Skip to content

SSL configuration does not work unless SASL is enabled #2938

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
PabloHiro opened this issue Nov 10, 2022 · 0 comments · Fixed by #3278
Closed

SSL configuration does not work unless SASL is enabled #2938

PabloHiro opened this issue Nov 10, 2022 · 0 comments · Fixed by #3278
Assignees
Labels
area/storage type/bug Something isn't working

Comments

@PabloHiro
Copy link

Description

Registry
Version
: 2.3.1.Final
Persistence type: kafkasql

Environment

I am deploying Apicurio via modified helm chart in a Kubernetes cluster v1.23.3.

Steps to Reproduce

If I configure the following environment variables:

KAFKA_SECURITY_PROTOCOL=SSL
KAFKA_SSL_TRUSTSTORE_LOCATION=foo
KAFKA_SSL_TRUSTSTORE_PASSWORD=foo
KAFKA_SSL_KEYSTORE_TYPE=foo
KAFKA_SSL_KEYSTORE_LOCATION=foo
KAFKA_SSL_KEYSTORE_PASSWORD=foo
KAFKA_SSL_KEY_PASSWORD=foo

The following errors are shown in the logs:

The configuration 'ssl.keystore.type' was supplied but isn't a known config.
The configuration 'ssl.truststore.location' was supplied but isn't a known config.
The configuration 'ssl.keystore.password' was supplied but isn't a known config.
The configuration 'ssl.key.password' was supplied but isn't a known config.
The configuration 'ssl.keystore.location' was supplied but isn't a known config.
The configuration 'ssl.truststore.password' was supplied but isn't a known config.
The configuration 'ssl.truststore.type' was supplied but isn't a known config.

These errors appear when kafka.security.protocol is not true . However, the configuration starts working when I set:
ENABLE_KAFKA_SASL=true

Expected vs Actual Behaviour

As far as I understand, SSL is not a subset of SASL, it is a separate protocol.

The bug appears because of these lines:
https://github.com/Apicurio/apicurio-registry/blob/2.3.1.Final/storage/kafkasql/src/main/java/io/apicurio/registry/storage/impl/kafkasql/KafkaSqlFactory.java#L100
https://github.com/Apicurio/apicurio-registry/blob/2.3.1.Final/storage/kafkasql/src/main/java/io/apicurio/registry/storage/impl/kafkasql/KafkaSqlFactory.java#L240
It should be possible to enable SSL settings simply by setting: KAFKA_SECURITY_PROTOCOL=SSL

Instead of having to add ENABLE_KAFKA_SASL=true as well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/storage type/bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants