Repository: k8ssandra/k8ssandra-operator
Pull request #736 (2022-10-21 22:48:20)

Handle auth for DSE clusters
**What this PR does**:
Set the proper configuration options when `spec.cassandra.serverType == dse` and `spec.auth == true`.

**Which issue(s) this PR fixes**:
#744 

**Checklist**
- [x] Changes manually tested
- [x] Automated Tests added/updated
- [ ] Documentation added/updated
- [x] CHANGELOG.md updated (not required for documentation PRs)
- [x] CLA Signed:  [DataStax CLA](https://cla.datastax.com/)


codecov-commenter: # [Codecov](https://codecov.io/gh/k8ssandra/k8ssandra-operator/pull/736?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k8ssandra) Report
> Merging [#736](https://codecov.io/gh/k8ssandra/k8ssandra-operator/pull/736?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k8ssandra) (fb813ec) into [main](https://codecov.io/gh/k8ssandra/k8ssandra-operator/commit/10550735b6f5670a8167d0bd5adc96fad89cadc9?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k8ssandra) (1055073) will **decrease** coverage by `0.04%`.
> The diff coverage is `28.57%`.

[![Impacted file tree graph](https://codecov.io/gh/k8ssandra/k8ssandra-operator/pull/736/graphs/tree.svg?width=650&height=150&src=pr&token=5FJ9A7ZBA1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k8ssandra)](https://codecov.io/gh/k8ssandra/k8ssandra-operator/pull/736?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k8ssandra)

```diff
@@            Coverage Diff             @@
##             main     #736      +/-   ##
==========================================
- Coverage   54.12%   54.07%   -0.05%     
==========================================
  Files          82       82              
  Lines        8361     8371      +10     
==========================================
+ Hits         4525     4527       +2     
- Misses       3384     3390       +6     
- Partials      452      454       +2     
```


| [Impacted Files](https://codecov.io/gh/k8ssandra/k8ssandra-operator/pull/736?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k8ssandra) | Coverage Δ | |
|---|---|---|
| [pkg/cassandra/auth.go](https://codecov.io/gh/k8ssandra/k8ssandra-operator/pull/736/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k8ssandra#diff-cGtnL2Nhc3NhbmRyYS9hdXRoLmdv) | `12.08% <28.57%> (-0.26%)` | :arrow_down: |
| [controllers/config/clientconfig\_controller.go](https://codecov.io/gh/k8ssandra/k8ssandra-operator/pull/736/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=k8ssandra#diff-Y29udHJvbGxlcnMvY29uZmlnL2NsaWVudGNvbmZpZ19jb250cm9sbGVyLmdv) | `82.17% <0.00%> (+0.77%)` | :arrow_up: |


Patch:
diff --git a/CHANGELOG/CHANGELOG-1.4.md b/CHANGELOG/CHANGELOG-1.4.md
index 3f25296e..33e7929e 100644
--- a/CHANGELOG/CHANGELOG-1.4.md
+++ b/CHANGELOG/CHANGELOG-1.4.md
@@ -21,6 +21,7 @@ When cutting a new release, update the `unreleased` heading to the tag being gen
 * [FEATURE] [#728](https://github.com/k8ssandra/k8ssandra-operator/issues/728) Add token generation utility
 * [FEATURE] [#724](https://github.com/k8ssandra/k8ssandra-operator/issues/724) Ability to provide per-node configuration
 * [FEATURE] [#718](https://github.com/k8ssandra/k8ssandra-operator/issues/718) Make keystore-password, keystore, truststore keys in secret configurable
+* [BUGFIX] [#744](https://github.com/k8ssandra/k8ssandra-operator/issues/744) Handle auth for DSE clusters
 * [BUGFIX] [#722](https://github.com/k8ssandra/k8ssandra-operator/issues/722) Enable client-side CQL encryption in Stargate if it is configured on the cluster
 * [BUGFIX] [#714](https://github.com/k8ssandra/k8ssandra-operator/issues/714) Don't restart whole Cassandra 4 DC when Stargate is added or removed
 * [BUGFIX] [#758](https://github.com/k8ssandra/k8ssandra-operator/issues/758) Remove -jdk8 suffix for DSE images
diff --git a/pkg/cassandra/auth.go b/pkg/cassandra/auth.go
index 36c2cceb..ce610dae 100644
--- a/pkg/cassandra/auth.go
+++ b/pkg/cassandra/auth.go
@@ -19,7 +19,7 @@ func ApplyAuth(dcConfig *DatacenterConfig, authEnabled bool) error {
 		return errors.New("PodTemplateSpec was nil, cannot add auth settings")
 	}
 
-	dcConfig.CassandraConfig = ApplyAuthSettings(dcConfig.CassandraConfig, authEnabled)
+	dcConfig.CassandraConfig = ApplyAuthSettings(dcConfig.CassandraConfig, authEnabled, dcConfig.ServerType)
 
 	// By default, the Cassandra process will be started with LOCAL_JMX=yes, see cassandra-env.sh. This means that the
 	// Cassandra process will only be accessible with JMX from localhost. This is the safest and preferred setup: you
@@ -82,10 +82,20 @@ func ApplyAuth(dcConfig *DatacenterConfig, authEnabled bool) error {
 
 // ApplyAuthSettings modifies the given config and applies defaults for authenticator, authorizer and role manager,
 // depending on whether auth is enabled or not, and only if these settings are empty in the input config.
-func ApplyAuthSettings(config api.CassandraConfig, authEnabled bool) api.CassandraConfig {
+func ApplyAuthSettings(config api.CassandraConfig, authEnabled bool, serverType api.ServerDistribution) api.CassandraConfig {
 	if authEnabled {
-		config.CassandraYaml.PutIfAbsent("authenticator", "PasswordAuthenticator")
-		config.CassandraYaml.PutIfAbsent("authorizer", "CassandraAuthorizer")
+		if serverType == api.ServerDistributionDse {
+			config.CassandraYaml.PutIfAbsent("authenticator", "com.datastax.bdp.cassandra.auth.DseAuthenticator")
+			config.CassandraYaml.PutIfAbsent("authorizer", "com.datastax.bdp.cassandra.auth.DseAuthorizer")
+			config.CassandraYaml.PutIfAbsent("role_manager", "com.datastax.bdp.cassandra.auth.DseRoleManager")
+
+			config.DseYaml.PutIfAbsent("authentication_options/enabled", "true")
+			config.DseYaml.PutIfAbsent("authorization_options/enabled", "true")
+			config.DseYaml.PutIfAbsent("role_management_options/mode", "internal")
+		} else {
+			config.CassandraYaml.PutIfAbsent("authenticator", "PasswordAuthenticator")
+			config.CassandraYaml.PutIfAbsent("authorizer", "CassandraAuthorizer")
+		}
 	} else {
 		config.CassandraYaml.PutIfAbsent("authenticator", "AllowAllAuthenticator")
 		config.CassandraYaml.PutIfAbsent("authorizer", "AllowAllAuthorizer")


Test patch:
diff --git a/pkg/cassandra/auth_test.go b/pkg/cassandra/auth_test.go
index cf497f3b..c3cf9bff 100644
--- a/pkg/cassandra/auth_test.go
+++ b/pkg/cassandra/auth_test.go
@@ -77,7 +77,7 @@ func TestApplyAuthSettings(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			actual := ApplyAuthSettings(tt.input, tt.authEnabled)
+			actual := ApplyAuthSettings(tt.input, tt.authEnabled, k8ssandraapi.ServerDistributionCassandra)
 			assert.Equal(t, tt.want, actual)
 		})
 	}
diff --git a/test/e2e/dse_test.go b/test/e2e/dse_test.go
index 600d4649..0a4ee278 100644
--- a/test/e2e/dse_test.go
+++ b/test/e2e/dse_test.go
@@ -52,6 +52,10 @@ func createSingleDseDatacenterCluster(t *testing.T, ctx context.Context, namespa
 		"SELECT server_id FROM system.local")
 	require.NoError(t, err, "failed to execute CQL query against DSE")
 	assert.Contains(t, output, "modified", "expected server_id to be modified")
+
+	output, err = f.ExecuteCqlNoAuth(f.DataPlaneContexts[0], namespace, DcPrefix(t, f, dcKey)+"-default-sts-0",
+		"SELECT server_id FROM system.local")
+	require.Error(t, err, "expected CQL query without auth to fail")
 }
 
 // createSingleDseSearchDatacenterCluster creates a K8ssandraCluster with one CassandraDatacenter running with search enabled
diff --git a/test/framework/cqlsh.go b/test/framework/cqlsh.go
index 45ad4fcc..81d2670c 100644
--- a/test/framework/cqlsh.go
+++ b/test/framework/cqlsh.go
@@ -50,3 +50,12 @@ func (f *E2eFramework) ExecuteCql(ctx context.Context, k8sContext, namespace, cl
 		query,
 	)
 }
+
+func (f *E2eFramework) ExecuteCqlNoAuth(k8sContext, namespace, pod, query string) (string, error) {
+	options := kubectl.Options{Context: k8sContext, Namespace: namespace}
+	return kubectl.Exec(options, pod,
+		f.cqlshBin,
+		"-e",
+		query,
+	)
+}
diff --git a/test/testdata/fixtures/single-dc-dse/k8ssandra.yaml b/test/testdata/fixtures/single-dc-dse/k8ssandra.yaml
index 25c87931..6897a933 100644
--- a/test/testdata/fixtures/single-dc-dse/k8ssandra.yaml
+++ b/test/testdata/fixtures/single-dc-dse/k8ssandra.yaml
@@ -3,6 +3,7 @@ kind: K8ssandraCluster
 metadata:
   name: test
 spec:
+  auth: true
   cassandra:
     serverVersion: 6.8.26
     serverType: dse
@@ -25,15 +26,7 @@ spec:
               requests:
                 storage: 5Gi
         config:
-          cassandraYaml:
-            authenticator: com.datastax.bdp.cassandra.auth.DseAuthenticator
-            authorizer: com.datastax.bdp.cassandra.auth.DseAuthorizer
-            role_manager: com.datastax.bdp.cassandra.auth.DseRoleManager
           dseYaml:
-            authentication_options:
-              enabled: true
-            authorization_options:
-              enabled: true
             server_id: server-id
           jvmOptions:
             heap_initial_size: 512Mi