Hi all, I wanted to check and verify if there is any interest and animo to adopt this feature request: https://issues.apache.org/jira/browse/KAFKA-14340
Istio and other *SPIFFE* based systems use X509 Client Certificates to provide workload ID. Kafka currently does support Client Cert based AuthN/Z and mapping to ACL, but only so be inspecting the CN field within a Client Certificate. There are several POC implementations out there implementing a bespoke *KafkaPrincipalBuilder* implementation for this purpose. Two examples include - https://github.com/traiana/kafka-spiffe-principal - https://github.com/boeboe/kafka-istio-principal-builder (written by myself) The gist is to introspect X509 based client certificates, look for a URI based SPIFFE entry in the SAN extension and return that as a principle, that can be used to write ACL rules. This KIP request is to include this functionality into Kafka's main functionality so end-users don't need to load custom and non-vetted java classes/implementations. The main use case for me is having a lot of Istio customers that express the will to be able to leverage SPIFFE based IDs for their Kafka ACL Authorization. This eliminates the need for sidecars on the broker side or custom *EnvoyFilters* and other less optimal implementations to integrate Kafka into an Istio secured Kubernetes environment. I believe this would make for a better integration between the Istio/SPIFFE and Kafka ecosystems. PS: I can use some advice on the provided implementation as well, because I do not have kafka experience in terms of committing or contributing code. Best regards, *Bart Van Bos* *SW & ICT Engineering - AllBits BVBA* Mobile: +32 485 630 628 E-mail: bartvan...@gmail.com BTW: BE.0678.829.457 IBAN: BE23 9731 7830 1491 Address: Lobroeken 25, 3191 Hever
