KafkaUser with existing public key

[germondc]

Hi

Is it possible to use the user operator to create a KafkaUser using an existing public key?
I tried creating a secret with the key in "user.crt" but the secret got updated when applying the KafkaUser.

Thanks
Clyde

[scholzj]

I guess theoretically if you create the secret with the right content, it would be accepted. But practically I'm not sure it makes sense. The user certificate needs to be signed by the Clients CA and have the right parameters etc. So it would be a lot of effort to make it right and I'm not sure what would you get out of doing it manually instead of using the operator for it.

If you want to issue your own user certificates using your own mechanism, the easier part is to configure Strimzi to use your custom Clients CA and then just disable the User Operator and issue the user certificates your self.

[germondc]

Yes, of course that makes sense. I hadn't thought that it would mean dealing with multiple CAs. We will need to rethink our plan here a little more. Thanks again for the details and clarification.

[rwd5213]

I came across the same thing in our setup. So it is not possible to configure a Kafka cluster to accept client certificates that already exist from public CAs? Such as using lets encrypt for clients that are completely outside of the kubernetes cluster?

[scholzj]

@rwd5213 The User Operator is basically among other things a tool for issuing certificates signed by the Strimzi Clients CA. If you do not want to use certificates signed by the Strimzi Clients CA, you can configure the Kafka cluster to use different CA, but you cannot the User Operator anymore because you decided to use a different CA. You also normally cannot use public CA such as Let's Encrypt for user authentication anyway - it would let anyone with Let's Encrypt certificate successfully authenticate and sign-in => this is normally not what you want from your authentication, you want only the users you created to be able to sign in.

[rwd5213]

That makes sense. I guess I didnt really care who authenticated as long as they had a valid cert (signed by some default trusted CA), because then I would have to add them to the ACLs some how for authorization for them to access the topics anyway. So in general I would have to create the the users, using the controller, extract the secrets then provide those to the clients (external teams/programs etc) so they can embedd them in their clients?

[scholzj]

So in general I would have to create the the users, using the controller, extract the secrets then provide those to the clients (external teams/programs etc) so they can embedd them in their clients?

Well, that is one option, yes. As I said before, you could also just disable and not use the User Operator, provide any CA you want instead of the generated self-signed CA and issue the certificates elsewhere. And for managing the ACLs you can just use the Admin API.