SSL Security Configuration

Describes how to configure Kafka REST security on a MapR cluster.

Secure by Default

As of MapR 6.0, the MapR Installer performs the Kafka REST configuration for new installations. This means that:
  • If MapR core is installed as secure, then Kafka REST is also installed as secure.
  • If MapR core is installed as unsecure, then Kafka REST is also installed as unsecure.
IMPORTANT: In addition, every time the MapR configuration script is run with the -R option (configure.sh -R), the default settings for MapR core are re-established.

This means that if you manually configure Kafka REST for unsecure on a secure MapR core, Kafka REST will revert back to secure when configure.sh -R is run.

Manually Securing Kafka REST Only

CAUTION: This configuration is not a typical configuration.

If you have an unsecure MapR cluster, and you want to secure Kafka REST, do the following:

  1. Obtain the server and client certificates.
    The certificates are obtained by using the keytool: 
    cd /opt/mapr/conf/ keytool 
              -v -exportcert -alias cyber.mapr.cluster -keytool /opt/mapr/conf/ssl_truststore -rfc -file server.cert
  2. Add any necessary property configurations to the kafka-rest.properties configuration file. For example: 
    listeners=http://0.0.0.0:8082,https://0.0.0.0:8085 
ssl.keystore.location=/opt/mapr/conf/ssl_keystore
ssl.keystore.password=<ssl-keystore-password> 
ssl.key.password=<ssl-keystore-password>
  3. Restart Kafka REST.
    maprcli node services -name kafka-rest -action restart -nodes <space delimited list of nodes>
  4. Run a curl command to ensure that HTTPS is enabled. 
    curl -X GET https://node1:8085/streams/%2Ftesting/topics --cacert ./server.cert

Manually Unsecuring Kafka REST

WARNING: This scenario is NOT recommended or supported.

If you have an secure MapR cluster, and you want to unsecure Kafka REST, do the following:

  1. In the kafka-rest.properties configuration file, change https:// to http:// for the listeners and remove the ssl.* properties. For example: 
    listeners=http://0.0.0.0:8082,http://0.0.0.0:8085
  2. Restart Kafka REST.
    maprcli node services -name kafka-rest -action restart -nodes <space delimited list of nodes>