[
https://issues.apache.org/jira/browse/KAFKA-13293?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17414217#comment-17414217
]
Rajini Sivaram commented on KAFKA-13293:
----------------------------------------
[~teabot] Yes, agree that it will be useful to support certificate updates
without restart for clients.
1) At the moment, as you said you will need to pull in new certs and restart
clients if you are using Kafka without custom plugins.
2) If you are willing to add a custom plugin, you can add a custom
implementation of `ssl.engine.factory.class` that recreates the
SslEngineFactory when certs change by watching key/truststore files or pulling
in PEM configs from an external source.
3) For the longer term,
[https://cwiki.apache.org/confluence/display/KAFKA/KIP-649%3A+Dynamic+Client+Configuration]
will be useful to perform dynamic updates for clients similar to how we do
dynamic broker config updates.
> Support client reload of PEM certificates
> -----------------------------------------
>
> Key: KAFKA-13293
> URL: https://issues.apache.org/jira/browse/KAFKA-13293
> Project: Kafka
> Issue Type: Improvement
> Components: clients, security
> Affects Versions: 2.7.0, 2.8.0, 2.7.1
> Reporter: Elliot West
> Priority: Major
>
> Since Kafka 2.7.0, clients are able to authenticate using PEM certificates as
> client configuration properties in addition to JKS file based key stores
> (KAFKA-10338). With PEM, certificate chains are passed into clients as simple
> string based key-value properties, alongside existing client configuration.
> This offers a number of benefits: it provides a JVM agnostic security
> mechanism from the perspective of clients, removes the client's dependency on
> the local filesystem, and allows the the encapsulation of the entire client
> configuration into a single payload.
> However, the current client PEM implement has a feature regression when
> compared with the JKS implementation. With the JKS approach, clients would
> automatically reload certificates when the key stores were modified on disk.
> This enables a seamless approach for the replacement of certificates when
> they are due to expire; no further configuration or explicit interference
> with the client lifecycle is needed for the client to migrate to renewed
> certificates.
> Such a capability does not currently exist for PEM. One supplies key chains
> when instantiating clients only - there is no mechanism available to either
> directly reconfigure the client, or for the client to observe changes to the
> original properties set reference used in construction. Additionally, no
> work-arounds are documented that might given users alternative strategies for
> dealing with expiring certificates. Given that expiration and renewal of
> certificates is an industry standard practice, it could be argued that the
> current PEM client implementation is not fit for purpose.
> In summary, a mechanism should be provided such that clients can
> automatically detect, load, and use updated PEM key chains from some non-file
> based source (object ref, method invocation, listener, etc.)
> Finally, It is suggested that in the short-term Kafka documentation be
> updated to describe any viable mechanism for updating client PEM certs
> (perhaps closing existing client and then recreating?).
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
