[Issue 8338][Function Worker] Splitting the authentication logic of function worker and client

[nodece]

Signed-off-by: Zixuan Liu nodeces@gmail.com

Fixes #8338

Motivation

In some scenarios, users use their own function-worker to connect to an existing pulsar cluster. Their own function-worker and pulsar cluster have different authentication methods, In the following code, when both function-worker and client have enabled the authentication and authorization services, the authentication and authorization can take effect. A better way is to separate them. function-worker can enable and disable the authentication service, and the broker-client can also enable and disable the authentication service according to the configuration.

Modifications

Add a configuration called brokerClientAuthenticationEnabled in the configuration file, which is disabled by default. It is used to control whether the broker-client of function-worker enable or disable the authentication.

Verifying this change

• Make sure that the change passes the CI checks.

[wolfstudy]

@nodece @sijie There is a bit of confusion here. If we want to add the prefix of brokerClient to distinguish the different operations between client and broker_client, do we also need to add the prefix of brokerClient to the following options?

# Enforce authorization on accessing functions api
authorizationEnabled: false
# Set of authentication provider name list, which is a list of class names
authenticationProviders:
# Authorization provider fully qualified class-name
authorizationProvider: org.apache.pulsar.broker.authorization.PulsarAuthorizationProvider

[wolfstudy]

The change LGTM+1, just a little confusion, please check.

[sijie]

@wolfstudy you are right.

[sijie]

@nodece Can you address @wolfstudy 's comments?

[nodece]

@sijie @wolfstudy These configurations already exist in https://github.com/apache/pulsar/pull/8824/files#diff-d834862abe40feef5d85eec66686cd1b378b78cab5f384570da79890ba85c7b2R64-R70. I'm not sure if is correct.

[tuteng]

@nodece You are right.

@nodece @sijie There is a bit of confusion here. If we want to add the prefix of brokerClient to distinguish the different operations between client and broker_client, do we also need to add the prefix of brokerClient to the following options?

# Enforce authorization on accessing functions api
authorizationEnabled: false
# Set of authentication provider name list, which is a list of class names
authenticationProviders:
# Authorization provider fully qualified class-name
authorizationProvider: org.apache.pulsar.broker.authorization.PulsarAuthorizationProvider

This is the authentication and authorization plugin configuration for function-worker, brokerClientAuthenticationPlugin, brokerClientAuthenticationParameters already exist https://github.com/apache/pulsar/blob/master/pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/worker/WorkerConfig.java#L280 to distinguish it from function-worker @wolfstudy

[sijie]

@nodece @tuteng thank you for clarifications!

@nodece great contribution!

[Jennifer88huang-zz]

Confirmed with Penghui, the right logic is to allow users to enable/disable authentication separately. This PR fixes the logic and add description in the code snippet.