Skip to content

fix(common): normalize SASL mechanism/bools before validating (lib-streaming parity) #1809

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guimoreirar merged 6 commits into from
Aug 3, 2026
Merged

fix(common): normalize SASL mechanism/bools before validating (lib-streaming parity) #1809

Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
295a0cc
fix(common): normalize SASL mechanism/bools before validating (lib-st…
guimoreirar Aug 2, 2026
680b6cd
fix(common): match strconv.ParseBool exactly for SASL TLS/plaintext b…
guimoreirar Aug 2, 2026
9801c56
fix(common): coerce null SASL overrides + correct ParseBool comment
guimoreirar Aug 2, 2026
6940159
fix(common): normalize SASL mechanism in streaming.secret (ConfigMap …
guimoreirar Aug 3, 2026
ba20139
fix(common): trim SASL username + %v mechanism format in streaming.se…
guimoreirar Aug 3, 2026
6adc674
fix(common): nil-only coercion for SASL mechanism (reject false/0, no…
guimoreirar Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 17 additions & 5 deletions charts/lerian-common/templates/_streaming.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,15 +69,27 @@ global.streaming (all optional except brokers, which gates emission):
via useExistingSecret), so mechanism/username/TLS are validated regardless of the secret
source. When a mechanism is set it must be a supported one, a username is required, and
TLS must be on unless plaintext SASL is explicitly opted into. */ -}}
{{- if $saslMechanism -}}
{{- /* Normalize like lib-streaming does: the mechanism is case-insensitive and
TrimSpace'd, and an all-whitespace value means "no SASL" (disabled). The booleans
follow strconv.ParseBool (case-insensitive true/1/t). Validate on the normalized
values so a valid lowercase/whitespace-padded config is not falsely rejected. */ -}}
{{- $saslMechNorm := upper (trim (toString $saslMechanism)) -}}
{{- if $saslMechNorm -}}
{{- $allowedSasl := list "PLAIN" "SCRAM-SHA-256" "SCRAM-SHA-512" -}}
{{- if not (has $saslMechanism $allowedSasl) -}}
{{- fail (printf "\n[lerian-common] Unsupported STREAMING_SASL_MECHANISM %q — lib-streaming accepts only PLAIN, SCRAM-SHA-256, SCRAM-SHA-512.\n" $saslMechanism) -}}
{{- if not (has $saslMechNorm $allowedSasl) -}}
{{- fail (printf "\n[lerian-common] Unsupported STREAMING_SASL_MECHANISM %q — lib-streaming accepts only PLAIN, SCRAM-SHA-256, SCRAM-SHA-512 (case-insensitive).\n" $saslMechanism) -}}
{{- end -}}
{{- if not $saslUsername -}}
{{- if not (trim (toString $saslUsername)) -}}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
{{- fail (printf "\n[lerian-common] Value required but empty: STREAMING_SASL_USERNAME\n a SASL mechanism (%s) is set, which requires a username (and a password).\n set: configmap.STREAMING_SASL_USERNAME (or global.streaming.saslUsername)\n" $saslMechanism) -}}
{{- end -}}
{{- if not (or (eq (toString $tlsEnabled) "true") (eq (toString $saslAllowPlaintext) "true")) -}}
{{- /* Match strconv.ParseBool EXACTLY (what the runtime's GetenvBoolOrDefault uses): the
true set is 1/t/T/TRUE/true/True with no trimming — anything else (e.g. "TrUe", " true ")
parses as an error and the runtime falls back to false. Using lower()/trim() here would
wrongly accept those and ship a SASL-without-TLS config that crashes at bootstrap. */ -}}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
{{- $parseBoolTrue := list "1" "t" "T" "TRUE" "true" "True" -}}
{{- $tlsOn := has (toString $tlsEnabled) $parseBoolTrue -}}
{{- $plaintextOn := has (toString $saslAllowPlaintext) $parseBoolTrue -}}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
{{- if not (or $tlsOn $plaintextOn) -}}
Comment thread
guimoreirar marked this conversation as resolved.
{{- fail (printf "\n[lerian-common] SASL requires TLS: mechanism %s is set but STREAMING_TLS_ENABLED is not true.\n set: STREAMING_TLS_ENABLED=true (recommended), or opt into plaintext SASL with STREAMING_SASL_ALLOW_PLAINTEXT=true.\n" $saslMechanism) -}}
{{- end -}}
{{- end -}}
Expand Down
Loading