Manikumar, Satish. Thanks for the review! As I understand, you are not in favor of this KIP, and I do agree that having a pluggable mechanism for sensitive data / metadata is preferable/more future-proof.
On Wed, Dec 12, 2018 at 8:12 AM Satish Duggana <satish.dugg...@gmail.com> wrote: > Agree with Manikumar on having pluggable mechanism for entities > required/created for delegation token mechanism. I will cover that as > part of KAFKA-7694. > > Thanks, > Satish. > On Tue, Dec 11, 2018 at 12:35 PM Manikumar <manikumar.re...@gmail.com> > wrote: > > > > Hi, > > > > Thanks for the KIP. > > > > Currently, master/secret key is stored as plain text in server.properties > > config file. > > Using master secret key as shared secret is again a security risk. We > have > > raised KAFKA-7694 > > to implement a ZooKeeper based master/secret key management to automate > > secret key rotation. > > > > As you mentioned in the alternatives sections, it is good to have > pluggable > > mechanism for > > token storage and master key generation. We can implement pluggable > > interfaces for token storage > > and master key generation as part of KAFKA-7694. This will provide us out > > of the box implementation > > using ZooKeeper and pluggable interfaces for custom implementations. > > > > What do you think? > > > > Thanks, > > Manikumar > > > > On Sat, Dec 1, 2018 at 9:37 PM Attila Sasvári <asasv...@apache.org> > wrote: > > > > > Hi All, > > > > > > I have a proposal to allow Kafka brokers to encrypt sensitive metadata > > > information about delegation tokens. > > > > > > As of now, delegation token metadata is stored in an unencrypted > format in > > > Zookeeper. Having the possibility to encrypt-then-MAC token information > > > would be beneficial in Kafka installations where Zookeeper is not on a > > > private network. > > > > > > Please take a look at > > > > > > > https://cwiki.apache.org/confluence/display/KAFKA/KIP-395%3A+Encypt-then-MAC+Delegation+token+metadata > > > and let me know what you think. > > > > > > - Attila > > > >
