kafka client certs usage at different VNets.

[charansaip]

Hi ALL,

Can someone please clarify this.
I have deployed Kafka Strimzi with MTLS. Here I am using external certs for brokers and also using internal client certs [ using Kafka user ] . My application is up and running. when i ran below commands with in same VNET but different subnet i am able to list topics. produce data and consume as well.

p12 creation :
kubectl get secret my-user -n kafka -o jsonpath='{.data.user.crt}' | base64 -d > user.crt
kubectl get secret my-user -n kafka -o jsonpath='{.data.user.key}' | base64 -d > user.key
openssl pkcs12 -export -in user.crt -inkey user.key -name "vm-client" -out user.keystore.p12 -password pass:changeit

security.protocol=SSL
ssl.truststore.location=C:\kafka_2.13-4.0.0\truststore.jks
ssl.truststore.password=password

ssl.keystore.location=C:\kafka_2.13-4.0.0\user.keystore.p12
ssl.keystore.password=changeit
ssl.keystore.type=PKCS12

Question : so my question is can we use internal client certs [ which are my user certs in ] other VNets as well

[scholzj]

Strimzi does not really care about your network configuration as long as it can route the connections based on the advertised addresses. So how do you use subnets, vnets or anything else is basically up to your infrastructure to make sure the connections are properly routed.

In any case, using different networks to access the brokers, should not have any impact on the client certificates, as they have nothing to do with how the connection is established.

[charansaip]

@scholzj thanks for clarification