Use mTLS instead of Kerberos for KRaft inter-node traffic

未关闭
  • 哪里不对？
#1,066 0 条评论 0 个 reaction 已指派 1 人 在 GitHub 查看

维护者通常 1 天内回复

@razvan 已经在做这个了。

开始于 2026年11月13日。

  • #1067 来自 @razvan —— 未关闭

评估

这个 Issue 还没有评估数据。

描述

type/internal-improvement

Description

With Kerberos enabled, the CONTROLLER listener currently uses SASL_SSL/GSSAPI. Brokers and controllers authenticate to each other with Kerberos principals (#1024). The INTERNAL listener already uses mTLS with the pod certificates of the internalSecretClass in every configuration.

Kerberos principals are a poor fit for identifying the Kafka nodes. With the default sasl.kerberos.principal.to.local.rules, every node principal maps to the same short name, so it can't be pinned to a specific node. Pod certificate subjects can.

Proposal:

  • Make the CONTROLLER listener always SSL, and require client authentication when Kerberos, TLS client authentication or OPA is configured.
  • Use Kerberos only on the client-facing broker listeners. Controllers get no keytab or JAAS configuration.
  • Make super.users contain only the pod certificate subjects of the nodes.

Issue checklist

This is a simple checklist of things to bear in mind when creating a new issue.

  • Describe the use-case: As far as possible, use the pattern "As a [type of user], I would like [feature/functionality] to be able to do [specific action]." This helps identify the feature and the problem it addresses.
  • Indicate importance and urgency: Use a scale (e.g., low, medium, high) to indicate the level of importance and urgency.
  • Work-around: If there is a known work-around, describe it briefly.
  • Environment: Describe the environment where the issue occurs (e.g., SDP version, K8S version, etc.).
主要语言
Rust
星标
31
派生
9
平均合并
4 天 5 小时
30 天内合并 PR
14

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

stackabletech/kafka-operator 的其他 Issue

查看 stackabletech/kafka-operator 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。