Kazoo auth for ch_keeper and keeper-monitoring

ch_tools/common/config.py

@@ -49,6 +49,8 @@
     },
     "zookeeper": {
         "randomize_hosts": True,
+        "username": None,
+        "password": None,
     },
     "chadmin": {
         "wait": {

ch_tools/monrun_checks_keeper/keeper_commands.py

@@ -7,6 +7,7 @@
 
 from click import command, option, pass_context
 from kazoo.client import KazooClient
+from kazoo.security import make_digest_acl
 
 from ch_tools.common.clickhouse.config import ClickhouseKeeperConfig
 from ch_tools.common.result import CRIT, OK, WARNING, Result
@@ -27,14 +28,28 @@ def alive_command(ctx):
     """Check (Zoo)Keeper service is alive"""
     try:
         keeper_port, use_ssl = get_keeper_port_pair()
-        client = KazooClient(
-            f"127.0.0.1:{keeper_port}",
-            connection_retry=ctx.obj.get("retries"),
-            command_retry=ctx.obj.get("retries"),
-            timeout=ctx.obj.get("timeout"),
-            use_ssl=use_ssl,
-            verify_certs=not ctx.obj.get("no_verify_ssl_certs"),
-        )
+        username = ctx.obj["config"]["zookeeper"]["username"]
+        password = ctx.obj["config"]["zookeeper"]["password"]
+        args = {
+            "hosts": f"127.0.0.1:{keeper_port}",
+            "connection_retry": ctx.obj.get("retries"),
+            "command_retry": ctx.obj.get("retries"),
+            "timeout": ctx.obj.get("timeout"),
+            "use_ssl": use_ssl,
+            "verify_certs": not ctx.obj.get("no_verify_ssl_certs"),
+        }
+        if username is not None and password is not None:
+            auth_data = [
+                (
+                    "digest",
+                    f"{username}:{password}",
+                )
+            ]
+            acls = [make_digest_acl(username, password, all=True)]
+            args["auth_data"] = auth_data
+            args["default_acl"] = acls
+
+        client = KazooClient(**args)
         client.start()
         client.get("/")
         client.create(path="/{0}_alive".format(socket.getfqdn()), ephemeral=True)