aschmidt402 opened a new pull request, #22688:
URL: https://github.com/apache/kafka/pull/22688
Implemented dynamic reloading of SSL certificates for the KRaft controller
listener via kafka-configs --alter --entity-type controllers. This is done via:
- Adding a new ConfigResource.Type.CONTROLLER (byte id = 64) to represent
controller-specific configuration
- Persisting controller SSL configs as ConfigRecord entries in the metadata
log via the existing IncrementalAlterConfigs RPC
- Replaying configs on startup and updates through a new
ControllerDynamicConfigPublisher that implements Kafka's
MetadataPublisher interface
- Triggering SslFactory.reconfigure() on both sides of the controller's TLS
surface
## Testing
### Unit Tests
ConfigurationControlManagerTest.testIncrementalAlterControllerConfigs:
validates controller-specific validation (accepts SSL keys with listener
prefix, rejects non-SSL keys, rejects non-numeric resource names)
- DynamicControllerConfigTest: validates dispatch (updates reach all
registered listeners, deduplicates identical configs, removeReconfigurable
works)
### Integration Tests
- ControllerDynamicSslReloadTest:
a. Boots isolated KRaft controller with SSL on CONTROLLER listener using
keystore A
b. Reads the baseline cert serial via SSLSocket handshake
c. Issues IncrementalAlterConfigs against ConfigResource.Type.CONTROLLER
pointing at keystore B
d. Polls new TLS connections until the presented cert serial matches
keystore B
e. Asserts rotation occurred without restart
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
