Skip to content

Use PEM certificates loaded from secrets for KafkaBridge #11549

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

tinaselenge
Copy link
Contributor

Type of change

Select the type of your PR

  • Refactoring

Description

  • TLS certificates are loaded from secrets directly using KubernetesSecretConfigProvider, therefore also removes the population of the certificate related environment variables and the script for preparing TLS.
  • Use key pattern (*.crt) of KubernetesSecretConfigProvider to load multiple certificates from a single secret for ssl.truststore.certificates configuration.
  • OAuth truststore is however configured differently, because multiline line certificates in Jaas config is not parsed correctly. Instead it will copy all the trusted certificates in PEM format into an internal secret under a single key and then volume mount it to use for ssl.truststore.location of oauth configuration.
  • Add RBAC right for reading secrets for KafkaBridge service account.

(There will be a follow up PR in bridge repository to remove the script for preparing PKCS12 certificates once this PR is merged.)

Resolves part of #11294

Checklist

Please go through this checklist and make sure all applicable tasks have been done

  • Write tests
  • Make sure all tests pass
  • Update documentation
  • Check RBAC rights for Kubernetes / OpenShift roles
  • Try your changes from Pod inside your Kubernetes and OpenShift cluster, not just locally
  • Reference relevant issue(s) and close them after merging
  • Update CHANGELOG.md
  • Supply screenshots for visual changes, such as Grafana dashboards

Signed-off-by: Gantigmaa Selenge <tina.selenge@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant