I am looking for mTLS securing zookeepers <->...
# generaln
Naresh
02/22/2024, 4:53 AMI am looking for mTLS securing zookeepers <-> pulsar components (bookie, broker, proxy), https://pulsar.apache.org/docs/3.2.x/security-tls-transport/ doesn't have details. There is https://github.com/apache/pulsar/issues/6236 . Whats the recommended doc for this ?
l
Lari Hotari
02/22/2024, 8:30 AMOne useful source of information could be @Michael Marshall’s presentation slides for "Securing Pulsar for a Zero Trust Environment". Michael presented that in ApacheCon 2022. However, there's no recording available for it. I don't have the presentation slides available. @Michael Marshall do you have a chance to share the slides?
Lari Hotari
02/22/2024, 8:34 AMYou could also try Apache Pulsar Helm chart by enabling TLS. However, there's a checkbox missing for "Mutual TLS" in the readme, so it's probably not mTLS. Contributions are welcome for adding mTLS support and improving it. 🙂
n
Naresh
02/22/2024, 9:00 AMthanks, will go through
y
Yu Wei Sung
02/22/2024, 3:22 PMTwo concept are confusing people, mTLS and TLS client authentication.
mTLS means service to service mutual TLS authentication, bookie - zk, broker - bk, broker - zk and so on. The tls certificates of mTLS use DNS/IP or spiffe. To answer your question, the helm chart does support this mTLS and there is an example how to turn it on. The key is here.
TLS client authentication means your pulsar clients use TLS certificate to authenticate themselves. Normally, those client TLS certificates contain email, group like user@domain.com. When broker/proxy receives the client certificate, it parses the “user” and checks the “user/app” authorized to access the topic or not. For client authentication, you will need to setup pulsar authentication/authorization plugin. This part is described in here and missed in helm chart here.
n
Naresh
02/22/2024, 4:01 PMi am reading the configs of zk to begin and had luck so far configuring it with mTLS will go backwards to other pulsar components
Naresh
02/22/2024, 4:03 PM Copy code
###############
# SSL Configs #
###############
secureClientPort=2182
authProvider.x509=org.apache.zookeeper.server.auth.X509AuthenticationProvider
serverCnxnFactory=org.apache.zookeeper.server.NettyServerCnxnFactory
clientCnxnSocket=org.apache.zookeeper.ClientCnxnSocketNetty
# <https://github.com/apache/zookeeper/blob/master/zookeeper-server/src/main/java/org/apache/zookeeper/common/X509Util.java#L245>
ssl.protocol=TLSv1.3
ssl.enabledProtocols=TLSv1.3,TLSv1.2
ssl.keyStore.type=PEM
ssl.keyStore.location=./key.pem
ssl.keyStore.passwordPath=./pass.txt
ssl.trustStore.type=PEM
ssl.trustStore.location=./chain.pem
ssl.trustStore.passwordPath=
ssl.hostnameVerification=false
ssl.crl=false
ssl.ocsp=false
ssl.clientAuth=need
ssl.authProvider=x509
###################################
# Encrypted Quorum Communications #
###################################
# Enables encrypted quorum communication. Default is false
sslQuorum=true
leader.closeSocketAsync=true
learner.closeSocketAsync=true
ssl.quorum.protocol = TLSv1.3
ssl.quorum.enabledProtocols = TLSv1.3,TLSv1.2
ssl.quorum.keyStore.type=PEM
ssl.quorum.keyStore.location=./key.pem
ssl.quorum.keyStore.passwordPath=./pass.txt
ssl.quorum.trustStore.type=PEM
ssl.quorum.trustStore.location=./chain.pem
ssl.quorum.trustStore.passwordPath=
ssl.crl=false
ssl.ocsp=false
ssl.clientAuth=need
ssl.authProvider=x5092 Views