16.4. Configuring internal clients to trust the cluster CA

Using PKCS #12 format (.p12)

1. Mount the cluster Secret as a volume when defining the client pod.

   For example:

   kind: Pod
   apiVersion: v1
   metadata:
     name: client-pod
   spec:
     containers:
     - name: client-name
       image: client-name
       volumeMounts:
       - name: secret-volume
         mountPath: /data/p12
       env:
       - name: SECRET_PASSWORD
         valueFrom:
           secretKeyRef:
             name: my-secret
             key: my-password
     volumes:
     - name: secret-volume
       secret:
         secretName: my-cluster-cluster-ca-cert

   Here we’re mounting the following:

   • The PKCS #12 file into an exact path, which can be configured
   • The password into an environment variable, where it can be used for Java configuration

2. Configure the Kafka client with the following properties:

   • A security protocol option:

     • security.protocol: SSL when using TLS for encryption (with or without mTLS authentication).
     • security.protocol: SASL_SSL when using SCRAM-SHA authentication over TLS.
   • ssl.truststore.location with the truststore location where the certificates were imported.
   • ssl.truststore.password with the password for accessing the truststore.
   • ssl.truststore.type=PKCS12 to identify the truststore type.

Using PEM format (.crt)

1. Mount the cluster Secret as a volume when defining the client pod.

   For example:

   kind: Pod
   apiVersion: v1
   metadata:
     name: client-pod
   spec:
     containers:
     - name: client-name
       image: client-name
       volumeMounts:
       - name: secret-volume
         mountPath: /data/crt
     volumes:
     - name: secret-volume
       secret:
         secretName: my-cluster-cluster-ca-cert

2. Use the extracted certificate to configure a TLS connection in clients that use certificates in X.509 format.