Hi Jonathan, Thanks for the KIP.
+1 (binding) with a couple comments below to add more detail to the KIP. 1. Make it clearer when the new option `bootstrap.reverse.dns.lookup` should or shouldn't be used. Document security considerations as well as other system configurations that may have an impact. 2. The PR currently disables the new code path for security protocol SSL. But this doesn't address SASL_SSL which could also do hostname verification. Do we even want to do reverse lookup if bootstrap list contains IP addresses? If we do, we should handle SSL and SASL_SSL in the same way (which basically means handling all protocols in the same way). On Thu, Apr 26, 2018 at 2:16 PM, Stephane Maarek < steph...@simplemachines.com.au> wrote: > +1 as a user > BUT > > I am no security expert. I have experienced that issue while setting up a > cluster and while I would have liked a feature like that (I opened a JIRA > at the time), I always guessed that the reason was because of some security > protection. > > Now from a setup point of view this helps a ton, but I really want to make > sure this doesn't introduce any security risk by relaxing a constraint. > > Is there a security assessment possible by someone accredited ? > > Sorry for raising these questions just want to make sure it's addressed > > On Thu., 26 Apr. 2018, 5:32 pm Gwen Shapira, <g...@confluent.io> wrote: > > > +1 (binding) > > > > This KIP is quite vital to running secured clusters in cloud/container > > environment. Would love to see more support from the community to this > (or > > feedback...) > > > > Gwen > > > > On Mon, Apr 16, 2018 at 4:52 PM, Skrzypek, Jonathan < > > jonathan.skrzy...@gs.com> wrote: > > > > > Hi, > > > > > > Could anyone take a look ? > > > Does the proposal sound reasonable ? > > > > > > Jonathan Skrzypek > > > > > > > > > From: Skrzypek, Jonathan [Tech] > > > Sent: 23 March 2018 19:05 > > > To: dev@kafka.apache.org > > > Subject: [VOTE] KIP-235 Add DNS alias support for secured connection > > > > > > Hi, > > > > > > I would like to start a vote for KIP-235 > > > > > > https://cwiki.apache.org/confluence/display/KAFKA/KIP- > > > 235%3A+Add+DNS+alias+support+for+secured+connection > > > > > > This is a proposition to add an option for reverse dns lookup of > > > bootstrap.servers hosts, allowing the use of dns aliases on clusters > > using > > > SASL authentication. > > > > > > > > > > > > > > > > > > -- > > *Gwen Shapira* > > Product Manager | Confluent > > 650.450.2760 | @gwenshap > > Follow us: Twitter <https://twitter.com/ConfluentInc> | blog > > <http://www.confluent.io/blog> > > >
