How can I use custom Certificate for a particular KafkaUser?

[Mehmoodhassan]

Hi everyone,
I've deployed the Strimzi Kafka Operator in my Azure Kubernetes Service (AKS) cluster, and it's working smoothly. By default, when I create a KafkaUser, the operator automatically generates an associated secret that includes the user's certificate (user.crt) and private key (user.key). However, I'd like to customize this process by providing my own certificates and keys instead of relying on the automatic generation of these credentials.
How can I do this?
Would be happy if you share a example kafkaUser yaml file.
@scholzj will appreciate your answer.

[scholzj]

You should check the documentation about the Custom Clients CA in the Kafka resource / Kafka cluster and about the tls-external authentication type in the KafkaUser resources

[Mehmoodhassan]

Thanks @scholzj One last question. when I will create a user with authentication: tls-external to use my custom Certificate. Do I need to pass custom certificate somewhere else or only just need to create a secret and label/annotate it?
I mean regarding below properties because I don't want to use custom CA for cluster and client just want to have one for a kafkaUser.

 clusterCa:
    generateCertificateAuthority: false
  clientsCa:
    generateCertificateAuthority: false

One more thing I am facing a really weird behavior as soon as I label the custom secret it automatically get deleted :( I don't why? Am I missing something?

[scholzj]

You do not need to pass the certificate anywhere nor create the Secret. The certificate is authenticated through the CA. So it has to be signed by the Clients CA. Whether it is the Strimzi one or your custom one does not really matter. But it is trusted through the CA. So you cannot sign ti with some random CA.

[Mehmoodhassan]

Thanks for the quick response @scholzj . Now I have a new certificate which is signed by the the Clients CA and I tries to use that CA and KEY with default producer and consumer to connect to the Broker but I am having below error at both Producer and consumer

would be thankful if you leave your useful thoughts here :)

[scholzj]

I guess that error suggests some configuration issue. But without knowing how you issues the certificate and how you configured it, it is hard to say anything more.

[Mehmoodhassan]

@ Actually I garbed the default Clients CA from cluster which was created from operator and then try to sign new certificate from that one by below steps:

Create a Certificate Signing Request (CSR) for the Certificate to Be Signed:

openssl req -new -newkey rsa:2048 -keyout certificate-to-sign.key -out certificate-to-sign.csr -subj "/CN=kafka-username"

Sign the CSR with the CA Certificate:

openssl x509 -req -in certificate-to-sign.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out signed-certificate.crt -days 365

here the ca.crt and ca.key is Clients CA.

if I use a certificate from a kafkauser which is created by operator it works fine.