[
https://issues.apache.org/jira/browse/KAFKA-20325?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101089#comment-18101089
]
Yunseop Eom commented on KAFKA-20325:
-------------------------------------
Update on PR #22941: https://github.com/apache/kafka/pull/22941
The PR detects SSL and SASL_SSL listeners from the security protocol map and
listener configuration, which supports dedicated KRaft controllers that do not
advertise listeners. It adds a Docker regression test for CONTROLLER:SSL.
Validation completed with the regression flow, a dedicated SSL KRaft controller
reaching the started state, bash -n, Python syntax validation, and git diff
--check. The PR is open and awaiting review.
> apache/kafka image - cannot set SSL as protocol for CONTROLLER on dedicated
> controller
> --------------------------------------------------------------------------------------
>
> Key: KAFKA-20325
> URL: https://issues.apache.org/jira/browse/KAFKA-20325
> Project: Kafka
> Issue Type: Improvement
> Components: docker
> Affects Versions: 4.0.0, 4.1.0, 4.2.0
> Reporter: Neil Buesing
> Priority: Minor
>
> The logic to enable SSL for the container is via
> ```
> # Set if ADVERTISED_LISTENERS has SSL:// or SASL_SSL:// endpoints.
> if [[ {-}n "$\{KAFKA_ADVERTISED_LISTENERS{-}}" ]] && [[
> $KAFKA_ADVERTISED_LISTENERS == *"SSL://"* ]]
> then
> echo "SSL is enabled."
> ```
> However, earlier in the script, startup of controller is stopped if
> KAFKA_PROCESS_ROLES=controller
>
> ```
> if [[ {-}n "$\{KAFKA_PROCESS_ROLES{-}}" ]]
> then
> echo "Running in KRaft mode..."
> ensure CLUSTER_ID
> if [[ $KAFKA_PROCESS_ROLES == "controller" ]]
> then
> if [[ {-}n "$\{KAFKA_ADVERTISED_LISTENERS{-}}" ]]
> then
> echo "KAFKA_ADVERTISED_LISTENERS is not supported on a KRaft
> controller."
> exit 1
> else
> # Unset in case env variable is set with empty value
> unset KAFKA_ADVERTISED_LISTENERS
> fi
> fi
> ```
>
> Unless I'm missing something, the only way to set SSL for the controller is
> to fallback to standard property configuration which exposes the passwords
> within the configuration of the image deployment.
> The logic for enabling SSL (and potentially SASL) needs to be checked to not
> be on advertised listeners when it comes to dedicated controllers.
>
>
>
> –
> Probably for a secondary ticket, but would like SASL and SSL to be determined
> if SSL is in the right hand side of the listeners, SSL isn't enabled in a
> scenario like this EXTERNAL:SSL, the LHS must be "EXTERNAL_SSL:SSL" – this
> leads to longer and more error prone configurations, due to
> `KAFKA_LISTENER_NAME_EXTERNAL__SSL_SSL`) but the logic really doesn't need to
> have SSL (or SASL) in the LHS of advertised listeners, it just needs to check
> for it on the RHS.
> ```
> if [[ -n "${KAFKA_ADVERTISED_LISTENERS-}" ]] && [[
> $KAFKA_ADVERTISED_LISTENERS == *"SSL://"* ]]
> ```
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
