[PKCS12-TLS support] Kafka-ui with Strimzi kafka user

[sachintandon-nexla]

Describe the bug
we are using strimzi kafka 0.33.1 for applications to connect to kafka we are using kafka-user-operator supported by strimzi kafka
this generates a ca.crt, user.key , user.pem for applications to connect to kafka over TLS .
Can you please help us in how can we connect kafka-ui with strimzi kafka user.

[Haarolean]

Hi, you'd need to create a jks (or p12) keystore with the files provided and pass them into the container.
Here's an example docker-compose file for SSL-enabled kafka.

[Bakrog]

why not consider using pem and key files directly? It's such a hassle to convert to keystore everytime we want to use it.

[sachintandon-nexla]

Is there a way to pass this directly in the HELM chart values.yaml file

[Haarolean]

https://github.com/provectus/kafka-ui/pull/3283/files

[ghost]

Try this - values.yaml config for the official Helm chart. It's not pretty, but...

env:
  - name: KAFKA_CLUSTERS_0_PROPERTIES_SSL_KEYSTORE_LOCATION
    value: /etc/secrets/user/keystore.jks
  - name: KAFKA_CLUSTERS_0_NAME
    value: my-cluster
  - name: KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS
    value: my-cluster-kafka-bootstrap:9093
  - name: KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL
    value: SSL
  - name: KAFKA_CLUSTERS_0_PROPERTIES_SSL_KEYSTORE_PASSWORD
    valueFrom:
      secretKeyRef:
        name: kafka-ui # name of the KafkaUser
        key: user.password
  - name: KAFKA_CLUSTERS_0_SSL_TRUSTSTORELOCATION
    value: /etc/secrets/user/truststore.jks
  - name: KAFKA_CLUSTERS_0_SSL_TRUSTSTOREPASSWORD
    valueFrom:
      secretKeyRef:
        name: my-cluster-cluster-ca-cert # generated secret, format <cluster-name>-cluster-ca-cert
        key: ca.password

volumeMounts:
  - name: mtls
    mountPath: /etc/secrets/user
volumes:
  - name: kafka-ui
    secret:
      secretName: kafka-ui
  - name: mtls
    emptyDir:
      medium: Memory
  - name: cluster-ca
    secret:
      secretName: my-cluster-cluster-ca-cert


initContainers:
  - name: convert-user-cert
    image: docker.io/provectuslabs/kafka-ui:v0.7.1
    command:
      - keytool
      - -importkeystore
      - -srckeystore
      - /etc/secrets/kafka-ui/user.p12
      - -srcstoretype
      - pkcs12
      - -srcalias
      - kafka-ui
      - -srcstorepass
      - $(KAFKA_UI_USER_KEYSTORE_PASS)
      - -destkeystore
      - /etc/secrets/user/keystore.jks
      - -deststoretype
      - jks
      - -deststorepass
      - $(KAFKA_UI_USER_KEYSTORE_PASS)
      - -destalias
      - creds
    volumeMounts:
      - name: kafka-ui
        mountPath: /etc/secrets/kafka-ui
      - name: mtls
        mountPath: /etc/secrets/user
        readOnly: false
    env:
      - name: KAFKA_UI_USER_KEYSTORE_PASS
        valueFrom:
          secretKeyRef:
            name: kafka-ui
            key: user.password

  - name: convert-cluster-cert
    image: docker.io/provectuslabs/kafka-ui:v0.7.1
    command:
      - keytool
      - -importkeystore
      - -srckeystore
      - /etc/secrets/kafka-cluster/ca.p12
      - -srcstoretype
      - pkcs12
      - -srcalias
      - ca.crt
      - -srcstorepass
      - $(KAFKA_CLUSTER_CA_TRUSTSTORE_PASS)
      - -destkeystore
      - /etc/secrets/cluster/truststore.jks
      - -deststoretype
      - jks
      - -deststorepass
      - $(KAFKA_CLUSTER_CA_TRUSTSTORE_PASS)
      - -destalias
      - creds
    volumeMounts:
      - name: mtls
        mountPath: /etc/secrets/cluster
        readOnly: false
      - name: cluster-ca
        mountPath: /etc/secrets/kafka-cluster
    env:
      - name: KAFKA_CLUSTER_CA_TRUSTSTORE_PASS
        valueFrom:
          secretKeyRef:
            name: my-cluster-cluster-ca-cert
            key: ca.password

Assumptions:

• kafka-ui, KafkaUser and Kafka cluster are all in the same namespace - needed for secret mounts
• KafkaUser is configured for TLS authentication, user certs/key will be in secret kafka-ui
• Kafka cluster CA cert will be in secret my-cluster-cluster-ca-cert

What the above is doing is adding two initContainers, one will take the KafkaUser PKCS12 TLS client certificate, and convert it into JKS, the other will do the same to the cluster CA cert. We're putting the converted certs into a shared emtpyDir volume with kafka-ui pod, then telling the pod the locations and passwords of the JKS containers.

It would be neater (no need for init containers/keytool) if the project supported PKCS12 format directly.

[realvictorprm]

Thanks for sharing @sqrooted!

[sachintandon-nexla]

moreover the password for the PKCS12 is in the secret itself it can be passed by directly mounting the secret as VolumeMounts and getting it from there.