@@ -14,20 +14,21 @@ import (
1414)
1515
1616type sharedOptions struct {
17- brokerAddr string
18- clusterConfig string
19- expandEnv bool
20- saslMechanism string
21- saslPassword string
22- saslUsername string
23- tlsCACert string
24- tlsCert string
25- tlsEnabled bool
26- tlsKey string
27- tlsSkipVerify bool
28- tlsServerName string
29- zkAddr string
30- zkPrefix string
17+ brokerAddr string
18+ clusterConfig string
19+ expandEnv bool
20+ saslMechanism string
21+ saslPassword string
22+ saslUsername string
23+ saslSecretsManagerArn string
24+ tlsCACert string
25+ tlsCert string
26+ tlsEnabled bool
27+ tlsKey string
28+ tlsSkipVerify bool
29+ tlsServerName string
30+ zkAddr string
31+ zkPrefix string
3132}
3233
3334func (s sharedOptions ) validate () error {
@@ -76,7 +77,7 @@ func (s sharedOptions) validate() error {
7677 }
7778
7879 useTLS := s .tlsEnabled || s .tlsCACert != "" || s .tlsCert != "" || s .tlsKey != ""
79- useSASL := s .saslMechanism != "" || s .saslPassword != "" || s .saslUsername != ""
80+ useSASL := s .saslMechanism != "" || s .saslPassword != "" || s .saslUsername != "" || s . saslSecretsManagerArn != ""
8081
8182 if useTLS && s .zkAddr != "" {
8283 log .Warn ("TLS flags are ignored accessing cluster via zookeeper" )
@@ -95,6 +96,10 @@ func (s sharedOptions) validate() error {
9596 (s .saslUsername != "" || s .saslPassword != "" ) {
9697 log .Warn ("Username and password are ignored if using SASL AWS-MSK-IAM" )
9798 }
99+
100+ if s .saslUsername != "" || s .saslPassword != "" && s .saslSecretsManagerArn != "" {
101+ err = multierror .Append (err , errors .New ("Cannot set both sasl-username or sasl-password and sasl-secrets-manager-arn" ))
102+ }
98103 }
99104
100105 return err
@@ -113,9 +118,12 @@ func (s sharedOptions) getAdminClient(
113118 return clusterConfig .NewAdminClient (
114119 ctx ,
115120 sess ,
116- readOnly ,
117- s .saslUsername ,
118- s .saslPassword ,
121+ config.AdminClientOpts {
122+ ReadOnly : readOnly ,
123+ UsernameOverride : s .saslUsername ,
124+ PasswordOverride : s .saslPassword ,
125+ SecretsManagerArnOverride : s .saslSecretsManagerArn ,
126+ },
119127 )
120128 } else if s .brokerAddr != "" {
121129 tlsEnabled := (s .tlsEnabled ||
@@ -150,10 +158,11 @@ func (s sharedOptions) getAdminClient(
150158 SkipVerify : s .tlsSkipVerify ,
151159 },
152160 SASL : admin.SASLConfig {
153- Enabled : saslEnabled ,
154- Mechanism : saslMechanism ,
155- Password : s .saslPassword ,
156- Username : s .saslUsername ,
161+ Enabled : saslEnabled ,
162+ Mechanism : saslMechanism ,
163+ Password : s .saslPassword ,
164+ Username : s .saslUsername ,
165+ SecretsManagerArn : s .saslSecretsManagerArn ,
157166 },
158167 },
159168 ReadOnly : readOnly ,
@@ -211,6 +220,12 @@ func addSharedFlags(cmd *cobra.Command, options *sharedOptions) {
211220 os .Getenv ("TOPICCTL_SASL_USERNAME" ),
212221 "SASL username if using SASL; will override value set in cluster config" ,
213222 )
223+ cmd .PersistentFlags ().StringVar (
224+ & options .saslSecretsManagerArn ,
225+ "sasl-secrets-manager-arn" ,
226+ os .Getenv ("TOPICCTL_SASL_SECRETS_MANAGER_ARN" ),
227+ "Secrets Manager ARN to use for credentials if using SASL; will override value set in cluster config" ,
228+ )
214229 cmd .PersistentFlags ().StringVar (
215230 & options .tlsCACert ,
216231 "tls-ca-cert" ,
0 commit comments