[
https://issues.apache.org/jira/browse/KAFKA-21073?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Muralidhar Basani updated KAFKA-21073:
--------------------------------------
Description:
SASL on the GraalVM-based native image (apache/kafka-native) was previously
blocked by two now-resolved issues:
- KAFKA-19584 — SASL/PLAIN failed on the native image because
java.security.AccessController was missing from the native reachability
metadata (fixed via the SecurityManager shim, #22379).
- KAFKA-19583 — OAUTHBEARER failed because the mechanism's
reflectively-instantiated classes (login module, SASL client/server factories,
callback handlers, JWT validator/retriever) were pruned by native-image (fixed
by registering them in reflect-config.json, #23397).
Both are fixed and merged, and java.security.AccessController is now present in
the native reachability metadata. SASL has been verified working end-to-end on
the native image: SASL/PLAIN, and OAUTHBEARER in both the unsecured and secured
(OIDC, JWKS-based validation against a live provider) flows.
However, a related doc and a test are in incorrect state:
1. docker/examples/README.md carries three notes stating "SASL is currently not
supported with the GraalVM based native image … See KAFKA-19584", and the SASL
examples omit the apache/kafka-native run command that the plaintext/SSL
examples provide.
2. docker/test/docker_sanity_test.py skips the SASL flow for the native image
(if self.MODE == "jvm", so the native sanity suite never exercises SASL.
Changes:
- Remove the three stale "SASL not supported on native" notes from
docker/examples/README.md and add the apache/kafka-native run command to each
SASL example, for parity with the other examples.
- Remove the MODE == "jvm" guard in docker_sanity_test.py so the SASL flow
runs for the native image as well as the JVM image.
was:
SASL on the GraalVM-based native image (apache/kafka-native) was previously
blocked by two now-resolved issues:
- KAFKA-19584 — SASL/PLAIN failed on the native image because
java.security.AccessController was missing from the native reachability
metadata (fixed via the SecurityManager shim, #22379).
- KAFKA-19583 — OAUTHBEARER failed because the mechanism's
reflectively-instantiated classes (login module, SASL client/server factories,
callback handlers, JWT validator/retriever) were pruned by native-image (fixed
by registering them in reflect-config.json, #23397).
Both are fixed and merged, and java.security.AccessController is now present in
the native reachability metadata. SASL has been verified working end-to-end on
the native image: SASL/PLAIN, and OAUTHBEARER in both the unsecured and secured
(OIDC, JWKS-based validation against a live provider) flows.
However, a related doc and a test are in incorrect state:
1. docker/examples/README.md carries three notes stating "SASL is currently not
supported with the GraalVM based native image … See KAFKA-19584", and the SASL
examples omit the apache/kafka-native run command that the plaintext/SSL
examples provide.
2. docker/test/docker_sanity_test.py skips the SASL flow for the native image
(if self.MODE == "jvm":), so the native sanity suite never exercises SASL.
Changes:
- Remove the three stale "SASL not supported on native" notes from
docker/examples/README.md and add the apache/kafka-native run command to each
SASL example, for parity with the other examples.
- Remove the MODE == "jvm" guard in docker_sanity_test.py so the SASL flow runs
for the native image as well as the JVM image.
> Enable SASL for the native image docker examples and sanity test
> ----------------------------------------------------------------
>
> Key: KAFKA-21073
> URL: https://issues.apache.org/jira/browse/KAFKA-21073
> Project: Kafka
> Issue Type: Sub-task
> Components: docker
> Reporter: Muralidhar Basani
> Assignee: Muralidhar Basani
> Priority: Minor
>
> SASL on the GraalVM-based native image (apache/kafka-native) was previously
> blocked by two now-resolved issues:
> - KAFKA-19584 — SASL/PLAIN failed on the native image because
> java.security.AccessController was missing from the native reachability
> metadata (fixed via the SecurityManager shim, #22379).
> - KAFKA-19583 — OAUTHBEARER failed because the mechanism's
> reflectively-instantiated classes (login module, SASL client/server
> factories, callback handlers, JWT validator/retriever) were pruned by
> native-image (fixed by registering them in reflect-config.json, #23397).
> Both are fixed and merged, and java.security.AccessController is now present
> in the native reachability metadata. SASL has been verified working
> end-to-end on the native image: SASL/PLAIN, and OAUTHBEARER in both the
> unsecured and secured (OIDC, JWKS-based validation against a live provider)
> flows.
> However, a related doc and a test are in incorrect state:
>
> 1. docker/examples/README.md carries three notes stating "SASL is currently
> not supported with the GraalVM based native image … See KAFKA-19584", and the
> SASL examples omit the apache/kafka-native run command that the plaintext/SSL
> examples provide.
> 2. docker/test/docker_sanity_test.py skips the SASL flow for the native image
> (if self.MODE == "jvm", so the native sanity suite never exercises SASL.
> Changes:
> - Remove the three stale "SASL not supported on native" notes from
> docker/examples/README.md and add the apache/kafka-native run command to each
> SASL example, for parity with the other examples.
> - Remove the MODE == "jvm" guard in docker_sanity_test.py so the SASL flow
> runs for the native image as well as the JVM image.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
