Use the Cloud service account for SASL authentication #475
Conversation
✅ Deploy Preview for rp-cloud ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
📝 WalkthroughWalkthroughThis pull request updates Redpanda SASL authentication configuration across four example files and two documentation files in the modules/ai-agents directory. The changes replace credential-based SASL mechanisms (SCRAM-SHA-512 and SCRAM-SHA-256 with username/password fields) with REDPANDA_CLOUD_SERVICE_ACCOUNT across the configuration examples and their corresponding documentation. Additionally, the quickstart documentation is updated to add SASL configuration blocks where they were previously omitted. Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Possibly related PRs
Suggested reviewers
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (2)
modules/ai-agents/examples/redpanda_output_with_processors.yaml (1)
7-7: SASL mechanism change consistent across examples.The change to
REDPANDA_CLOUD_SERVICE_ACCOUNTis consistent with other examples in this PR. Ensure verification from the previous file confirms this mechanism is valid.modules/ai-agents/examples/redpanda_cache.yaml (1)
8-8: SASL mechanism change consistent.This change aligns with the authentication updates across all Redpanda examples in the PR.
🧹 Nitpick comments (1)
modules/ai-agents/pages/mcp/remote/pipeline-patterns.adoc (1)
88-88: Consider adding documentation for the new SASL mechanism.While the configuration example is updated, the documentation doesn't explain what
REDPANDA_CLOUD_SERVICE_ACCOUNTis, how it works, or when to use it versus traditional SASL mechanisms. Consider adding a note or callout explaining:
- What this mechanism does (authenticates using the MCP server's service account)
- When it's available (Redpanda Cloud environments)
- Any prerequisites or limitations
🔎 Example documentation addition
Add after line 88:
+ [NOTE] ==== The `REDPANDA_CLOUD_SERVICE_ACCOUNT` mechanism authenticates using the service account associated with your MCP server. This mechanism is available in Redpanda Cloud and eliminates the need to manage separate SASL credentials for MCP tools. ====
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (5)
modules/ai-agents/examples/redpanda_cache.yaml(1 hunks)modules/ai-agents/examples/redpanda_output.yaml(1 hunks)modules/ai-agents/examples/redpanda_output_with_processors.yaml(1 hunks)modules/ai-agents/pages/mcp/remote/pipeline-patterns.adoc(1 hunks)modules/ai-agents/pages/mcp/remote/quickstart.adoc(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Redirect rules - rp-cloud
- GitHub Check: Header rules - rp-cloud
- GitHub Check: Pages changed - rp-cloud
🔇 Additional comments (3)
modules/ai-agents/pages/mcp/remote/quickstart.adoc (2)
172-180: Clear instructions for SASL configuration update.The added instructions clearly guide users to update the SASL configuration and explain that the mechanism uses the MCP server's service account for authentication. This addresses the gap mentioned in the PR objectives.
249-249: YAML formatting in the API example is correct.The
config_yamlfield produces valid YAML when parsed. The SASL block is properly indented at the same level asseed_brokers,topic, andtls. The SASL mechanismREDPANDA_CLOUD_SERVICE_ACCOUNTis correctly set as a list element.modules/ai-agents/examples/redpanda_output.yaml (1)
10-10:REDPANDA_CLOUD_SERVICE_ACCOUNTis not a documented or officially supported SASL mechanism. Replace it with a standard mechanism (SCRAM-SHA-256, SCRAM-SHA-512, PLAIN, OAUTHBEARER, or GSSAPI) supported by Redpanda, or provide documentation and implementation details if this is a custom authentication mechanism.
|
marking as a draft until this is supported. Current workaround is #476 |
Description
We had some reports that the quickstart didn't mention the need for creating SASL users even though the MCP server creation step includes a service account. This PR updates the docs with the previously undocumented SASL mechanism that automatically uses the MCP server's service account for authentication.
Changes
mechanism: REDPANDA_CLOUD_SERVICE_ACCOUNTinstead of username/password-based SASL authenticationPage previews
Checks