Strimzi-kafka-operator: [Question] Enforce HTTPS for KafkaConnect REST API

[ddlees]

I'm looking for some guidance on how to deploy KafkaConnect so that invoking the REST api when internal to the cluster is over HTTPS. I've found docs on ensuring TLS is setup between Kafka and KafkaConnect; I got that and it's setup. However, I can't seem to find documentation for this issue.

Background:
My team's k8s cluster spans multiple datacenters for HA/DR of services including our KafkaConnect cluster so any invocation against the REST API will be in the clear should the caller need to communicate cross-datacenter. Since our development team is large and I cannot guarantee folks won't put sensitive information in KafkaConnector configurations either using the CRD or REST API directly it's important that we have a way to reduce the risk of a man-in-the-middle attack.

Note: This might already be documented somewhere and it is entirely possible that I'm blind.

[scholzj]

I'm afraid we currently don't have any support for it. It is on the TODO list to either add something to secure the REST interface or to lock it down and let users use only the Kafkaconnector resources, but it haven't been implemented yet.

So I guess the only options right now is to use a network policies in combination with some proxy to secure it.

[scholzj]

This is being addressed in strimzi/proposals#10 ... so I think we can close this question. The proposal is almost approved so it should be implemented soon. If you have some more question about how it is planned to be implemented, best would be to comment on the proposal PR.

[ddlees]

@scholzj Just out of curiosity, by "soon" are we talking in the order of days or weeks? I know our security focal is going to ask and I don't want to have to shrug my shoulders ¯_(ツ)_/¯. Anyway, not a big deal if you don't know or don't want to say. Thanks!

[scholzj]

The proposal has been approved. But I do not think we have any strict deadline when we plan to have the development finished.

(cc: @ajborley )

[ddlees]

@scholzj In that case I'll just keep an eye out for when you guys get around to it. Strimzi is one of my favorite sets of operators to work with; Let me know if there's anything I can do to help. Thank you!