Support custom CA for 1-way TLS

fgeller / kt

Kafka command line tool that likes JSON

MIT License

950 stars 100 forks source link

Support custom CA for 1-way TLS #139

Closed jvansanten closed 1 year ago

jvansanten commented 1 year ago

Some Kafka clusters use TLS as a backdoor load-balancing mechanism, see e.g. strimzi's ingress feature. These are impossible to use with kt if the cluster uses a self-signed certificate, as it uses a default tls.Config in 1-way TLS mode. This PR adds the following features:

use ca-certificate if provided even in 1-way TLS mode
raise authentication errors in group and topic commands, rather than silently falling back to an unencrypted connection

fgeller commented 1 year ago

👋 @jvansanten thank you for contributing! the changes lgtm -- thanks for boyscouting as well 🙏 do you want to follow up with a readme update?