> (ø)
...lsar/client/impl/conf/ReaderConfigurationData.java	81.39% <0.00%> (ø)
...r/client/admin/internal/data/AuthPoliciesImpl.java	65.21% <0.00%> (ø)
...sar/common/policies/data/impl/BundlesDataImpl.java	92.30% <0.00%> (ø)
...ar/common/policies/data/InactiveTopicPolicies.java	83.33% <0.00%> (ø)
... and 1400 more

[momo-jun]

Hi @massakam, It will help users a lot if you can add the docs for this improvement. Do you have any planned updates on that?

[massakam]

@momo-jun Yes, I will make a pull-request to the pulsar-site repository later.