Strimzi
ingress kafka-cluster-kafka-bootstrap replace external cert #5571
-
|
hello everyone i have already deploy kafka cluster successfully , Currently i use configuration like picture
2 . I doubt if I can use own cert and it is possible to re deploy kafka each of component such as kafka connector kafka bridge
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 4 replies
-
|
You cannot use ssl-passthrough and ingress certificate at the same time. TLS passthrough means that the connection will be taken as it is and passed to the broker without decrypting it. So it will use the broker certificate. If you disable TLS passthrough and temrinate the TLS connection in the Ingress, you can use your Ingress certificate, but Nginx will figure out that there is not HTTP inside and not route the connection. So if you want to use your own certificate, you have to configure it in the broker - for example as the listener certificate. |
Beta Was this translation helpful? Give feedback.
-
|
because of kafka uses protocol over tpc like document below . Am i correct in thinking that ?
So if you want to use your own certificate, you have to configure it in the broker - for example as the listener certificate. Ans: If i will configuration external cert like picture , It will be working ?
|
Beta Was this translation helpful? Give feedback.
-
|
Yes, you can use this to configure your own certificate for the Ingress listener. |
Beta Was this translation helpful? Give feedback.
-
|
after apply new configuration own ca , i test showcerts and found Verify return code: 21 (unable to verify the first certificate)
========tls.crt ========== [root@jumphost cert]# cat tls.crt ========tls.key ========== [root@jumphost cert]# cat tls.key |
Beta Was this translation helpful? Give feedback.
-
|
Well, that is expected as long as you are not using a certificate signed by a trusted public CA which yours doesn't see to be on a first look. Also, you have configured TLS client authentication => so you will need to provide a user certificate for authentication. |
Beta Was this translation helpful? Give feedback.
You cannot use ssl-passthrough and ingress certificate at the same time. TLS passthrough means that the connection will be taken as it is and passed to the broker without decrypting it. So it will use the broker certificate. If you disable TLS passthrough and temrinate the TLS connection in the Ingress, you can use your Ingress certificate, but Nginx will figure out that there is not HTTP inside and not route the connection.
So if you want to use your own certificate, you have to configure it in the broker - for example as the listener certificate.