Page History

...

Currently, when describing config for a resource, we'll get `null` if the config is a sensitive config, ex: "ssl.keystore.certificate.chain", "ssl.keystore.password". And when describing configs with them it'll always return something like this: 

> bin/kafka-configs.sh --bootstrap-server localhost:9092 --entity-type brokers --entity-name 2 --describe
Dynamic configs for broker 2 are:
  listener.name.myssl.ssl.keystore.key=null sensitive=true synonyms={DYNAMIC_BROKER_CONFIG:listener.name.myssl.
=null} 

...

1. 1. The user will update the ssl.keystore.location, ssl.keystore.password, ssl.keystore.type in the vault.
   2. After the updates are complete he will send a adminClient request to the broker to notify that configs are updated.
   3. Once the Broker receives a alteredConfig request it will invoke the get function in VaultConfigProvider.
   4. The VaultConfigProvider will fetch the actual values for ssl.keystore.location, ssl.keystore.password, ssl.keystore.type from the vault.
   5. The broker will validate these configs and apply the changes.

In the step (2b), the operator needs a way to know what if the current state of these configs before updating it. With current design, the operator will never know it, and blindly run the alter config multiple times, or worse, the operator thought it is already updated and skipped this update, and cause the broker connection failure.

...