LOG-1725 Summarize Recognized Auth Keys. #1182

alanconway · 2021-09-20T21:53:22Z

Common keys are documented in the Secret section of the CLF Go spec.
Output-specific keys are documented in configuration field for that output.

/hold

Open questions:

is it too late to rename "passphrase" as "tls.key.passphrase"?
- just "passphrase" doensn't tell you what it is a passphrase for...
is it too late to drop "sasl_over_ssl" in favour of "sasl.enable"?
- if not we can maybe keep sasl_over_ssl as a hidden alias of sasl.enable.
- SASL can be used with or without SSL, some sasl mechs do their own encryption.
should output specific keys be listed at the end of the main Secret doc?
- I put them with the output-config field, but I dithered over which to do.

/assign @jcantrill
/cc @periklis
/cc @vimalkum

openshift-ci · 2021-09-20T21:53:25Z

@alanconway: GitHub didn't allow me to request PR reviews from the following users: vimalkum.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

Common keys are documented in the Secret section of the CLF Go spec.
Output-specific keys are documented in configuration field for that output.

/hold

Open questions:

is it too late to rename "passphrase" as "tls.key.passphrase"?

just "passphrase" doensn't tell you what it is a passphrase for...

is it too late to drop "sasl_over_ssl" in favour of "sasl.enable"?

if not we can maybe keep sasl_over_ssl as a hidden alias of sasl.enable.

SASL can be used with or without SSL, some sasl mechs do their own encryption.

should output specific keys be listed at the end of the main Secret doc?

I put them with the output-config field, but I dithered over which to do.

/assign @jcantrill
/cc @periklis
/cc @vimalkum

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alanconway · 2021-09-20T21:54:26Z

/cc @vimalk78

apis/logging/v1/cluster_log_forwarder_types.go

jcantrill · 2021-09-21T20:17:57Z

apis/logging/v1/cluster_log_forwarder_types.go

+	//
+	// Simple Authentication Security Layer (SASL)
+	//
+	//   `sasl.enable`: (boolean) Enable or disable SASL.


Do we need to explicitly "enable" or is it sufficient the presence of something else means it is enabled?

I've clarified the doc:

// `sasl.enable`: (boolean) Explicitly enable or disable SASL. // If missing, SASL is automatically enabled if any of the other `sasl.` keys are set. // `sasl.mechanisms`: (array) List of allowed SASL mechanism names. // If missing or empty, the system defaults are used. // `sasl.allow_insecure`: (boolean) Allow mechanisms that send clear-text passwords. // Default false.

We need sasl.enable because it is common for clients to enable SASL with no other config. There is a default set of mechanims and auto-negotiation with the server so clients often use the defaults and servers are configured to dicate the security policy by only accepting appropriate mechanisms.

jcantrill · 2021-09-21T20:20:14Z

/hold

jcantrill · 2021-09-21T20:21:50Z

is it too late to rename "passphrase" as "tls.key.passphrase"?

We can deprecate the original one, honor both with preference of one over the other

just "passphrase" doensn't tell you what it is a passphrase for...

is it too late to drop "sasl_over_ssl" in favour of "sasl.enable"?

Same here though I don't believe we currently support any SASL features.

if not we can maybe keep sasl_over_ssl as a hidden alias of sasl.enable.

SASL can be used with or without SSL, some sasl mechs do their own encryption.

should output specific keys be listed at the end of the main Secret doc?

periklis

Besides one small nit, looks good to me

periklis · 2021-09-22T07:55:08Z

apis/logging/v1/cluster_log_forwarder_types.go

-	// For client authentication, set secret keys `tls.crt` and `tls.key` to the client certificate and private key.
+	// All sensitive authentication information is provided via a kubernetes Secret object.
+	// A Secret is a key:value map, common keys are described here.
+	// Some outputs support additional pecialized keys, documented with the output-specific configuration field.


pecialized -> specialized?

alanconway · 2021-09-23T14:06:21Z

Updated the doc text, please re-review @jcantrill . I'm writing the backwards-compat code now....

alanconway · 2021-09-23T18:00:50Z

@jcantrill @vimalk78 hopefully final - please look it over.

I didn't change "passphrase", it's already public and we also have "ca-bundle" so we wouldn't have consistent "tls." prefixes anyway. I don't think it's a problem.
I wrote the code to support sasl.enable and sasl_over_ssl for Kafka. Future SASL outputs can stick to the sasl. variables.
I shortened the security. go code, I had to write some wrappers to make deprecation simple, so I simplified some of the other funcs there.

alanconway · 2021-09-23T21:20:18Z

/hold
Wait for merge of #1189
Separate generated file changes.

alanconway · 2021-09-24T18:30:21Z

/hold
Needs rebase after #1189 has merged to remove unrelated generated code changes.

Common keys are documented in the Secret section of the CLF Go spec. apis/logging/v1/cluster_log_forwarder_types.go Output-specific keys are documented in configuration field for that output. apis/logging/v1/output_types.go

alanconway · 2021-09-27T16:05:44Z

/unhold
@jcantrill can I get a final LGTM? All the generated weirdness is gone.

jcantrill

/lgtm

openshift-ci · 2021-09-27T19:07:32Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alanconway, jcantrill

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [alanconway,jcantrill]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

LOG-1725 Summarize Recognized Auth Keys.

openshift-ci bot assigned jcantrill Sep 20, 2021

openshift-ci bot requested a review from periklis September 20, 2021 21:53

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 20, 2021

openshift-ci bot requested a review from vimalk78 September 20, 2021 21:54

alanconway force-pushed the secret-keys branch from ed01937 to b66a78a Compare September 21, 2021 19:41

jcantrill reviewed Sep 21, 2021

View reviewed changes

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 21, 2021

periklis reviewed Sep 22, 2021

View reviewed changes

alanconway force-pushed the secret-keys branch from b66a78a to 500480c Compare September 23, 2021 14:05

alanconway force-pushed the secret-keys branch 3 times, most recently from aadbd61 to 352d1f2 Compare September 23, 2021 17:57

openshift-ci bot added the midstream/Dockerfile A Dockerfile.in sync is needed with midstream label Sep 23, 2021

alanconway force-pushed the secret-keys branch from 352d1f2 to e2e6470 Compare September 23, 2021 21:19

LOG-1725 Summarize Recognized Auth Keys.

7b29d46

Common keys are documented in the Secret section of the CLF Go spec. apis/logging/v1/cluster_log_forwarder_types.go Output-specific keys are documented in configuration field for that output. apis/logging/v1/output_types.go

alanconway force-pushed the secret-keys branch from e2e6470 to 7b29d46 Compare September 27, 2021 16:05

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Sep 27, 2021

jcantrill reviewed Sep 27, 2021

View reviewed changes

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 27, 2021

openshift-merge-robot merged commit 175ab33 into openshift:master Sep 27, 2021

pmoogi-redhat pushed a commit to pmoogi-redhat/cluster-logging-operator that referenced this pull request Apr 26, 2022

Merge pull request openshift#1182 from alanconway/secret-keys

a8d05f4

LOG-1725 Summarize Recognized Auth Keys.

alanconway deleted the secret-keys branch March 30, 2023 13:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

LOG-1725 Summarize Recognized Auth Keys. #1182

LOG-1725 Summarize Recognized Auth Keys. #1182

alanconway commented Sep 20, 2021

openshift-ci bot commented Sep 20, 2021

alanconway commented Sep 20, 2021

jcantrill Sep 21, 2021

alanconway Sep 23, 2021

jcantrill commented Sep 21, 2021

jcantrill commented Sep 21, 2021

periklis left a comment

periklis Sep 22, 2021

alanconway commented Sep 23, 2021

alanconway commented Sep 23, 2021

alanconway commented Sep 23, 2021

alanconway commented Sep 24, 2021

alanconway commented Sep 27, 2021

jcantrill left a comment

openshift-ci bot commented Sep 27, 2021

LOG-1725 Summarize Recognized Auth Keys. #1182

LOG-1725 Summarize Recognized Auth Keys. #1182

Conversation

alanconway commented Sep 20, 2021

openshift-ci bot commented Sep 20, 2021

alanconway commented Sep 20, 2021

jcantrill Sep 21, 2021

Choose a reason for hiding this comment

alanconway Sep 23, 2021

Choose a reason for hiding this comment

jcantrill commented Sep 21, 2021

jcantrill commented Sep 21, 2021

periklis left a comment

Choose a reason for hiding this comment

periklis Sep 22, 2021

Choose a reason for hiding this comment

alanconway commented Sep 23, 2021

alanconway commented Sep 23, 2021

alanconway commented Sep 23, 2021

alanconway commented Sep 24, 2021

alanconway commented Sep 27, 2021

jcantrill left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Sep 27, 2021