THIS IS A TEST INSTANCE. ALL YOUR CHANGES WILL BE LOST!!!!
...
The rest.advertised.host.name and rest.advertised.port options will continue to be used as today to specify the connection address which should be used by other workers. In addition a new option rest.advertised.security.protocol will define whether other workers should connect using HTTP or HTTPS protocols. In case HTTPS is selected, the connecting worker will use the SSL configuration from the the existing ssl.* options. Even in case when rest.advertised.host.name and rest.advertised.port options are not specified this field will be used to define which protocol should be advertised to other workers in combination with the appropriatte hostname and port from the listener field.
This proposal doesn't include any authorization / ACL features. Only encryption and authentication. Authorization / ACLs should be subject of separate KIP in order to keep the scope of this KIP under control. It also doesn't add any other authentication options than SSL/TLS client authentication.
...
Configuration of SSL / TLS for the Kafka Connect REST interface tries to follow the configuration for other SSL / TLS enabled server interfaces. It will be done through the properties configuration file for the distributed Kafka Connect workers.
Following new options will be added:
| Parameter | Default value | Note |
|---|---|---|
listeners | null | List of REST listeners in the format protocol://host:port,protocol2://host2:port2 where the protocol is one of HTTP and HTTPS. |
rest.advertised.security.protocol | HTTP | Configures the protocol used for communication between workers. Should beValid values are either HTTP to ensure backwards compatibilityWhen the listeners configuration is not defined or when it contains |
ssl.client.auth | none | Valid values are none, requested and required. It will controls whether:
This is the only authentication option suggested as part of this KIP. |
listeners.https.ssl.* | The listeners.https. prefix can be used with any SSL configuration option mentioned below to override the default SSL configuration which is shared with the connections to Kafka broker. |
...
This KIP is a new implementation and doesn't have any backwards compatibility issues or special requirements on migration from older versions. Existing Kafka Connect installation would work in the same way as before this change. Without the SSL configuration, the REST interface will continue to be configured as today - i.e. without SSL / TLS.
Rejected Alternatives
- The first version of this KIP suggested only single REST listener - either HTTP or HTTPS. This was changed based on the feedback from the discussion
Technically it would be possible to define multiple "listeners". For example one with HTTP and one with HTTPS. However, given the functionality provided over the REST interface I see only limited value in it. And therefore I rejected it. If you see some value / use case in this, please raise it in the discussion.