Moved bridge configuration setup within the operator #11032

ppatierno · 2025-01-14T14:47:03Z

Type of change

Refactoring

Description

This PR fixes #10959 by moving the configuration of the bridge to be generated by the operator within a ConfigMap (actually using the same one that today is used for the metrics and logging configuratio, but with a different entry in the data section) then mounted on the bridge pod and loaded from there.

NOTE: the temporary change in the .azure/templates/steps/system_test_general.yaml file is for using a custom bridge image which doesn't use its script to generate the configuration anymore. Of course the commit to the file will be reverted before merging the PR. It's there for running STs.

Checklist

Write tests
Make sure all tests pass
Try your changes from Pod inside your Kubernetes and OpenShift cluster, not just locally
Reference relevant issue(s) and close them after merging
Update CHANGELOG.md

ppatierno · 2025-01-14T14:47:15Z

This PR comes together with strimzi/strimzi-kafka-bridge#963
I guess the bridge PR should be merged first, and the bridge 0.32.0 released.
After that we can update this PR by setting the new bridge release as well and removing the temporary change in the mentioned azure/templates/steps/system_test_general.yaml to use the right bridge.

see-quick · 2025-01-14T21:19:34Z

/azp run bridge

azure-pipelines · 2025-01-14T21:19:48Z

Azure Pipelines successfully started running 1 pipeline(s).

ppatierno · 2025-01-15T12:56:01Z

/azp run bridge

azure-pipelines · 2025-01-15T12:56:13Z

Azure Pipelines successfully started running 1 pipeline(s).

ppatierno · 2025-01-15T16:42:30Z

/azp run regression

azure-pipelines · 2025-01-15T16:42:41Z

Azure Pipelines successfully started running 1 pipeline(s).

scholzj

i made just a quick pass ... but left bunch of comments.

systemtest/src/test/java/io/strimzi/systemtest/bridge/HttpBridgeST.java

...src/main/java/io/strimzi/operator/cluster/operator/assembly/KafkaBridgeAssemblyOperator.java

...perator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeConfigurationBuilder.java

scholzj · 2025-01-15T20:47:37Z

...perator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeConfigurationBuilder.java

+    private static final String PLACEHOLDER_CERT_STORE_PASSWORD = "${strimzienv:CERTS_STORE_PASSWORD}";
+    private static final String PLACEHOLDER_SASL_USERNAME = "${strimzienv:KAFKA_BRIDGE_SASL_USERNAME}";
+    private static final String PASSWORD_VOLUME_MOUNT = "/opt/strimzi/bridge-password/";
+    // the SASL password file template includes: <volume_mount>/<secret_name>/<password_file>
+    private static final String PLACEHOLDER_SASL_PASSWORD_FILE_TEMPLATE = "${strimzidir:%s%s:%s}";
+    private static final String PLACEHOLDER_OAUTH_CONFIG = "${strimzienv:KAFKA_BRIDGE_OAUTH_CONFIG}";
+    private static final String PLACEHOLDER_OAUTH_ACCESS_TOKEN = "${strimzienv:KAFKA_BRIDGE_OAUTH_ACCESS_TOKEN}";
+    private static final String PLACEHOLDER_OAUTH_REFRESH_TOKEN = "${strimzienv:KAFKA_BRIDGE_OAUTH_REFRESH_TOKEN}";
+    private static final String PLACEHOLDER_OAUTH_CLIENT_SECRET = "${strimzienv:KAFKA_BRIDGE_OAUTH_CLIENT_SECRET}";
+    private static final String PLACEHOLDER_OAUTH_PASSWORD_GRANT_PASSWORD = "${strimzienv:KAFKA_BRIDGE_OAUTH_PASSWORD_GRANT_PASSWORD}";


Do we really need all of these? For example PLACEHOLDER_CERT_STORE_PASSWORD is used multiple times, so I get it. But some of the others seem to be used only once.

But it would mean having string hardcoded where we use it. I would stick with constant here.

Doesn't that just make the code harder to read? You wanna see what the configuration will look like, but you actually have to jump between the definitions instead of having it inlined. As I said, I think it makes sense to have this for those that are used multiple times. For those used just once it seems like a waste of space.

It's not a big issue jumping on a constant definition as weel as today, most of the IDEs shows the value of the constant straight away.

Right, works in your IDE, so whoever else can go f*ck themself. :-D

Just for the sake of fun try to review your own Pr in the GitHub UI and see how the IDE shows the value there.

TBH, I think it is easier to live with the names as long as they are used a few times and not for tens of things used just once. I think they can be easily improved by just making them more descriptive. E.g. PLACEHOLDER_CERT_STORE_PASSWORD could be PLACEHOLDER_CERT_STORE_PASSWORD_CONFIG_PROVIDER_FROM_ENV_VAR or something like that.

I renamed them in the bridge configuration builder. If the names are ok, I will open a separate PR to address the same in the broker configuration builder.

I still don't get this. You haven't given a single reason why having a special variable that is used once adds some value.

Too be honest I don't see it really appealing having some hard coded constants and other declared at the top of the file (just because used in one more place). To be honest I would stick with consistency for them all. Is it really a so big problem? Even reviewing on GitHub with the "search" function it's not that difficult to get the constant value imho. You do that anyway when the constant is used in multiple place and you need to know the value. So from this pov it doesn't make any difference.

Too be honest I don't see it really appealing having some hard coded constants and other declared at the top of the file (just because used in one more place). To be honest I would stick with consistency for them all.

What is the actual benefit of that? What does it make easier? Also, what consistency are you trying to achieve? You have plenty of hardcoded values there:
*PKCS12 is hardcoded

The security protocol strings are hardcoded

SASL mechanisms are hardcoded

Rack ID is hardcoded

Provider class names are hardcoded

The configuration keys for all the options are all hardcoded

So what exactly is the underlying logic that makes this consistent?

Please help me to understand it. Because I feel like I gave a pretty reasonable comment that helps improve the code readability for more than just myself and helps to eliminate any need for searching for things or using IDE to read the code. And I do not really see any downside we will get when we apply it. But instead of explaining the benefits of your solution, you seem to keep telling me to use IDE or search. So if consistency is supposed to be the benefit, what exactly is the pattern you are trying to be consistent with?

Even reviewing on GitHub with the "search" function it's not that difficult to get the constant value imho. You do that anyway when the constant is used in multiple place and you need to know the value. So from this pov it doesn't make any difference.

Yeah, try that for example with the next PR when the constant definition is hidden because nothing around it changed but the use of it has changed. Also, even without that, it still means that you need to search for it instead of just seeing it. So what is the positive value that stands against it to justify it?

...perator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeConfigurationBuilder.java

...tor/src/test/java/io/strimzi/operator/cluster/model/KafkaBridgeConfigurationBuilderTest.java

...perator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeConfigurationBuilder.java

tinaselenge

LGTM, thanks :)

fvaleri

There are a couple of test failures, but the overall approach LGTM.

I also left a minor comment. Thanks.

CHANGELOG.md

scholzj · 2025-01-19T21:13:16Z

...perator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeConfigurationBuilder.java

+    public KafkaBridgeConfigurationBuilder withConfigProviders() {
+        printSectionHeader("Config providers");
+        writer.println("kafka.config.providers=strimzienv,strimzifile,strimzidir");
+        writer.println("kafka.config.providers.strimzienv.class=org.apache.kafka.common.config.provider.EnvVarConfigProvider");
+        writer.println("kafka.config.providers.strimzienv.param.allowlist.pattern=.*");
+        writer.println("kafka.config.providers.strimzifile.class=org.apache.kafka.common.config.provider.FileConfigProvider");
+        writer.println("kafka.config.providers.strimzifile.param.allowed.paths=/opt/strimzi");
+        writer.println("kafka.config.providers.strimzidir.class=org.apache.kafka.common.config.provider.DirectoryConfigProvider");
+        writer.println("kafka.config.providers.strimzidir.param.allowed.paths=/opt/strimzi");
+        writer.println();
+        return this;
+    }


If we don't allow users to configure the providers, it should be mentioned in the release notes as that is potentially backwards incompatible. But maybe we can simply handle it and just add our own as we do for broker?

scholzj · 2025-01-19T21:16:29Z

...perator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeConfigurationBuilder.java

+    private static final String PLACEHOLDER_CERT_STORE_PASSWORD = "${strimzienv:CERTS_STORE_PASSWORD}";
+    private static final String PLACEHOLDER_SASL_USERNAME = "${strimzienv:KAFKA_BRIDGE_SASL_USERNAME}";
+    private static final String PASSWORD_VOLUME_MOUNT = "/opt/strimzi/bridge-password/";
+    // the SASL password file template includes: <volume_mount>/<secret_name>/<password_file>
+    private static final String PLACEHOLDER_SASL_PASSWORD_FILE_TEMPLATE = "${strimzidir:%s%s:%s}";
+    private static final String PLACEHOLDER_OAUTH_CONFIG = "${strimzienv:KAFKA_BRIDGE_OAUTH_CONFIG}";
+    private static final String PLACEHOLDER_OAUTH_ACCESS_TOKEN = "${strimzienv:KAFKA_BRIDGE_OAUTH_ACCESS_TOKEN}";
+    private static final String PLACEHOLDER_OAUTH_REFRESH_TOKEN = "${strimzienv:KAFKA_BRIDGE_OAUTH_REFRESH_TOKEN}";
+    private static final String PLACEHOLDER_OAUTH_CLIENT_SECRET = "${strimzienv:KAFKA_BRIDGE_OAUTH_CLIENT_SECRET}";
+    private static final String PLACEHOLDER_OAUTH_PASSWORD_GRANT_PASSWORD = "${strimzienv:KAFKA_BRIDGE_OAUTH_PASSWORD_GRANT_PASSWORD}";


If you decide to stick with it, you should probably at least better name it to make it more obvious what it is. For example PLACEHOLDER_SASL_PASSWORD_FILE_TEMPLATE is completely unclear if that is file path, env var config provider, file config provider etc.

...src/main/java/io/strimzi/operator/cluster/operator/assembly/KafkaBridgeAssemblyOperator.java

cluster-operator/src/test/java/io/strimzi/operator/cluster/model/KafkaBridgeClusterTest.java

systemtest/src/test/java/io/strimzi/systemtest/bridge/HttpBridgeST.java

cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeCluster.java

...perator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeConfigurationBuilder.java

systemtest/src/test/java/io/strimzi/systemtest/bridge/HttpBridgeST.java

ppatierno · 2025-01-20T18:18:16Z

/azp run regression

azure-pipelines · 2025-01-20T18:18:26Z

Azure Pipelines successfully started running 1 pipeline(s).

...test/java/io/strimzi/operator/cluster/operator/assembly/KafkaBridgeAssemblyOperatorTest.java

scholzj · 2025-01-20T21:57:22Z

.azure/templates/steps/system_test_general.yaml

@@ -145,7 +145,7 @@ jobs:

      env:
        DOCKER_TAG: $(docker_tag)
-        BRIDGE_IMAGE: "latest-released"
+        BRIDGE_IMAGE: "quay.io/ppatierno/kafka-bridge:bridge-config"


We need to address this before merging this.

Yes sure. After I addressed all comments and merged the corresponding bridge PR.

Signed-off-by: Paolo Patierno <[email protected]> Reverted back original operator Deployment Set different bridge image for STs Signed-off-by: Paolo Patierno <[email protected]> Fixed missing env vars to setup the truststore Signed-off-by: Paolo Patierno <[email protected]> Removed ST using env vars not in place anymore Signed-off-by: Paolo Patierno <[email protected]> Fixed checkstyle errors Signed-off-by: Paolo Patierno <[email protected]> CHANGELOG update Signed-off-by: Paolo Patierno <[email protected]> Fixed updated systemtests bridge MD Signed-off-by: Paolo Patierno <[email protected]> Fixed scholzj comments Signed-off-by: Paolo Patierno <[email protected]> Factored out a dedicated withConfigProviders method for the bridge configuration builder Refactored bridge configuration builder to use isEquivalent Signed-off-by: Paolo Patierno <[email protected]> Fixed tinaselenge comments Signed-off-by: Paolo Patierno <[email protected]> Fixed checkstyle issues Signed-off-by: Paolo Patierno <[email protected]> Fixed rolling bridge pod on configuration change Signed-off-by: Paolo Patierno <[email protected]> Fixed scholzj and tinaselenge feedback Signed-off-by: Paolo Patierno <[email protected]> Fixed KafkaBridgeAssemblyOperator tests about the missing new hash annotation Signed-off-by: Paolo Patierno <[email protected]> Reverted back some deleted tests Signed-off-by: Paolo Patierno <[email protected]> Adapted system tests to changes in configuration Signed-off-by: Paolo Patierno <[email protected]> Fixed scholzj and fvaleri feedback Signed-off-by: Paolo Patierno <[email protected]>

Signed-off-by: Paolo Patierno <[email protected]>

ppatierno · 2025-01-21T17:29:34Z

/azp run regression

azure-pipelines · 2025-01-21T17:29:45Z

Azure Pipelines successfully started running 1 pipeline(s).

ppatierno added this to the 0.46.0 milestone Jan 14, 2025

ppatierno mentioned this pull request Jan 14, 2025

Removed the script to generate the configuration strimzi/strimzi-kafka-bridge#963

Open

strimzi deleted a comment from azure-pipelines bot Jan 14, 2025

strimzi deleted a comment from see-quick Jan 15, 2025

strimzi deleted a comment from azure-pipelines bot Jan 15, 2025

ppatierno force-pushed the bridge-config-via-configmap branch from 76c9c35 to d889705 Compare January 15, 2025 16:32

ppatierno marked this pull request as ready for review January 15, 2025 16:42

ppatierno requested a review from scholzj January 15, 2025 16:44

scholzj reviewed Jan 15, 2025

View reviewed changes

tinaselenge reviewed Jan 16, 2025

View reviewed changes

...perator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeConfigurationBuilder.java Outdated Show resolved Hide resolved

scholzj mentioned this pull request Jan 16, 2025

Add proposal for integrating Bridge with Metrics Reporter strimzi/proposals#143

Open

tinaselenge approved these changes Jan 17, 2025

View reviewed changes

fvaleri reviewed Jan 18, 2025

View reviewed changes

CHANGELOG.md Show resolved Hide resolved

scholzj reviewed Jan 19, 2025

View reviewed changes

tinaselenge reviewed Jan 19, 2025

View reviewed changes

cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeCluster.java Show resolved Hide resolved

tinaselenge reviewed Jan 19, 2025

View reviewed changes

cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeCluster.java Outdated Show resolved Hide resolved

tinaselenge reviewed Jan 19, 2025

View reviewed changes

...perator/src/main/java/io/strimzi/operator/cluster/model/KafkaBridgeConfigurationBuilder.java Outdated Show resolved Hide resolved

ppatierno commented Jan 20, 2025

View reviewed changes

systemtest/src/test/java/io/strimzi/systemtest/bridge/HttpBridgeST.java Show resolved Hide resolved

scholzj reviewed Jan 20, 2025

View reviewed changes

ppatierno force-pushed the bridge-config-via-configmap branch from 5dfc74c to 1c964e1 Compare January 21, 2025 13:54

ppatierno force-pushed the bridge-config-via-configmap branch from 1c964e1 to de427e5 Compare January 21, 2025 13:57

Added test to check bridge configuration hash changes

d97c6fc

Signed-off-by: Paolo Patierno <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Moved bridge configuration setup within the operator #11032

Moved bridge configuration setup within the operator #11032

ppatierno commented Jan 14, 2025 •

edited

Loading

ppatierno commented Jan 14, 2025 •

edited

Loading

see-quick commented Jan 14, 2025

azure-pipelines bot commented Jan 14, 2025

ppatierno commented Jan 15, 2025

azure-pipelines bot commented Jan 15, 2025

ppatierno commented Jan 15, 2025

azure-pipelines bot commented Jan 15, 2025

scholzj left a comment

scholzj Jan 15, 2025

ppatierno Jan 16, 2025

scholzj Jan 16, 2025

ppatierno Jan 16, 2025

scholzj Jan 19, 2025 •

edited

Loading

scholzj Jan 20, 2025

ppatierno Jan 20, 2025

scholzj Jan 20, 2025

ppatierno Jan 21, 2025

scholzj Jan 21, 2025

tinaselenge left a comment

fvaleri left a comment

scholzj Jan 19, 2025

scholzj Jan 19, 2025

ppatierno commented Jan 20, 2025

azure-pipelines bot commented Jan 20, 2025

scholzj Jan 20, 2025

ppatierno Jan 21, 2025 •

edited

Loading

ppatierno commented Jan 21, 2025

azure-pipelines bot commented Jan 21, 2025

Moved bridge configuration setup within the operator #11032

Are you sure you want to change the base?

Moved bridge configuration setup within the operator #11032

Conversation

ppatierno commented Jan 14, 2025 • edited Loading

Type of change

Description

Checklist

ppatierno commented Jan 14, 2025 • edited Loading

see-quick commented Jan 14, 2025

azure-pipelines bot commented Jan 14, 2025

ppatierno commented Jan 15, 2025

azure-pipelines bot commented Jan 15, 2025

ppatierno commented Jan 15, 2025

azure-pipelines bot commented Jan 15, 2025

scholzj left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

scholzj Jan 19, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tinaselenge left a comment

Choose a reason for hiding this comment

fvaleri left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ppatierno commented Jan 20, 2025

azure-pipelines bot commented Jan 20, 2025

Choose a reason for hiding this comment

ppatierno Jan 21, 2025 • edited Loading

Choose a reason for hiding this comment

ppatierno commented Jan 21, 2025

azure-pipelines bot commented Jan 21, 2025

ppatierno commented Jan 14, 2025 •

edited

Loading

ppatierno commented Jan 14, 2025 •

edited

Loading

scholzj Jan 19, 2025 •

edited

Loading

ppatierno Jan 21, 2025 •

edited

Loading