Who Are You? Configuring Kafka Authentication in Strimzi from TLS to Custom Principals
summary
Axual moves a single-tenant Kafka rollout to multi-tenant Strimzi by trusting multiple customer CAs, building a custom Principal Builder that encodes the full certificate chain, and shipping it either in a rebuilt Kafka image or via image volume; this prevents cross-tenant superuser escalation but forces rebuilding on Strimzi retags and exposed a Strimzi 0.49 certificate-chain regression later fixed in 0.50/0.51. Experiments include per-tenant listener trust stores and a mTLS+OAuth layered auth setup that works but increases operational complexity.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:44Multi-tenancy challenges
- 2:48Authentication basics
- 4:16Default mechanisms
- 8:50Multiple tenant CAs
- 11:38Custom principal builder
- 16:17Risks of custom solutions
- 19:53Custom listener per tenant
- 24:29OAuth in Strimzi
- 27:46MTLS and OAuth
- 29:52Summary
related talks
34mHow to Survive Managing Strimzi in an Enterprise
42mPartial Multi-Tenancy on Kafka Using Strimzi at LittleHorse
32mStretching Strimzi: Exploring Multi-Cluster Kafka for High Availability
31mSimplifying Apache Kafka on Kubernetes With Strimzi
21mKeynote: Strimzi past, present and future
19mStrimzi & OpenTelemetry: Building End-to-End Observability for Kafka on Kubernetes
42mTransition to Apache Kafka on Kubernetes With Strimzi
04mProject Lightning Talk: Strimzi – What's New and What's Next