Allow TLS authenticated client to write on new topics
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Fabfur
	Nov 20 2024, 1:59 PM

Description

I'd like to add the following ACLs to the new topics used by haproxykafka:

kafka acls --add --allow-principal User:CN=haproxykafka --producer --topic webrequest_frontend_text
kafka acls --add --allow-principal User:CN=haproxykafka --producer --topic webrequest_frontend_upload
kafka acls --add --allow-principal User:CN=haproxykafka --producer --topic webrequest_errors
kafka acls --add --deny-principal User:ANONYMOUS --operation Write --topic webrequest_frontend_text
kafka acls --add --deny-principal User:ANONYMOUS --operation Write --topic webrequest_frontend_upload
kafka acls --add --deny-principal User:ANONYMOUS --operation Write --topic webrequest_frontend_errors

The CN used in haproxykafka certificate is haproxykafka

Related Objects
Search...

Status	Assigned	Task
Resolved	Fabfur	T351117 Move analytics log from Varnish to HAProxy
Resolved	Fabfur	T370668 New software: haproxykafka
Open	Fabfur	T379776 Enable SSL client authentication on haproxykafka
Resolved	Fabfur	T380373 Allow TLS authenticated client to write on new topics

Event Timeline

Fabfur created this task.Nov 20 2024, 1:59 PM

Just to make sure, that'd be on kafka-jumbo?

In T380373#10343910, @brouberol wrote:

Just to make sure, that'd be on kafka-jumbo?

Yes, haproxykafka will only use kafka-jumbo

+1 from my side!

Mentioned in SAL (#wikimedia-operations) [2024-11-21T17:39:24Z] <fabfur> adding acls to kafka-jumbo cluster (T380373)

Done from kafka-jumbo1009

This triggered errors on every haproxykafka instance after losing producer access to the configured topics:

Nov 21 17:42:40 cp5031 haproxykafka[3825906]: %5|1732210960.009|PARTCNT|cp5031#producer-1| [thrd:ssl://kafka-jumbo1011.eqiad.wmnet:9093/bootstrap]: Topic webrequest_frontend_upload partition count changed from 1 to 0

Nov 21 17:42:34 cp5020 haproxykafka[1002581]: %5|1732210954.345|PARTCNT|cp5020#producer-1| [thrd:ssl://kafka-jumbo1012.eqiad.wmnet:9093/bootstrap]: Topic webrequest_frontend_text partition count changed from 1 to 0

After those events, all produced messages have been rejected.

Currently haproxykafka doesn't perform mTLS authentication so it's effectively operating with User:ANONYMOUS

Vgutierrez mentioned this in T380583: Avoid logging errors per produced message.Nov 22 2024, 12:19 PM

Gehel edited projects, added Data-Platform-SRE (2023.12.01 - 2023.12.31); removed Data-Platform-SRE.Jan 10 2025, 2:27 PM

Gehel edited projects, added Data-Platform-SRE (2024.11.09 - 2024.11.29); removed Data-Platform-SRE (2023.12.01 - 2023.12.31).Jan 10 2025, 3:21 PM

Gehel moved this task from Backlog - project to Reported on the Data-Platform-SRE (2024.11.09 - 2024.11.29) board.Jan 22 2025, 9:47 AM