stackabletech / stackabletech/kafka-operator
Support custom TLS principals
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 28
- Forks
- 8
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 9
Description
A vanilla Kafka installation will use the TLS certificate's Distinguished Name (DN) as the principal, which is then used for authorization (see https://kafka.apache.org/documentation/#security_authz_ssl). This isn't great for us, since the Secret Operator will currently always hard-code this to "CN=generated certificate for pod".
We could implement a custom https://kafka.apache.org/28/javadoc/org/apache/kafka/common/security/auth/KafkaPrincipalBuilder.html to do whatever mapping we want.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading Kafka's KafkaPrincipalBuilder documentation and tracing how the Secret Operator currently sets the certificate principal. Define the desired DN-to-principal mapping and verify that the resulting principal is used correctly for authorization; the issue does not name a file or test to run.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, rust
- Domain
- distributed-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100