search

lsst-sqre / strimzi-registry-operator

A Kubernetes Operator for running the Confluent Schema Registry with a Strimzi-based Kafka cluster
MIT License
81 stars 17 forks source link

DM-32353: Configure operator's cluster and namespace with env vars #3

Closed spenczar closed 3 years ago

spenczar commented 3 years ago

Fixes #2, I think.

I have never touched operators so I don't reeeeeally know whether this is the right way to do things, but I think it might work.

jonathansick commented 3 years ago

@spenczar Hey thanks. It's been a while since I've been in this code base so I'll have to refresh myself on the issues. And also migrate to GitHub Actions :)

One thing you might want to do instead of this operator, though, is look into whether modern Strimzi does everything you need. The new Strimzi includes PKCS #12 certificates and passwords in its TLS secrets now. The role of this operator was essentially just to convert TLS certs into that format for the Schema Registry. Now to be honest, I haven't deployed a newer Strimzi in Roundtable, so I don't know how hard it would be configure Schema Registry's deployment to look at the secret from strimzi; but that's what I'd actually try first rather than this project. The strimzi docs are here: https://strimzi.io/docs/operators/in-development/using.html#tls_client_authentication

spenczar commented 3 years ago

Oh, interesting point.

The other thing that this operator seemed to do was respond to changes in the cluster CA cert, triggering a deployment update. This seems pretty useful too. But maybe Strimzi automatically handles that these days?

spenczar commented 3 years ago

I've spent the last 5 hours getting kind of lost in the weeds with configuring a Schema Registry myself on top of Strimzi. I think I have a long way to go.

But this operator actually does work for me currently, once the three PRs (this one, #7, and #6) are applied - I have a forked version running on GKE right now. So, I think I'd pretty strongly prefer to use this operator. I think it's actually pretty good!

jonathansick commented 3 years ago

Yeah, that's fair, I forgot that you'd need to restart the registry. Darn, I was hoping to have one less piece of my code in the critical path! I'll get through these PRs in the next day or so.