Re: [DISCUSS] KIP-1119: Add support for SSL hot reload

2025-04-30 Thread Moncef Abboud
Gaurav, Colin, Thank you for your replies. > It appears that inotify on Linux doesn't emit events for bind mounts. This is indeed a valid concern and it seems that this a well-known issue.. As Colin suggested, we can work around this by manually polling or by leveraging a library that uses polli

Re: [DISCUSS] KIP-1119: Add support for SSL hot reload

2025-04-29 Thread Colin McCabe
Gaurav brings up a good point. However, we can work around that bug by doing polling every 5 or 10 minutes in addition to using WatchService. best, Colin On Wed, Apr 23, 2025, at 00:39, Gaurav Narula wrote: > Hi Moncef, > > Have you tried experimenting the behaviour of JDK's WatchService with >

Re: [DISCUSS] KIP-1119: Add support for SSL hot reload

2025-04-23 Thread Gaurav Narula
Hi Moncef, Have you tried experimenting the behaviour of JDK's WatchService with bind mounts? Reading [0], it appears that inotify on linux doesn't emit events for bind mounts. This may pose a limitation in Kubernetes as that's how config maps are mounted. Another scenario to consider would b

Re: [DISCUSS] KIP-1119: Add support for SSL hot reload

2025-03-22 Thread Moncef Abboud
Hi Mickael, Thank you for your feedback. >- Can you provide the description and default value for the new configuration? Done. I amended the KIP. >The KIP explicitly mentions brokers, consumer and producers, I assume it also covers admin clients (and controllers)? Correct. I believe both the c

Re: [DISCUSS] KIP-1119: Add support for SSL hot reload

2025-03-12 Thread Mickael Maison
Hi, Thanks for the KIP, it seems a useful improvement. I guess this would supersede KIP-687. The KIP is a bit light on details. - Can you provide the description and default value for the new configuration? - The KIP explicitly mentions brokers, consumer and producers, I assume it also covers adm

Re: [DISCUSS] KIP-1119: Add support for SSL hot reload

2024-12-05 Thread Moncef Abboud
Hi Gaurav, Thank you for your reply. There is some overlap between the two. However, while KIP-687 focuses primarily on brokers, this KIP targets consumers and producers, with additional benefits for brokers. Best, Moncef On Thu, Dec 5, 2024, 10:38 AM Gaurav Narula wrote: > Hi Moncef, > > Tha

Re: [DISCUSS] KIP-1119: Add support for SSL hot reload

2024-12-05 Thread Gaurav Narula
Hi Moncef, Thank you for the KIP. It seems very similar in spirit to KIP-687 (https://cwiki.apache.org/confluence/display/KAFKA/KIP-687%3A+Automatic+Reloading+of+Security+Store) which seems like it was approved but never fully implemented. Can you please confirm if it is the case indeed? Regar

Re: [DISCUSS] KIP-1119: Add support for SSL hot reload

2024-12-05 Thread Moncef Abboud
Hello everyone, A GitHub PR https://github.com/apache/kafka/pull/17987 implementing the KIP is also available. Your feedback would be greatly appreciated! Cheers, Moncef On Mon, Dec 2, 2024, 5:12 PM Moncef Abboud wrote: > Hi all, > > I hope your week is off to a great start. > > I created a

[DISCUSS] KIP-1119: Add support for SSL hot reload

2024-12-02 Thread Moncef Abboud
Hi all, I hope your week is off to a great start. I created a KIP to add support for SSL hot reloading. https://cwiki.apache.org/confluence/x/eIrREw Thank you for your feedback! Moncef