Aiven-Open / Aiven-Open/klaw

Document how to share JAAS configuration accross clusters

Open
#2,491 3 comments 0 reactions 1 assignee Claimed by @muralibasani View on GitHub
Dominant language
Java
Stars
195
Forks
77
Avg merge
8d 9h
Merged PRs (30d)
1

Description

HI,

If I'm interpreting the [documentation](https://www.klaw-project.io/docs/cluster-connectivity-setup/kafka-cluster-sasl-protocol) correctly, the JAAS configuration to talk to a Kafka cluster say using GSSAPI has to be specified in cluster-api's `application.properties` via the key:

```
clusterid.kafkasasl.jaasconfig.gssapi
```

However, I've declared a JAAS configuration like this (sorry, pseudoconfig [Helm/K8s configmap](https://gitlab.cern.ch/nile/klaw/klaw-helm/-/blob/master/klaw-api/templates/cm.yaml?ref_type=heads#L16)):

```yaml
jaas: |
KafkaAdminClient {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
serviceName={{ .Values.auth.serviceName }}
keyTab="{{ .Values.auth.keytabPath }}"
principal="{{ .Values.auth.keytabPrincipal }}";
};
KafkaClient {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
serviceName={{ .Values.auth.serviceName }}
keyTab="{{ .Values.auth.keytabPath }}"
principal="{{ .Values.auth.keytabPrincipal }}";
};
```

that I feed to the cluster-api component via:

```yaml
command: ["java"]
args:
- "-Djava.security.auth.login.config=/config/jaasclient.conf"
- "-jar"
- "klaw-cluster-api.jar"
```

and it seems to work. This is convenient in our case as we share the same conn credentials that Klaw uses to talk to all our clusters.

Would it make sense to add this to the docs? (maybe to the FAQ?) I can submit a MR if you fancy.

Thanks.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.