[ANSIENG-4490] Sample inventories for non RBAC to RBAC migration #1893
+406
−0
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
rrbadiani
reviewed
Feb 6, 2025
| ## You can skip step 1 if you already have a running cluster | ||
| ## steps to run: | ||
| ## 1. setup non rbac (mtls) cluster with "ansible-playbook -i <inv.yml> confluent.platform.all" | ||
| ## 2. Uncomment Section 1 to enable authorization on cluster and run command "ansible-playbook -i <inv.yml> confluent.platform.all --skip-tags package --tags kafka_controller,kafka_broker -e deployment_strategy=rolling" |
There was a problem hiding this comment.
when we do this step in rolling fashion some broker would have authorizer and some would not. Does that work fine without downtime ?
There was a problem hiding this comment.
is it the case that some brokers which dont have authorizer they allow all actions. the ones which have authorizer they also have allow.everyone.if.no.acl.found: "true" and thus they also allow all actions
There was a problem hiding this comment.
yes, because for inter-broker communication we added broker principal in super user and allow.everyone.if.no.acl.found: "true" for other components
rrbadiani
reviewed
Feb 6, 2025
| ansible_python_interpreter: /usr/bin/python3 | ||
|
|
||
| ssl_enabled: true | ||
| ssl_mutual_auth_enabled: true |
There was a problem hiding this comment.
This is deprecated in 7.8 itself. so we can define ssl_client_authentication
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR adds sample inventories to enable rbac in cp-ansible. Sample ACL commands are also added.
Fixes # ANSIENG-4490
Type of change
How Has This Been Tested?
tested locally
Checklist: