CAS integration

[sreejesh123]

hi, has anyone integrated Strmzi to work with CAS as Cert authority? and use certmanager to automate the cert rotation?

[scholzj]

What is CAS?

[sreejesh123]

as part of Google cas integration - we were provided with ca.cert, tls.cert and tls.key. just to confirm when we replace the secret we replace with ca.cert? any idea where does tls.cert and tls.key should be provided? or its not needed for strmzi to work?

[sreejesh123]

Reason for asking being when I use tls.cert the ZK do not start with error " NO CA" (similar to issue in this - #4004)

using ca.cert - operator show RECONCILE java runtime error while trying to deploy cluster -

java.lang.RuntimeException: openssl status code 1 at io.strimzi.certs.OpenSslCertManager$OpensslArgs.exec(OpenSslCertManager.java:601) ~[io.strimzi.certificate-manager-0.25.0.jar:0.25.0] at io.strimzi.certs.OpenSslCertManager$OpensslArgs.exec(OpenSslCertManager.java:559) ~[io.strimzi.certificate-manager-0.25.0.jar:0.25.0]

checking the cert in website report-uri.com (not sure if its of any help) but

ca.cert -
Basic Constraints: CA:TRUE

and tls.cert
Basic Constraints: CA:FALSE

[scholzj]

as part of Google cas integration - we were provided with ca.cert, tls.cert and tls.key. just to confirm when we replace the secret we replace with ca.cert? any idea where does tls.cert and tls.key should be provided? or its not needed for strmzi to work?

I don't really know the Google service. So I'm afraid I can give you only guesses and assumptions. But this seems to correspond to what I suggested earlier. The three files sound like you got a certificate (tls.crt and tls.key) signed by the CA (ca.crt) which is provided so that you have a full chain. Ig the signed certificate would have the CA:TRUE, you could use it as intermediate CA. But if it doesn't, it is most probably just a server certificate which you can use for example as a listener certificate but not as a Cluster CA certificate.

The ca.crt could be also used as the Clients CA => if you use the tls-external mechanisms in KafkaUser resources. Then you do not have the User Operator issue the user certs but you use the Google service. But not for the Cluster CA.

[sreejesh123]

Corresponding to the example repo- we are having only - https://github.com/scholzj/strimzi-custom-ca-test/blob/master/build.sh#L15

ca.pem has been verified and the cert is valid.

I am sure we are setting the correct ca.cert to secret. But getting this error on Operator. Any help please?

2021-10-29T16:17:09.212385026Zjava.lang.RuntimeException: openssl status code 1 at io.strimzi.certs.OpenSslCertManager$OpensslArgs.exec(OpenSslCertManager.java:601) ~[io.strimzi.certificate-manager-0.25.0.jar:0.25.0] at io.strimzi.certs.OpenSslCertManager$OpensslArgs.exec(OpenSslCertManager.java:559) ~[io.strimzi.certificate-manager-0.25.0.jar:0.25.0] at io.strimzi.certs.OpenSslCertManager.addKeyAndCertToKeyStore(OpenSslCertManager.java:356) ~[io.strimzi.certificate-manager-0.25.0.jar:0.25.0] at io.strimzi.operator.cluster.model.Ca.generateSignedCert(Ca.java:289) ~[io.strimzi.operator-common-0.25.0.jar:0.25.0] at io.strimzi.operator.cluster.model.Ca.generateSignedCert(Ca.java:332) ~[io.strimzi.operator-common-0.25.0.jar:0.25.0] at io.strimzi.operator.cluster.model.ModelUtils.buildSecret(ModelUtils.java:152) ~[io.strimzi.cluster-operator-0.25.0.jar:0.25.0] at io.strimzi.operator.cluster.operator.assembly.KafkaAssemblyOperator$ReconciliationState.clusterOperatorSecret(KafkaAssemblyOperator.java:3579) ~[io.strimzi.cluster-operator-0.25.0.jar:0.25.0] at io.strimzi.operator.cluster.operator.assembly.KafkaAssemblyOperator.lambda$reconcile$2(KafkaAssemblyOperator.java:263) ~[io.strimzi.cluster-operator-0.25.0.jar:0.25.0] at io.vertx.core.impl.future.Composition.onSuccess(Composition.java:38) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:62) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureImpl.tryComplete(FutureImpl.java:179) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.Composition$1.onSuccess(Composition.java:62) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:62) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureImpl.tryComplete(FutureImpl.java:179) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.PromiseImpl.tryComplete(PromiseImpl.java:23) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.PromiseImpl.onSuccess(PromiseImpl.java:49) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:62) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureImpl.tryComplete(FutureImpl.java:179) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.PromiseImpl.tryComplete(PromiseImpl.java:23) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.Promise.complete(Promise.java:66) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.strimzi.operator.cluster.operator.assembly.KafkaAssemblyOperator$ReconciliationState.lambda$reconcileCas$5(KafkaAssemblyOperator.java:678) ~[io.strimzi.cluster-operator-0.25.0.jar:0.25.0] at io.vertx.core.impl.future.FutureImpl$3.onSuccess(FutureImpl.java:124) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:62) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureImpl.tryComplete(FutureImpl.java:179) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.CompositeFutureImpl.complete(CompositeFutureImpl.java:172) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.CompositeFutureImpl.lambda$join$3(CompositeFutureImpl.java:109) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureImpl$3.onSuccess(FutureImpl.java:124) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:62) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureImpl.tryComplete(FutureImpl.java:179) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.Composition$1.onSuccess(Composition.java:62) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureBase.emitSuccess(FutureBase.java:62) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureImpl.tryComplete(FutureImpl.java:179) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.PromiseImpl.tryComplete(PromiseImpl.java:23) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.PromiseImpl.onSuccess(PromiseImpl.java:49) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.vertx.core.impl.future.FutureBase.lambda$emitSuccess$0(FutureBase.java:54) ~[io.vertx.vertx-core-4.1.2.jar:4.1.2] at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:164) [io.netty.netty-common-4.1.66.Final.jar:4.1.66.Final] at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:469) [io.netty.netty-common-4.1.66.Final.jar:4.1.66.Final] at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:500) [io.netty.netty-transport-4.1.66.Final.jar:4.1.66.Final] at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:986) [io.netty.netty-common-4.1.66.Final.jar:4.1.66.Final] at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74) [io.netty.netty-common-4.1.66.Final.jar:4.1.66.Final] at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) [io.netty.netty-common-4.1.66.Final.jar:4.1.66.Final] at java.lang.Thread.run(Thread.java:829) [?:?]

[scholzj]

I don't know what that means. Any more logs form OpenSSL?

[sreejesh123]

FYI - this is how I am creating the certificate

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: sample-certificate
namespace: default
spec:

isCA: true
secretName: demo-cert-tls

commonName: cert-manager.io.sample

dnsNames:
- cert-manager.io
- jetstack.io

duration: 24h

renewBefore: 8h

issuerRef:
group: cas-issuer.jetstack.io
kind: GoogleCASIssuer
name: googlecasclusterissuer-sample

[sreejesh123]

[scholzj]

by default when I install - how Strimzi manage certificate? as part of operator install do you create any certificate or issuer etc on my cluster , just wanted to compare what actually is missing in what I am providing and its failing.

Nothing is done when you install Strimzi. Everything happens when you create a Kafka cluster. It also doesn't use CertManager. So I'm not sure the two things are comparable. But basically when you create the Kafka cluster, it creates the self-signed CAs and uses those to issue the server certificates.

[sreejesh123]

thanks, any idea if anyone got a fix for this issue? #4004

[scholzj]

I'm not sure what issue was there.

[sreejesh123]

Sorry, to reiterate - once we adding the cert in order and after spinning up the cluster the pods are going to "CrashLoopBackOff" with below error.

Detected Zookeeper ID 1
Preparing truststore
Adding /opt/kafka/cluster-ca-certs/ca.crt to truststore /tmp/zookeeper/cluster.truststore.p12 with alias ca
Certificate was added to keystore
Preparing truststore is complete
Looking for the right CA
No CA found. Thus exiting.

[scholzj]

This part No CA found. Thus exiting. means that the server certificate was not signed by any of the provided cluster CAs (or at least that the code thinks so). But why is it the case is not clear just from this log.