feat(security): add kafka secure-mode smoke test and acceptance checklist#42
Conversation
There was a problem hiding this comment.
Pull request overview
Adds an operational “secure-mode validation” gate for Kafka SASL/SSL by introducing an automated smoke-test script and an accompanying acceptance checklist, and wiring both into the existing operations docs.
Changes:
- Added
scripts/kafka-secure-smoke.shto validate container status, secure env vars, and scan recent logs for TLS/SASL failures. - Added
docs/operations/kafka-sasl-ssl-acceptance-checklist.mdto standardize secure-mode rollout acceptance steps/evidence. - Updated ops docs to reference the new checklist and smoke-test command.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| scripts/kafka-secure-smoke.sh | New smoke-test script for secure Kafka rollout validation. |
| docs/operations/README.md | Links the new acceptance checklist in the operations index (EN/ES sections). |
| docs/operations/kafka-sasl-ssl-quickstart.md | Adds the smoke-test command to the quickstart verification step. |
| docs/operations/kafka-sasl-ssl-acceptance-checklist.md | New release/ops checklist for closing secure-mode rollout. |
| status="$(docker compose ps --format json "$svc" | tr -d '\n' | sed 's/}\s*{/}\n{/g' | grep -m1 '"Service":"'"$svc"'"' || true)" | ||
| if [[ -z "$status" ]]; then | ||
| echo " [FAIL] unable to read status: $svc" | ||
| failed=1 | ||
| continue | ||
| fi | ||
|
|
||
| if echo "$status" | grep -q '"State":"running"'; then |
There was a problem hiding this comment.
The container-state detection is parsing docker compose ps --format json output with sed 's/}\s*{/}... where \s is not portable in POSIX/GNU sed (it won’t match whitespace). More importantly, grepping JSON is brittle and can misreport when a service has multiple containers (any "State":"running" match passes). Prefer using the supported Go-template output (e.g., --format '{{.State}}') and explicitly fail if any returned state is not running.
| status="$(docker compose ps --format json "$svc" | tr -d '\n' | sed 's/}\s*{/}\n{/g' | grep -m1 '"Service":"'"$svc"'"' || true)" | |
| if [[ -z "$status" ]]; then | |
| echo " [FAIL] unable to read status: $svc" | |
| failed=1 | |
| continue | |
| fi | |
| if echo "$status" | grep -q '"State":"running"'; then | |
| states="$(docker compose ps --format '{{.State}}' "$svc" || true)" | |
| if [[ -z "$states" ]]; then | |
| echo " [FAIL] unable to read status: $svc" | |
| failed=1 | |
| continue | |
| fi | |
| all_running=1 | |
| while IFS= read -r state; do | |
| if [[ "$state" != "running" ]]; then | |
| all_running=0 | |
| fi | |
| done <<< "$states" | |
| if [[ "$all_running" -eq 1 ]]; then |
| if echo "$combined_logs" | grep -Eiq 'SSLHandshakeException|SaslAuthenticationException|PKIX path building failed|No route to host|Connection refused'; then | ||
| echo " [WARN] suspicious errors detected in recent logs" | ||
| echo " inspect with: docker compose logs --tail=200 kafka kafka-connect backend" | ||
| failed=1 |
There was a problem hiding this comment.
This block prints [WARN] but still sets failed=1, which makes the script exit non-zero. Either treat these matches as [FAIL] (and keep failing), or keep [WARN] but don’t flip failed so operators can distinguish a warning-only run from a hard failure.
| failed=1 |
| - [ ] `.env` contains secure Kafka credentials | ||
| - [ ] TLS artifacts exist under `docker/kafka/secrets/` | ||
| - [ ] Preflight passes: `./scripts/kafka-secure-preflight.sh` |
There was a problem hiding this comment.
The checklist says ".env contains secure Kafka credentials", but the referenced preflight script (./scripts/kafka-secure-preflight.sh) only checks the current process environment and does not source .env. This can confuse operators who rely on .env alone. Consider updating the checklist to explicitly say the vars must be exported in the shell (or that .env must be sourced before running preflight/smoke scripts).
| - [ ] `.env` contains secure Kafka credentials | |
| - [ ] TLS artifacts exist under `docker/kafka/secrets/` | |
| - [ ] Preflight passes: `./scripts/kafka-secure-preflight.sh` | |
| - [ ] Secure Kafka credentials are available as environment variables (exported in the shell or by running `source .env`) | |
| - [ ] TLS artifacts exist under `docker/kafka/secrets/` | |
| - [ ] Preflight passes after env is prepared: `./scripts/kafka-secure-preflight.sh` |
Security Hardening - Phase 7 (secure-mode validation closure)
What was added
scripts/kafka-secure-smoke.shdocs/operations/kafka-sasl-ssl-acceptance-checklist.mdDocs updates
Security impact