mTLS
client certificatesReviewedMerged 24 May 2026#68771rgw/kafka: add mTLS support (extends #61572)
Some Kafka clusters do not use passwords at all. Instead, every client has to present its own certificate as proof of identity. RGW can now do that.
What I did- Reviewed the patch over three weeks with my mentor, asking for changes twice before approving it.
- Tested it on my own machine against a Kafka broker set to require client certificates.
- Suggested how the test should be written. That suggestion was used as-is.
mTLS was on my project list, but my mentor wanted to leave it open for a new contributor rather than have me do it. Someone else wrote the patch and I took the reviewer seat.
The test shape I proposed in review@pytest.mark.kafka_security_test
def test_notification_kafka_security_ssl_mtls():
kafka_security('SSL', use_mtls=True)
Merged into test_bn.py with a use_mtls option added to the shared kafka_security() helper — exactly what I suggested.
Inline comments
9
on the diff
Changes requested
2
before approval
Final approval
✓
24 May 2026
GSSAPI
KerberosWroteMerged 20 Jul 2026#69200rgw/kafka: Adding missing support for GSSAPI bucket notification endpoint and relevant tests for it
Kafka clusters joined to Active Directory require Kerberos. Before this, those setups could not receive bucket notifications at all, because RGW had no way to log in. Now it can, using a keytab and principal set on the topic.
What I did- Added Kerberos login to RGW’s Kafka driver. The service name, principal and keytab are read from the topic settings and passed to librdkafka.
- Made RGW keep a separate Kafka connection per Kerberos identity, so two topics logging in as different users cannot end up sharing one connection.
- Added a cluster setting,
rgw_kafka_sasl_kerberos_service_name, as the default that a topic can override. - Wrote
qa/tasks/kerberos.py, which sets up a working Kerberos server in Ceph’s test system so the tests run against the real thing instead of a stand-in. - Added Valgrind suppressions for the Kerberos libraries, so the memory-checking tests still pass.
OAuthBearer
single sign-onWroteIn review#70100rgw/kafka: Add OAuthbearer support and testing for Kafka bucket notifications
Instead of storing a password, RGW can now ask the organisation’s identity provider — the same system behind single sign-on — for a short-lived token, and use that token to connect to Kafka. Fixes tracker issue #74725.
What I did- Added OAuthBearer login to the Kafka driver and the topic API. The token URL, client ID, secret and optional scope are set on the topic; librdkafka then fetches and renews tokens by itself.
- Treated the client secret like a password: never written to logs, and rejected if it is sent over an unencrypted connection, unless
rgw_allow_notification_secrets_in_cleartext is turned on. - Wrote
qa/tasks/dex.py, which runs a real identity provider (Dex) in Ceph’s test system so the tests use genuinely signed tokens. - Added tests over both encrypted and unencrypted connections.
Fileless CA
no file neededWroteIn review#70771rgw/kafka: Add fileless CA certificate support for Kafka bucket notifications
To check that a Kafka broker is genuine, RGW needs a CA certificate. It used to have to be saved as a file on every RGW machine. On Kubernetes and Rook that certificate lives in a Secret, so writing it to disk was awkward. You can now put the certificate straight into the topic settings.
What I did- Added a
ca-cert topic setting that takes the certificate contents and passes them to librdkafka in memory, with nothing written to disk. ca-cert takes priority over ca-location if both are set, and requires use-ssl=true.- Added tests for the new path alongside the existing file-based one.