Aiven-Open / Aiven-Open/klaw

Document how to share JAAS configuration accross clusters

未关闭
#2,491 3 条评论 0 个 reaction 已指派 1 人 已被 @muralibasani 认领 在 GitHub 查看
主要语言
Java
星标
195
派生
77
平均合并
8 天 9 小时
30 天内合并 PR
1

描述

HI,

If I'm interpreting the [documentation](https://www.klaw-project.io/docs/cluster-connectivity-setup/kafka-cluster-sasl-protocol) correctly, the JAAS configuration to talk to a Kafka cluster say using GSSAPI has to be specified in cluster-api's `application.properties` via the key:

```
clusterid.kafkasasl.jaasconfig.gssapi
```

However, I've declared a JAAS configuration like this (sorry, pseudoconfig [Helm/K8s configmap](https://gitlab.cern.ch/nile/klaw/klaw-helm/-/blob/master/klaw-api/templates/cm.yaml?ref_type=heads#L16)):

```yaml
jaas: |
KafkaAdminClient {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
serviceName={{ .Values.auth.serviceName }}
keyTab="{{ .Values.auth.keytabPath }}"
principal="{{ .Values.auth.keytabPrincipal }}";
};
KafkaClient {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
storeKey=true
serviceName={{ .Values.auth.serviceName }}
keyTab="{{ .Values.auth.keytabPath }}"
principal="{{ .Values.auth.keytabPrincipal }}";
};
```

that I feed to the cluster-api component via:

```yaml
command: ["java"]
args:
- "-Djava.security.auth.login.config=/config/jaasclient.conf"
- "-jar"
- "klaw-cluster-api.jar"
```

and it seems to work. This is convenient in our case as we share the same conn credentials that Klaw uses to talk to all our clusters.

Would it make sense to add this to the docs? (maybe to the FAQ?) I can submit a MR if you fancy.

Thanks.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。