Queries related to cert working in strimzi

[ervikrant06]

Hello Experts,

A naive question after reading bunch of old discussion(s) and issue(s) related to TLS working in strimzi, main focuse is about client certs (using authentication: tls)

Ex: this is working stanza with strimzi/hello-world-producer:latest, it requires cluster CA cert to send the messages to kafka cluster, isn't it should use test-kafka1-client-ca-cert or test-kafka1-user2 ca.crt to authenticate with cluster?

      - env:
        - name: CA_CRT
          valueFrom:
            secretKeyRef:
              key: ca.crt
              name: test-kafka1-cluster-ca-cert                        <<<<< 
        - name: USER_CRT
          valueFrom:
            secretKeyRef:
              key: user.crt
              name: test-kafka1-user2
        - name: USER_KEY
          valueFrom:
            secretKeyRef:
              key: user.key
              name: test-kafka1-user2
        - name: BOOTSTRAP_SERVERS
          value: test-kafka1-kafka-0.kube2.example.com:9094
        - name: TOPIC
          value: my-topic
        - name: DELAY_MS
          value: "500"
        - name: LOG_LEVEL
          value: INFO
        - name: MESSAGE_COUNT
          value: "100"
        image: strimzi/hello-world-producer:latest

In listener list of kafka cluster 9094 port is exposed as tls with external LB.

    - name: external
      port: 9094
      type: loadbalancer
      tls: true
      authentication:
        type: tls
      configuration:
        #bootstrap:
          #alternativeNames:
          #- kafka-test1.kube2..example.com
        brokers:
        - advertisedHost: test-kafka1-kafka-0.kube2.example.com
          advertisedPort: 9094
          broker: 0
          annotations:
            external-dns.alpha.kubernetes.io/hostname: test-kafka1-kafka-0.kube2.example.com
        - advertisedHost: test-kafka1-kafka-1.kube2.example.com
          advertisedPort: 9094
          broker: 1
          annotations:
            external-dns.alpha.kubernetes.io/hostname: test-kafka1-kafka-1.kube2.example.com
        - advertisedHost: test-kafka1-kafka-2.kube2.example.com
          advertisedPort: 9094
          broker: 2
          annotations:
            external-dns.alpha.kubernetes.io/hostname: test-kafka1-kafka-2.kube2.example.com

We have old strimzi setup running with 0.11.0 operator. we use the following commands to get the information from user secret to generate the trustore (below script is partial snippet).

USER="my-user" #CHANGEME
CLUSTER="centrallogging" #CHANGEME, Kafka cluster name
NAMESPACE="centrallogging"

mkdir -p $USER-$CLUSTER
cd $USER-$CLUSTER

kubectl get secret -n $NAMESPACE $USER -o=jsonpath='{.data.user\.crt}' | base64 -d > user.crt
kubectl get secret -n $NAMESPACE $USER -o=jsonpath='{.data.user\.key}' | base64 -d > user.key
kubectl get secret -n $NAMESPACE $USER -o=jsonpath='{.data.ca\.crt}' | base64 -d > ca.crt

[scholzj]

The ca.crt in the user secret is the public key of the Clients CA used to sign the user certificate. It is not the public key of the Cluster CA which is used to sign the broker certificates. For the truststore, you need to trust the CA which signed the broker certificates which is the Cluster CA. So you need to get that from the <cluster-name>-cluster-ca-cert secret as in our examples.

[ervikrant06]

thanks