Certificate Authority (CA) called the cluster CA

[sreejesh-radhakrishnan-db]

From Strimzi Document: "To support encryption, each Strimzi component needs its own private keys and public key
certificates. All component certificates are signed by an internal Certificate Authority (CA) called
the cluster CA."

Q:
Is there any way we can switch off this encryption between each Strimzi component? and we setup our own inter pod mtls!

Rationale:
Company Security Control Office is worried a self signed certificate is issued on Cloud , which could pose a security risk.

We are talking about 200+ applications needing to use KAFKA on their clusters, so bank is not ready to issue a workload Intermediate root CA which clearly violate the policy and wider risk. Hence we wont be able to override the cluster-ca cert with our own.

[scholzj]

You can use the Strimzi provided CA or you can supply your own CA. Those are the two options.

[sreejesh-radhakrishnan-db]

@scholzj how the private key for Cluster CA are stored? can anyone who has access to GKE cluster be able to decode it ?

[scholzj]

It is stored as a Kubernetes Secret.