Add Kafka Connect TrustStore

[reidmeyer]

Issue submitter TODO list

• I've searched for an already existing issues here
• I'm running a supported version of the application which is listed here and the feature is not present there

Is your proposal related to a problem?

I am running a a kafka connect that I want to hook kafka-ui up to, but when I try to use what i've hooked up I get error
500 PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Describe the feature you're interested in

In provectus/kafka-ui, someone already added the functionality I'm looking for. https://github.com/provectus/kafka-ui/pull/2833/files

If there is agreement, a similar PR could be made here.

Describe alternatives you've considered

I assume I could add environment variables somewhere to override the built in java truststore. If anyone has tried this, I'd be curious.

I see there is a kafka truststore.. does kafka-ui use this to communicate with kafka-connect as well; if so, I could add my ca there as well.

Version you're running

42c236d

Additional context

No response

[github-actions]

Hi reidmeyer! 👋

Welcome, and thank you for opening your first issue in the repo!

Please wait for triaging by our maintainers.

As development is carried out in our spare time, you can support us by sponsoring our activities or even funding the development of specific issues.
Sponsorship link

If you plan to raise a PR for this issue, please take a look at our contributing guide.

[fallen-up]

@reidmeyer i highly doubt you have tls-auth on kafka-connect. which means you'll be ok with the solution:
#422

[reidmeyer]

Thanks a ton for sharing, @fallen-up.

Indeed, I'm not doing tls-auth on kafka-connect.

This is simply the ssl verification through the truststore.

Reading the PR, I'm not 100% clear that it would solve the issue. I don't see mention of kafka-connect, and I'm not sure the user enabled the skipping of the verification, based on the PR. But perhaps I'm mistaken.

Lastly, the title concerns me BE: Implement a mechanism to skip SSL verification, because I don't think ssl verification should be skipped; instead, a truststore should be able to be provided.

[fallen-up]

@reidmeyer
i have a case like this:
kafka-connect behind https, but with self-signed certificates.

1. options with truststore, keystore don't help
2. replacing global trustcacerts in /usr/lib/jvm/zulu17-ca/lib/security/ causes self-signed certificates in strimzi-kafka to break. and you need to add ca for each cluster.

fix #422 eliminates such problem.

[reidmeyer]

@fallen-up

I have a nearly identical problem as you. I have a strimzi kafka-connect deployed behind https with a self signed cert. Typically I add the relevant CA to verify this cert to the truststore.

What action should I take to fix my situation after #422 is merged?

[fallen-up]

need to add
KAFKA_CLUSTERS_0_SSL_VERIFYSSL: "false" #or another id of your cluster

it's possible not to wait for merge and build locally for testing.

[reidmeyer]

so that turns off ssl verification for the kafka cluster.. and then the global is used for kafka connect? or does this turn off verifyssl for everything..?

isn't turning off ssl verification a bad thing..?

to me, the solution here seems like it would make more sense: provectus/kafka-ui#2833
where you configure different truststores for each element you are connecting to.. indeed.. i'm not interested in the tls auth of this pr, but the option to configure a truststore for kafka-connect..

If you search in provectus/kafka-ui, you'll see they have CONNECT_SSL_TRUSTSTORE_LOCATION, SCHEMA_REGISTRY_SSL_TRUSTSTORE_LOCATION, KAFKA_CLUSTERS_0_SSL_TRUSTSTORE_LOCATION. This makes sense to me. My Kafka and kafka-connect have different CAs to verify.

[Haarolean]

I wonder what makes you think we don't have this?

https://github.com/kafbat/kafka-ui/blob/main/documentation/compose/kafka-ssl-components.yaml#L30
e26f978