Current state: Under Discussion
Discussion thread: here
Voting thread: here
Add an ability to use custom SSL factory to configure Kafka Connect RestServer.
Currently Kafka Connect provides only one basic mechanism based on file key stores to configure SSL for REST server.
Kafka Connect is used by all sizes of organizations serving varied technical and business domains. SSL/TLS communication is a very critical part of organizations' standards. SSL config customization is the most part of functionality for any applications.
Common approach to configure extensible SSL for Kafka broker & clients was introduced at the KIP-519. The property
ssl.engine.factory.class was added in this patch to specify custom creation of the SSL Engine.
ssl.engine.factory.class") property with prefixes:
New config properties are used to define SSL engine factory for RestServer listeners. By default
DefaultSslEngineFactory is used. Full names of new properties:
All properties prefixed with "
"admin.listeners.https." passed to the
configure method of the
There is a public Kafka interface to define custom SSL engine since 2.6.0 version (
SslEngineFactory). This interface can be used to configure SSL for Kafka connect RestServer.
Add private adapter class to use
SslEngineFactory for Jetty. Implementation of the main functionality:
A similar adapter can be used for RestClient (extends
Compatibility, Deprecation, and Migration Plan
Utilities are affected by the change:
There is no impact on existing behavior, and the existing behavior is not deprecated. All existing SSL properties are supported.
Pay an attention that current implementation uses SSL configuration from Kafka client (without any prefixes) for REST servers/client in case there is not any properties with "
"admin.listeners.https." prefixes. An implementation must be backward-compatible with this behavior.
Add integration tests to check:
RestClient creation (modify
- Custom SSL engine factory to configure RestServer listeners.
Use native type for Jetty server in public API
The Jetty server uses extenstions of the class org.eclipse.jetty.util.ssl.SslContextFactory to configure SSL for connector.
- external dependency in public API (e.g. server implementation may be changed for Kafka Connect);
- new type in public interface;
- new default implementation (because new type must implement
Configurable) which is minimally different from DefaultSslEngineFactory.