[KAFKA-6886] Externalize Secrets for Kafka Connect Configurations

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0
• Component/s: connect
• Assignee: Robert Yokota
• Reporter: Robert Yokota
• Created: 08/May/18 20:08
• Updated: 30/Aug/20 16:49
• Resolved: 30/May/18 21:43

Description

Kafka Connect's connector configurations have plaintext passwords, and Connect stores these in cleartext either on the filesystem (for standalone mode) or in internal topics (for distributed mode).

Connect should not store or transmit cleartext passwords in connector configurations. Secrets in stored connector configurations should be allowed to be replaced with references to values stored in external secret management systems. Connect should provide an extension point for adding customized integrations, as well as provide a file-based extension as an example. Second, a Connect runtime should be allowed to be configured to use one or more of these extensions, and allow connector configurations to use placeholders that will be resolved by the runtime before passing the complete connector configurations to connectors. This will allow existing connectors to not see any difference in the configurations that Connect provides to them at startup. And third, Connect's API should be changed to allow a connector to obtain the latest connector configuration at any time.

Issue Links

• is duplicated by: KAFKA-5117 Kafka Connect REST endpoints reveal Password typed values
• is related to: KAFKA-8774 Connect REST API exposes plaintext secrets in tasks endpoint if config value contains additional characters
• links to: GitHub Pull Request #5068
• mentioned in: Page Loading...