Dynamic SSL Configuration Update

[somasundaram1996]

Hi Is is possible to reload the truststore and keystore on broker side without rolling of the pods. Its creating downtime unnecessarily.

Is there a feature that I can use to update the keystores whenever the brokerCertChain is reloaded.

[scholzj]

No, that is not supported at this point. Kafka itself has also different limitations to this such as no changes tot he subject etc.

[somasundaram1996]

Is there a roadmap planned for the introduction of the dynamic update of ssl properties per listeners.

[scholzj]

I do not think there is currently any plan to support it. As I said, there are many limitations, so it is very complicated code with questionable value.

Maybe you can start by better describing your usecase and what properties would you want to change dynamically. You started with certificates, now you talk about properties, which is a bit confusing.

[somasundaram1996]

Sorry for the confusion.

I am using my own certificate custom provided broker certificates. It will get renewed every x days. On each x day I am seeing an rolling update of the kafka pods due to this certificate change. But on investigating I found that there is a way to update the certificates dynamically without rolling the pods. I wanted to know is there a roadmap for the strimzi to accommodate dynamic update of brokerCertiChain in keystores. And I get there is no plan to introduce it as of now due to complex cases. Am I right?

[scholzj]

Ok, thanks for the clarification As I said, we currently don't have any plans to support this given the complexity and the limitations of what Kafka supports. If you would be interested in contributing it, we would be definitely open to it. The best start might be to write a proposal on how it might work: https://github.com/strimzi/proposals