密码文件而不是kafka ssl设置中的纯文本密码

Question

If a system generates password and keys per host and copies (there are approx 50 hosts with differnt passwords) them to specified location on each host

i.e. on host host1

/a/b/c/xyj_host1.p12
/a/b/c/xyj_host1.p12.pwd 

In server.properties file of kafka I want to specify file location instead plain password for kafka (reason: I deploy on those 50+ servers using Ansible and its security hole if I have to specify password at the time of deployment)

ssl.truststore.location=/a/b/c/xyj_host1.p12
# instead of passoword I want to specify the file which contains password
ssl.truststore.password=/a/b/c/xyj_host1.p12.pwd  

How can I make above happen?

Answer 1

Kafka Connect can externalize secrets to files, but the brokers cannot

If you want to protect secrets in Ansible, then Ansible Vault seems to be the solution there, as far as the broker goes, restrict the file permissions to the server properties

There are other solutions still that could combine Hashicorp Vault with a templated property file (consul-template), but you'd still have a plaintext Vault token floating around, so really depends on how much you want to obfuscate your security