How do you force rotation of user/password through kafka strimzi operator?

[yxiang92128]

After the KafkaUser is created, how do you force it to rotate its randomly generated password to a new one? We have requirement to rotate all user credentials on a set schedule.

Is there a best practice documented somewhere?

Thanks

[scholzj]

I do not think there is any special feature for it (feel free to open an enhancement issue if you think there should be one).

If you want to rotate the password, you can basically just delete the existing user secret and a new one with new password will be generated. So you can for example setup a CronJob to delete the secrets periodically if you want.

[yxiang92128]

I guess the same goes with the cluster/client CA as well? If the validity is set to be expiring by default in one year, I should set up a cron job to fetch the new "ca.crt" that it renewed?

[scholzj]

I'm not sure I follow. Certificates have validity baked into them. You can control it in the Kafka custom resource for how long they should be valid and how early before the expiration should they be renewed (keep in mind that if you change the values, they will be used in the next renewal and not immediately).

[yxiang92128]

What I meant is when the CA renews, the clients need to fetch the new one and start to use it instead of the old one. How that is being handled is unknown to us. I think a cron job might work in this case.

[scholzj]

Ahh, ok. Well, that depends on the client, where it runs, how it sues the secret etc. You can for example use the https://github.com/strimzi/kafka-kubernetes-config-provider to load it directly form the secret etc.