Skip to content

Use PEM certificates loaded from secrets for MirrorMaker2 #11531

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

tinaselenge
Copy link
Contributor

@tinaselenge tinaselenge commented Jun 12, 2025

Type of change

Select the type of your PR

  • Refactoring

Description

  • Use TLS certificates in PEM format directly using KubernetesSecretConfigProvider when configuring MM2 connector.
  • Copy source and target's clusters trusted certs secrets into a single internal secret and then use key pattern (*.crt) of KubernetesSecretConfigProvider to load multiple certificates for ssl.truststore.certificates configuration.
  • Remove scripts used for preparing PKCS12 files as no longer need.
  • Remove generation of environment variables used by the scripts that are removed.
  • Remove volumes and volume mounts used for ssl keystore and truststore, as they are now loaded from secrets directly.
  • OAuth truststore is however configured differently, because multiline line certificates in Jaas config is not parsed correctly. Instead it will copy all the trusted certificates in PEM format into an internal secret under a single key and then volume mount it to use for ssl.truststore.location of oauth configuration.

Resolves part of #11294

Checklist

Please go through this checklist and make sure all applicable tasks have been done

  • Write tests
  • Make sure all tests pass
  • Update documentation
  • Check RBAC rights for Kubernetes / OpenShift roles
  • Try your changes from Pod inside your Kubernetes and OpenShift cluster, not just locally
  • Reference relevant issue(s) and close them after merging
  • Update CHANGELOG.md
  • Supply screenshots for visual changes, such as Grafana dashboards

protected String getCommand() {
return "/opt/kafka/kafka_mirror_maker_2_run.sh";
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We no longer this script because this script prepared PKCS files and then ran kafka_connect_run.sh. Since preparation of PKCS files is removed, we just need to run kafka_connect_run.sh set in container config.

@tinaselenge tinaselenge marked this pull request as ready for review June 12, 2025 13:07
Signed-off-by: Gantigmaa Selenge <tina.selenge@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant