How to change KafkaUser certificate validity?

[vanhoale]

I have a Kafka cluster that is using an ingress external listener. I'm using my own CA that has validity for 10 years. A super KafkaUser was created and I see its cert/key/p12 was generated as well, when I check the certificate validity it just has 1 year. I wonder if I can have a configuration option somewhere to have it longer or shorter?

[scholzj]

You should be able to configure it in .spec.clientsCa.validityDays in the Kafka custom resource: https://strimzi.io/docs/operators/latest/full/configuring.html#con-certificate-renewal-str

[scholzj]

Right ... it will apply to all users. But it is used only in the next renewal. You can force the renewal by deleting the certificate secret of the users.

[vanhoale]

Awesome, thanks!

[vanhoale]

What if we move the grant validity to KafkaUser spec? I mean it can be a new feature

[scholzj]

That is currently not supported.

[vanhoale]

ok, thanks!