Question related to Azure Kubernetes Service, Azure Key Vault, Strimzi and secrets

[gwenael-lebarzic]

Hello.

I am trying to use Strimzi on AKS (Azure Kubernetes Service).

I have an external listener using a certificate for connections from outside the kubernetes cluster, this certificate is signed by my own CA.

I was wondering if it was possible to use Azure Key Vault to store the certificate and directly use it in Strimzi ?

For the moment, I use this configuration in my kafka resource for my listener.

      - authentication:
          type: tls
        configuration:
          bootstrap:
            annotations:
              advertisedHost: broker-bootstrap.mydomain
              advertisedPort: "9093"
          brokerCertChainAndKey:
            certificate: mysignedcert.pem
            key: mykey.pem
            secretName: mysecret
          brokers:
          - advertisedHost: broker-0.mydomain
            advertisedPort: 9093
            broker: 0
          - advertisedHost: broker-1.mydomain
            advertisedPort: 9093
            broker: 1
          - advertisedHost: broker-2.mydomain
            advertisedPort: 9093
            broker: 2
        name: myexternallistener
        port: 9093
        tls: true
        type: cluster-ip

Is it possible to use Azure Key Vault with Strimzi ?

Best regards.

[scholzj]

No. Strimzi currently supports only reading the certificates from Kubernetes Secrets. So you would need to get it from Azure Key Vault to Secret first.

[gwenael-lebarzic]

Hello Jakub.

Thanks for the quick reply !