From c3dce4683085185ba5bcf0a20b53404466ebccb4 Mon Sep 17 00:00:00 2001 From: Aras Mumcuyan Date: Mon, 30 Oct 2023 11:46:36 +0100 Subject: [PATCH] Add ability to pass auth_data to zk client (#2932) --- docs/ENVIRONMENT.rst | 1 + docs/yaml_configuration.rst | 1 + patroni/config.py | 4 ++-- patroni/dcs/zookeeper.py | 3 ++- patroni/validator.py | 3 ++- 5 files changed, 8 insertions(+), 4 deletions(-) diff --git a/docs/ENVIRONMENT.rst b/docs/ENVIRONMENT.rst index bd928af9f..ad7c46b80 100644 --- a/docs/ENVIRONMENT.rst +++ b/docs/ENVIRONMENT.rst @@ -85,6 +85,7 @@ ZooKeeper - **PATRONI\_ZOOKEEPER\_KEY\_PASSWORD**: (optional) The client key password. - **PATRONI\_ZOOKEEPER\_VERIFY**: (optional) Whether to verify certificate or not. Defaults to ``true``. - **PATRONI\_ZOOKEEPER\_SET\_ACLS**: (optional) If set, configure Kazoo to apply a default ACL to each ZNode that it creates. ACLs will assume 'x509' schema and should be specified as a dictionary with the principal as the key and one or more permissions as a list in the value. Permissions may be one of ``CREATE``, ``READ``, ``WRITE``, ``DELETE`` or ``ADMIN``. For example, ``set_acls: {CN=principal1: [CREATE, READ], CN=principal2: [ALL]}``. +- **PATRONI\_ZOOKEEPER\_AUTH\_DATA**: (optional) Authentication credentials to use for the connection. Should be a dictionary in the form that `scheme` is the key and `credential` is the value. Defaults to empty dictionary. .. note:: It is required to install ``kazoo>=2.6.0`` to support SSL. diff --git a/docs/yaml_configuration.rst b/docs/yaml_configuration.rst index fc313fd0a..a4a33134f 100644 --- a/docs/yaml_configuration.rst +++ b/docs/yaml_configuration.rst @@ -133,6 +133,7 @@ ZooKeeper - **key_password**: (optional) The client key password. - **verify**: (optional) Whether to verify certificate or not. Defaults to ``true``. - **set_acls**: (optional) If set, configure Kazoo to apply a default ACL to each ZNode that it creates. ACLs will assume 'x509' schema and should be specified as a dictionary with the principal as the key and one or more permissions as a list in the value. Permissions may be one of ``CREATE``, ``READ``, ``WRITE``, ``DELETE`` or ``ADMIN``. For example, ``set_acls: {CN=principal1: [CREATE, READ], CN=principal2: [ALL]}``. +- **auth_data**: (optional) Authentication credentials to use for the connection. Should be a dictionary in the form that `scheme` is the key and `credential` is the value. Defaults to empty dictionary. .. note:: It is required to install ``kazoo>=2.6.0`` to support SSL. diff --git a/patroni/config.py b/patroni/config.py index ee0b27105..00dba9d90 100644 --- a/patroni/config.py +++ b/patroni/config.py @@ -791,7 +791,7 @@ def _get_auth(name: str, params: Collection[str] = _AUTH_ALLOWED_PARAMETERS[:2]) 'SERVICE_TAGS', 'NAMESPACE', 'CONTEXT', 'USE_ENDPOINTS', 'SCOPE_LABEL', 'ROLE_LABEL', 'POD_IP', 'PORTS', 'LABELS', 'BYPASS_API_SERVICE', 'RETRIABLE_HTTP_CODES', 'KEY_PASSWORD', 'USE_SSL', 'SET_ACLS', 'GROUP', 'DATABASE', 'LEADER_LABEL_VALUE', 'FOLLOWER_LABEL_VALUE', - 'STANDBY_LEADER_LABEL_VALUE', 'TMP_ROLE_LABEL') and name: + 'STANDBY_LEADER_LABEL_VALUE', 'TMP_ROLE_LABEL', 'AUTH_DATA') and name: value = os.environ.pop(param) if name == 'CITUS': if suffix == 'GROUP': @@ -802,7 +802,7 @@ def _get_auth(name: str, params: Collection[str] = _AUTH_ALLOWED_PARAMETERS[:2]) value = value and parse_int(value) elif suffix in ('HOSTS', 'PORTS', 'CHECKS', 'SERVICE_TAGS', 'RETRIABLE_HTTP_CODES'): value = value and _parse_list(value) - elif suffix in ('LABELS', 'SET_ACLS'): + elif suffix in ('LABELS', 'SET_ACLS', 'AUTH_DATA'): value = _parse_dict(value) elif suffix in ('USE_PROXIES', 'REGISTER_SERVICE', 'USE_ENDPOINTS', 'BYPASS_API_SERVICE', 'VERIFY'): value = parse_bool(value) diff --git a/patroni/dcs/zookeeper.py b/patroni/dcs/zookeeper.py index 3093ba069..3704b579d 100644 --- a/patroni/dcs/zookeeper.py +++ b/patroni/dcs/zookeeper.py @@ -115,7 +115,8 @@ def __init__(self, config: Dict[str, Any]) -> None: self._client = PatroniKazooClient(hosts, handler=PatroniSequentialThreadingHandler(config['retry_timeout']), timeout=config['ttl'], connection_retry=KazooRetry(max_delay=1, max_tries=-1, sleep_func=time.sleep), command_retry=KazooRetry(max_delay=1, max_tries=-1, - deadline=config['retry_timeout'], sleep_func=time.sleep), **kwargs) + deadline=config['retry_timeout'], sleep_func=time.sleep), + auth_data=list(config.get('auth_data', {}).items()), **kwargs) self.__last_member_data: Optional[Dict[str, Any]] = None diff --git a/patroni/validator.py b/patroni/validator.py index 10bc7b2a7..016f4b2e7 100644 --- a/patroni/validator.py +++ b/patroni/validator.py @@ -1042,7 +1042,8 @@ def validate_watchdog_mode(value: Any) -> None: Optional("key"): str, Optional("key_password"): str, Optional("verify"): bool, - Optional("set_acls"): dict + Optional("set_acls"): dict, + Optional("auth_data"): dict, }, "kubernetes": { "labels": {},