Authentication

The communication between nodes (server to server) is encrypted via TLS by default. In order to enforce TLS authentication for client-to-server communication, you can set an AuthenticationClass reference in the spec.clusterConfig.authentication property.

Currently it is possible to configure a single form of authentication (of type TLS) by adding one (and only one) entry in the authentication sequence as shown in the example below. Additional authentication methods, such as Kerberos, are not yet supported.

---
apiVersion: zookeeper.stackable.tech/v1alpha1
kind: ZookeeperCluster
metadata:
  name: simple-zk
spec:
  image:
    productVersion: 3.9.1
  clusterConfig:
    authentication:
      - authenticationClass: zk-client-tls (1)
  servers:
    roleGroups:
      default:
        replicas: 3
---
apiVersion: authentication.stackable.tech/v1alpha1
kind: AuthenticationClass
metadata:
  name: zk-client-tls (2)
spec:
  provider:
    tls:
      clientCertSecretClass: zk-client-auth-secret (3)
---
apiVersion: secrets.stackable.tech/v1alpha1
kind: SecretClass
metadata:
  name: zk-client-auth-secret (4)
spec:
  backend:
    autoTls:
      ca:
        secret:
          name: secret-provisioner-tls-zk-client-ca
          namespace: default
        autoGenerate: true
1 The clusterConfig.authentication.authenticationClass can be set to use TLS for authentication. This is optional.
2 The referenced AuthenticationClass that references a SecretClass to provide certificates.
3 The reference to a SecretClass.
4 The SecretClass that is referenced by the AuthenticationClass in order to provide certificates.

If both spec.clusterConfig.tls.server.secretClass and spec.clusterConfig.authentication.authenticationClass are set, the authentication class will take precedence over the secret class. The cluster will be encrypted and authenticate only against the authentication class.

Due to a bug in ZooKeeper, the clientPort property in combination with client.portUnification=true is used instead of the secureClientPort. This means that unencrypted and unauthenticated access to the ZooKeeper cluster is still possible.

Learn more