Re: Configuring Kerberos behind an ELB

2018-06-22 Thread Tyler Monahan
1:09 PM > *To:* Ben Wood > *Cc:* users@kafka.apache.org; Martin Gainty > *Subject:* Re: Configuring Kerberos behind an ELB > > Ben, > > Yes. I want to be able to provide consumers/producers with a single > address they can use to connect to the cluster. Having it behind an el

Re: Configuring Kerberos behind an ELB

2018-06-22 Thread Martin Gainty
Wood Cc: users@kafka.apache.org; Martin Gainty Subject: Re: Configuring Kerberos behind an ELB Ben, Yes. I want to be able to provide consumers/producers with a single address they can use to connect to the cluster. Having it behind an elb lets us scale up and replace nodes with out needing

Re: Configuring Kerberos behind an ELB

2018-06-22 Thread Tyler Monahan
Ben, Yes. I want to be able to provide consumers/producers with a single address they can use to connect to the cluster. Having it behind an elb lets us scale up and replace nodes with out needing to mess with consumer/producer configurations. I have considered setting up individual dns records

Re: Configuring Kerberos behind an ELB

2018-06-22 Thread Ben Wood
Hey Tyler, What is your end goal? To have a single publicly / internally available address to be able to provide to consumers / producers to connect to the Kerberized Kafka? On Fri, Jun 22, 2018 at 9:20 AM, Tyler Monahan wrote: > Martin, > > I have read that stack overflow post but it doesn't

Re: Configuring Kerberos behind an ELB

2018-06-22 Thread Tyler Monahan
Martin, I have read that stack overflow post but it doesn't help with my specific problem. An ELB will work if I am not using kerberos just fine. The issue started happening when I added kerberos auth to the cluster. The auth has to happen before the meta data request so it never gets to the

Re: Configuring Kerberos behind an ELB

2018-06-22 Thread Martin Gainty
MG>quoting stackoverflow below "You can use an ELB as the bootstrap.servers, The ELB will be used for the initial metadata request the client makes to figure out which topic partitions are on which brokers, but after (the initial metadata request) the brokers still need to be directly accessible