Make it easier to handle TLS trust in service account based authentication

[scholzj]

In #10317 we add support for service account based authentication. But the way to configure TLS trust seems very hacky and strange. We should figure out how to improve this:

• Either by support for loading certs from ConfigMaps (see [Enhancement]: Allow to mount trustedCertificates as configmap in KafkaConnect #10308)
• Or by allowing to use the certificate mounted in the pod itself

[scholzj]

Triaged on the Community call on 8.8.2024: Should be postponed for the next call with more maintainers.

[scholzj]

Discussed on a community call on 22.8.2024: This makes sense and should be kept. But it should have a proposal since there are at least two ways how to handle this:

• Use the certificate from the path already mounted int he Kafka pods
• Use the Kube Config Map directly

The proposal should clarify the exact approach.

[scholzj]

Sorry, but what does it have to do with this issue?

[L040639]

.

[scholzj]

Assuming the proposal strimzi/proposals#175 goes through, I think this issue will not be needed anymore. With type: custom authentication, you can easily use certificates from Config Maps either by using the one mounted with the Service Account or mount a separate one through additional volumes. E.g.:

      - name: tls
        port: 9093
        type: internal
        tls: true
        authentication:
          type: custom
          sasl: true
          listenerConfig:
            sasl.enabled.mechanisms: OAUTHBEARER
            oauthbearer.sasl.server.callback.handler.class: io.strimzi.kafka.oauth.server.JaasServerOauthValidatorCallbackHandler
            oauthbearer.sasl.jaas.config: |
                org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required unsecuredLoginStringClaim_sub="thePrincipalName" oauth.valid.issuer.uri="https://kubernetes.default.svc.cluster.local" oauth.jwks.endpoint.uri="https://kubernetes.default.svc.cluster.local/openid/v1/jwks" oauth.server.bearer.token.location="/var/run/secrets/kubernetes.io/serviceaccount/token" oauth.check.access.token.type="false" oauth.include.accept.header="false" oauth.custom.claim.check="@.['kubernetes.io'] && @.['kubernetes.io'].['namespace'] in ['myproject']" oauth.ssl.truststore.location="/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" oauth.ssl.truststore.type="PEM";
            principal.builder.class: io.strimzi.kafka.oauth.server.OAuthKafkaPrincipalBuilder
            connections.max.reauth.ms: 3600000