[CORE-12961] Add security report admin endpoint

[IoannisRP]

Implemets: CORE-12961

Expose new admin api to report on the security settings of a redpanda node.

Backports Required

• none - not a bug fix
• none - this is a backport
• none - issue does not exist in previous branches
• none - papercut/not impactful enough to backport
• v25.2.x
• v25.1.x
• v24.3.x

Release Notes

Features

• Introduces GET /v1/security/report (Admin API)

[IoannisRP]

/dt

[vbotbuildovich]

Retry command for Build#70421

please wait until all jobs are finished before running the slash command

/ci-repeat 1
tests/rptest/tests/security_report_test.py::RpcTLSSecurityReportTest.test_security_report
tests/rptest/tests/security_report_test.py::AdminSecurityReportTest.test_security_report

[vbotbuildovich]

CI test results

test results on build#70421

test_class	test_method	test_arguments	test_kind	job_url	test_status	passed	reason
FeaturesMultiNodeTest	test_license_upload_and_query	null	integration	https://buildkite.com/redpanda/redpanda/builds/70421#0198868d-32c7-4338-b2f1-48a3e248b359	FLAKY	18/21	upstream reliability is '91.59456118665018'. current run reliability is '85.71428571428571'. drift is 5.88028 and the allowed drift is set to 50. The test should PASS
DataMigrationsApiTest	test_creating_and_listing_migrations	null	integration	https://buildkite.com/redpanda/redpanda/builds/70421#01988690-a6d1-4e30-8252-9df1f3179242	FLAKY	20/21	upstream reliability is '100.0'. current run reliability is '95.23809523809523'. drift is 4.7619 and the allowed drift is set to 50. The test should PASS
DatalakeE2ETests	test_json_schema_unicode	{"catalog_type": "rest_hadoop", "cloud_storage_type": 1, "query_engine": "trino"}	integration	https://buildkite.com/redpanda/redpanda/builds/70421#0198868d-32c4-464a-a0e1-3889eccde55e	FLAKY	20/21	upstream reliability is '98.66962305986696'. current run reliability is '95.23809523809523'. drift is 3.43153 and the allowed drift is set to 50. The test should PASS
AdminSecurityReportTest	test_security_report	null	integration	https://buildkite.com/redpanda/redpanda/builds/70421#0198868d-32c4-464a-a0e1-3889eccde55e	FAIL	0/21	The test has failed across all retries
RpcTLSSecurityReportTest	test_security_report	null	integration	https://buildkite.com/redpanda/redpanda/builds/70421#0198868d-32c3-4150-a766-954b75371441	FAIL	0/21	The test has failed across all retries

test results on build#70461

test_class	test_method	test_arguments	test_kind	job_url	test_status	passed	reason
FeaturesMultiNodeTest	test_license_upload_and_query	null	integration	https://buildkite.com/redpanda/redpanda/builds/70461#01988a0e-d0c2-4ddd-9d2d-08e373b8ff6e	FLAKY	19/21	upstream reliability is '100.0'. current run reliability is '90.47619047619048'. drift is 9.52381 and the allowed drift is set to 50. The test should PASS
AdminSecurityReportTest	test_security_report	null	integration	https://buildkite.com/redpanda/redpanda/builds/70461#01988a0e-d0bf-4de5-9da8-4d931ff765e9	FAIL	0/21	The test has failed across all retries

test results on build#70478

test_class	test_method	test_arguments	test_kind	job_url	test_status	passed	reason
DatalakeDiskUsageTest	test_idle_finish	{"cloud_storage_type": 1, "concurrent_translations": 4, "num_partitions": 10}	integration	https://buildkite.com/redpanda/redpanda/builds/70478#01988ae9-4898-44f5-846d-ac035631825d	FAIL	0/21	The test has failed across all retries
DatalakeDiskUsageTest	test_idle_finish	{"cloud_storage_type": 1, "concurrent_translations": 4, "num_partitions": 40}	integration	https://buildkite.com/redpanda/redpanda/builds/70478#01988ae9-4899-448a-919f-b7a2e6121bce	FAIL	0/21	The test has failed across all retries
MultiTopicAutomaticLeadershipBalancingTest	test_topic_aware_rebalance	null	integration	https://buildkite.com/redpanda/redpanda/builds/70478#01988ae9-4896-4b55-8da1-96f8b92bdb2a	FAIL	0/21	The test has failed across all retries
NodeFolderDeletionTest	test_deleting_node_folder	null	integration	https://buildkite.com/redpanda/redpanda/builds/70478#01988ae9-4899-448a-919f-b7a2e6121bce	FLAKY	7/21	upstream reliability is '93.95348837209302'. current run reliability is '33.33333333333333'. drift is 60.62016 and the allowed drift is set to 50. The test should FAIL
RaftAvailabilityTest	test_leader_transfers_recovery	{"acks": -1}	integration	https://buildkite.com/redpanda/redpanda/builds/70478#01988ae9-489b-47bb-8bd4-983116f6defc	FAIL	0/21	The test has failed across all retries
RaftAvailabilityTest	test_leader_transfers_recovery	{"acks": -1}	integration	https://buildkite.com/redpanda/redpanda/builds/70478#01988aeb-6c6f-44c0-bc6f-a8f94f042539	FAIL	0/21	The test has failed across all retries
SelfTestTest	test_self_test_unknown_test_type	null	integration	https://buildkite.com/redpanda/redpanda/builds/70478#01988ae9-4898-4b04-be55-b7169281bfa1	FAIL	0/21	The test has failed across all retries
SelfTestTest	test_self_test_unknown_test_type	null	integration	https://buildkite.com/redpanda/redpanda/builds/70478#01988aeb-6c6d-4128-a598-556e84385657	FAIL	0/21	The test has failed across all retries
RedpandaUpgradeTest	test_workloads_through_releases	{"cloud_storage_type": 1}	integration	https://buildkite.com/redpanda/redpanda/builds/70478#01988ae9-489b-4473-9b58-aacd0ea65920	FAIL	0/21	The test has failed across all retries
WriteCachingFailureInjectionTest	test_unavoidable_data_loss	null	integration	https://buildkite.com/redpanda/redpanda/builds/70478#01988ae9-4898-44f5-846d-ac035631825d	FLAKY	19/21	upstream reliability is '99.7584541062802'. current run reliability is '90.47619047619048'. drift is 9.28226 and the allowed drift is set to 50. The test should PASS

test results on build#71446

test_class	test_method	test_arguments	test_kind	job_url	test_status	passed	reason
RandomNodeOperationsTest	test_node_operations	{"cloud_storage_type": 1, "compaction_mode": "sliding_window", "enable_failures": true, "mixed_versions": true, "with_iceberg": false}	integration	https://buildkite.com/redpanda/redpanda/builds/71446#0198eb43-916a-4119-95a3-8702b0a098ab	FLAKY	20/21	upstream reliability is '99.51219512195122'. current run reliability is '95.23809523809523'. drift is 4.2741 and the allowed drift is set to 50. The test should PASS

test results on build#71689

test_class	test_method	test_arguments	test_kind	job_url	test_status	passed	reason
Datalake3rdPartyMaintenanceTest	test_e2e_basic	{"catalog_type": "rest_jdbc", "cloud_storage_type": 1, "query_engine": "trino"}	integration	https://buildkite.com/redpanda/redpanda/builds/71689#0199056b-dc44-4172-998c-e4315e18c513	FLAKY	20/21	upstream reliability is '100.0'. current run reliability is '95.23809523809523'. drift is 4.7619 and the allowed drift is set to 50. The test should PASS

test results on build#71780

test_class	test_method	test_arguments	test_kind	job_url	test_status	passed	reason
TxAtomicProduceConsumeTest	test_basic_tx_consumer_transform_produce	{"with_failures": true}	integration	https://buildkite.com/redpanda/redpanda/builds/71780#01991519-3aa6-4d47-82b9-bc15937f68a3	FLAKY	20/21	upstream reliability is '99.7134670487106'. current run reliability is '95.23809523809523'. drift is 4.47537 and the allowed drift is set to 50. The test should PASS

test results on build#71991

test_class	test_method	test_arguments	test_kind	job_url	test_status	passed	reason
RandomNodeOperationsTest	test_node_operations	{"cloud_storage_type": 2, "compaction_mode": "sliding_window", "enable_failures": false, "mixed_versions": true, "with_iceberg": false}	integration	https://buildkite.com/redpanda/redpanda/builds/71991#01993408-f153-418d-9786-4664c84da411	FLAKY	20/21	upstream reliability is '98.8'. current run reliability is '95.23809523809523'. drift is 3.5619 and the allowed drift is set to 50. The test should PASS

[IoannisRP]

changes in force-push:

• add host/port info in rpc
• add name in kafka client

[vbotbuildovich]

Retry command for Build#70461

please wait until all jobs are finished before running the slash command

/ci-repeat 1
tests/rptest/tests/security_report_test.py::AdminSecurityReportTest.test_security_report

[vbotbuildovich]

Retry command for Build#70478

please wait until all jobs are finished before running the slash command

/ci-repeat 1
tests/rptest/tests/self_test_test.py::SelfTestTest.test_self_test_unknown_test_type
tests/rptest/tests/raft_availability_test.py::RaftAvailabilityTest.test_leader_transfers_recovery@{"acks":-1}
tests/rptest/tests/leadership_transfer_test.py::MultiTopicAutomaticLeadershipBalancingTest.test_topic_aware_rebalance
tests/rptest/tests/datalake/disk_budget_test.py::DatalakeDiskUsageTest.test_idle_finish@{"cloud_storage_type":1,"concurrent_translations":4,"num_partitions":10}
tests/rptest/tests/datalake/disk_budget_test.py::DatalakeDiskUsageTest.test_idle_finish@{"cloud_storage_type":1,"concurrent_translations":4,"num_partitions":40}
tests/rptest/tests/node_folder_deletion_test.py::NodeFolderDeletionTest.test_deleting_node_folder
tests/rptest/tests/workload_upgrade_runner_test.py::RedpandaUpgradeTest.test_workloads_through_releases@{"cloud_storage_type":1}

[kbatuigas]

Thanks, no blockers from docs, but would recommend descriptions and/or examples in the Swagger spec for some of the properties (e.g. what is the name in the various _security_report schemas, as well as security_report_alert.description?)

Do you also need specific ACLs so that this endpoint returns security reports for all interfaces?

[IoannisRP]

changes in force-push:

• rebased to dev

[IoannisRP]

changes in force-push:

• move get_authn_method to config/broker_authn_endpoint

[IoannisRP]

@kbatuigas the security report endpoint requires superuser access.

The names are the names of each interface, as defined in the .yaml config.
The security_report_alert.description is a human-readable description of what this alert is.

I will add some descriptions to make it easier to parse the schemas.

[IoannisRP]

changes in force-push:

• add descriptions to the security report jsons

[BenPope]

LGTM

[IoannisRP]

changes in force-push:

• rebase to dev

[IoannisRP]

changes in force-push:

• add field to report sasl mechanisms, when active
• add alert for SASL/PLAIN

[michael-redpanda]

Just some questions/nits but overall this is great

[IoannisRP]

changes in force-push:

• reworked alert wording for more errors to be used with the inteface utility alert function.

[vbotbuildovich]

/backport v25.2.x

[vbotbuildovich]

Failed to create a backport PR to v25.2.x branch. I tried:

git remote add upstream https://github.com/redpanda-data/redpanda.git
git fetch --all
git checkout -b backport-pr-27173-v25.2.x-339 remotes/upstream/v25.2.x
git cherry-pick -x cb0074b5a7 222147588d 35ac3c613b 311da52fc9 461543b1ac fa5bfb8ef9 8cee595f98 e616e11815 221c772684 1a68c6123f

Workflow run logs.