{"action":"created","comment":{"url":"https://api.github.com/repos/confluentinc/ksql/pulls/comments/175419583","pull_request_review_id":104943167,"id":175419583,"diff_hunk":"@@ -167,7 +167,141 @@ The maximum parallelism depends on the number of partitions.\n          against a two-partition input topic, only two servers perform the actual work, but the other eight will run an “idle”\n          query.\n \n+=================================================================================\n+Can KSQL connect to an Apache Kafka cluster over SSL and authenticate using SASL?\n+=================================================================================\n+\n+Yes. Internally, KSQL uses standard Kafka consumers and producers.\n+The procedure to securely connect KSQL to Kafka is the same as connecting any app to Kafka.\n+\n+For example, you can add the following entries to the KSQL server configuration file\n+(ksqlserver.properties). This configuration enables KSQL to connect to a secure Kafka","path":"docs/faq.rst","position":null,"original_position":12,"commit_id":"bf22ba8a52b414b2239598e8386d1165a1d20aeb","original_commit_id":"800366064823e56b2123f1159cf722af3b59f05a","user":{"login":"miguno","id":294849,"avatar_url":"https://avatars3.githubusercontent.com/u/294849?v=4","gravatar_id":"","url":"https://api.github.com/users/miguno","html_url":"https://github.com/miguno","followers_url":"https://api.github.com/users/miguno/followers","following_url":"https://api.github.com/users/miguno/following{/other_user}","gists_url":"https://api.github.com/users/miguno/gists{/gist_id}","starred_url":"https://api.github.com/users/miguno/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miguno/subscriptions","organizations_url":"https://api.github.com/users/miguno/orgs","repos_url":"https://api.github.com/users/miguno/repos","events_url":"https://api.github.com/users/miguno/events{/privacy}","received_events_url":"https://api.github.com/users/miguno/received_events","type":"User","site_admin":false},"body":"@big-andy-coates : Yes, you are right.  But what typically happens is that, in trainings/questions/etc many users will stick to whatever the default name is (and also copy-paste instructions verbatim).","created_at":"2018-03-19T12:38:40Z","updated_at":"2018-03-19T12:38:41Z","html_url":"https://github.com/confluentinc/ksql/pull/914#discussion_r175419583","pull_request_url":"https://api.github.com/repos/confluentinc/ksql/pulls/914","author_association":"OWNER","_links":{"self":{"href":"https://api.github.com/repos/confluentinc/ksql/pulls/comments/175419583"},"html":{"href":"https://github.com/confluentinc/ksql/pull/914#discussion_r175419583"},"pull_request":{"href":"https://api.github.com/repos/confluentinc/ksql/pulls/914"}},"in_reply_to_id":174950313},"pull_request":{"url":"https://api.github.com/repos/confluentinc/ksql/pulls/914","id":174390269,"html_url":"https://github.com/confluentinc/ksql/pull/914","diff_url":"https://github.com/confluentinc/ksql/pull/914.diff","patch_url":"https://github.com/confluentinc/ksql/pull/914.patch","issue_url":"https://api.github.com/repos/confluentinc/ksql/issues/914","number":914,"state":"open","locked":false,"title":"KSQL-707 - document what is needed to get KSQL working with a secure Kafka","user":{"login":"big-andy-coates","id":8012398,"avatar_url":"https://avatars0.githubusercontent.com/u/8012398?v=4","gravatar_id":"","url":"https://api.github.com/users/big-andy-coates","html_url":"https://github.com/big-andy-coates","followers_url":"https://api.github.com/users/big-andy-coates/followers","following_url":"https://api.github.com/users/big-andy-coates/following{/other_user}","gists_url":"https://api.github.com/users/big-andy-coates/gists{/gist_id}","starred_url":"https://api.github.com/users/big-andy-coates/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/big-andy-coates/subscriptions","organizations_url":"https://api.github.com/users/big-andy-coates/orgs","repos_url":"https://api.github.com/users/big-andy-coates/repos","events_url":"https://api.github.com/users/big-andy-coates/events{/privacy}","received_events_url":"https://api.github.com/users/big-andy-coates/received_events","type":"User","site_admin":false},"body":"Fix for: #861\r\n\r\n# Conclusions\r\n## SSL - Full support\r\nSSL is fully supported using standard Consumer/Producer config. There is now a test proving this and documentation, with link to the main Kafka docs.\r\n\r\n## SASL - Full support\r\nSSL is fully supported using standard Consumer/Producer config. There is now a test proving this and documentation, with link to the main Kafka docs.\r\n\r\n## ACLs - Partial support\r\nKafka Clusters that use ACLs can be supported, but require the KSQL user for interactive clusters to have open access to the Kafka resources. For non-interactive KSQL clusters the KSQL user can be locked down, but determining the list of ACLs that is needed is manual / painful / non-intuitive.\r\n\r\nIt should be possible to provide tooling to list out the required ACLs for a specific statement, or sql file, which would improve things dramatically. (#948 created to track).\r\n\r\nIt's also worth noting that the `SimpleAclAuthorizer` that comes with AK is not ideal for KSQL / Streams, as it does not support partial-wildcard or regex resource names. So you can not, for example, set ACLs in Kafka to allow KSQL rights to produce/consume from topics \"ksql_*\", or use consumer groups \"ksql_*\". I think if we want better integration with Kafka clusters running ACLs, then we need a better `Authorizer` implementation available in the brokers. We could initially ship this with KSQL/CP, until we can get it into the AK release. (#949 created to track).\r\n\r\n## Confluent Cloud - Supported\r\nDocs added to give users access to the settings @apurvam documented.\r\n\r\n## Secure Schema Repo - Supported (PITA)\r\nDocs added covering how KSQL can be configured to talk to the Schema Registry over HTTPS.\r\n\r\nHowever, this currently requires setting environment variables, as the SchemaRegistryClient we are using does not support receiving key store details via properties, as other Kafka components can. (#950 created to track)\r\n\r\n\r\n","created_at":"2018-03-12T14:46:30Z","updated_at":"2018-03-19T12:38:41Z","closed_at":null,"merged_at":null,"merge_commit_sha":"f396f53c77231ab51bb57ea705c83e00c1ffce3d","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/confluentinc/ksql/pulls/914/commits","review_comments_url":"https://api.github.com/repos/confluentinc/ksql/pulls/914/comments","review_comment_url":"https://api.github.com/repos/confluentinc/ksql/pulls/comments{/number}","comments_url":"https://api.github.com/repos/confluentinc/ksql/issues/914/comments","statuses_url":"https://api.github.com/repos/confluentinc/ksql/statuses/bf22ba8a52b414b2239598e8386d1165a1d20aeb","head":{"label":"big-andy-coates:howto_secure_ak","ref":"howto_secure_ak","sha":"bf22ba8a52b414b2239598e8386d1165a1d20aeb","user":{"login":"big-andy-coates","id":8012398,"avatar_url":"https://avatars0.githubusercontent.com/u/8012398?v=4","gravatar_id":"","url":"https://api.github.com/users/big-andy-coates","html_url":"https://github.com/big-andy-coates","followers_url":"https://api.github.com/users/big-andy-coates/followers","following_url":"https://api.github.com/users/big-andy-coates/following{/other_user}","gists_url":"https://api.github.com/users/big-andy-coates/gists{/gist_id}","starred_url":"https://api.github.com/users/big-andy-coates/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/big-andy-coates/subscriptions","organizations_url":"https://api.github.com/users/big-andy-coates/orgs","repos_url":"https://api.github.com/users/big-andy-coates/repos","events_url":"https://api.github.com/users/big-andy-coates/events{/privacy}","received_events_url":"https://api.github.com/users/big-andy-coates/received_events","type":"User","site_admin":false},"repo":{"id":122631155,"name":"ksql","full_name":"big-andy-coates/ksql","owner":{"login":"big-andy-coates","id":8012398,"avatar_url":"https://avatars0.githubusercontent.com/u/8012398?v=4","gravatar_id":"","url":"https://api.github.com/users/big-andy-coates","html_url":"https://github.com/big-andy-coates","followers_url":"https://api.github.com/users/big-andy-coates/followers","following_url":"https://api.github.com/users/big-andy-coates/following{/other_user}","gists_url":"https://api.github.com/users/big-andy-coates/gists{/gist_id}","starred_url":"https://api.github.com/users/big-andy-coates/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/big-andy-coates/subscriptions","organizations_url":"https://api.github.com/users/big-andy-coates/orgs","repos_url":"https://api.github.com/users/big-andy-coates/repos","events_url":"https://api.github.com/users/big-andy-coates/events{/privacy}","received_events_url":"https://api.github.com/users/big-andy-coates/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/big-andy-coates/ksql","description":"KSQL - the Streaming SQL Engine for Apache Kafka ","fork":true,"url":"https://api.github.com/repos/big-andy-coates/ksql","forks_url":"https://api.github.com/repos/big-andy-coates/ksql/forks","keys_url":"https://api.github.com/repos/big-andy-coates/ksql/keys{/key_id}","collaborators_url":"https://api.github.com/repos/big-andy-coates/ksql/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/big-andy-coates/ksql/teams","hooks_url":"https://api.github.com/repos/big-andy-coates/ksql/hooks","issue_events_url":"https://api.github.com/repos/big-andy-coates/ksql/issues/events{/number}","events_url":"https://api.github.com/repos/big-andy-coates/ksql/events","assignees_url":"https://api.github.com/repos/big-andy-coates/ksql/assignees{/user}","branches_url":"https://api.github.com/repos/big-andy-coates/ksql/branches{/branch}","tags_url":"https://api.github.com/repos/big-andy-coates/ksql/tags","blobs_url":"https://api.github.com/repos/big-andy-coates/ksql/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/big-andy-coates/ksql/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/big-andy-coates/ksql/git/refs{/sha}","trees_url":"https://api.github.com/repos/big-andy-coates/ksql/git/trees{/sha}","statuses_url":"https://api.github.com/repos/big-andy-coates/ksql/statuses/{sha}","languages_url":"https://api.github.com/repos/big-andy-coates/ksql/languages","stargazers_url":"https://api.github.com/repos/big-andy-coates/ksql/stargazers","contributors_url":"https://api.github.com/repos/big-andy-coates/ksql/contributors","subscribers_url":"https://api.github.com/repos/big-andy-coates/ksql/subscribers","subscription_url":"https://api.github.com/repos/big-andy-coates/ksql/subscription","commits_url":"https://api.github.com/repos/big-andy-coates/ksql/commits{/sha}","git_commits_url":"https://api.github.com/repos/big-andy-coates/ksql/git/commits{/sha}","comments_url":"https://api.github.com/repos/big-andy-coates/ksql/comments{/number}","issue_comment_url":"https://api.github.com/repos/big-andy-coates/ksql/issues/comments{/number}","contents_url":"https://api.github.com/repos/big-andy-coates/ksql/contents/{+path}","compare_url":"https://api.github.com/repos/big-andy-coates/ksql/compare/{base}...{head}","merges_url":"https://api.github.com/repos/big-andy-coates/ksql/merges","archive_url":"https://api.github.com/repos/big-andy-coates/ksql/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/big-andy-coates/ksql/downloads","issues_url":"https://api.github.com/repos/big-andy-coates/ksql/issues{/number}","pulls_url":"https://api.github.com/repos/big-andy-coates/ksql/pulls{/number}","milestones_url":"https://api.github.com/repos/big-andy-coates/ksql/milestones{/number}","notifications_url":"https://api.github.com/repos/big-andy-coates/ksql/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/big-andy-coates/ksql/labels{/name}","releases_url":"https://api.github.com/repos/big-andy-coates/ksql/releases{/id}","deployments_url":"https://api.github.com/repos/big-andy-coates/ksql/deployments","created_at":"2018-02-23T14:24:40Z","updated_at":"2018-02-23T14:24:43Z","pushed_at":"2018-03-19T11:51:44Z","git_url":"git://github.com/big-andy-coates/ksql.git","ssh_url":"git@github.com:big-andy-coates/ksql.git","clone_url":"https://github.com/big-andy-coates/ksql.git","svn_url":"https://github.com/big-andy-coates/ksql","homepage":"","size":6260,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"confluentinc:4.1.x","ref":"4.1.x","sha":"47b5e3e66a1fa92dc58298ab972698829dabdabd","user":{"login":"confluentinc","id":9439498,"avatar_url":"https://avatars0.githubusercontent.com/u/9439498?v=4","gravatar_id":"","url":"https://api.github.com/users/confluentinc","html_url":"https://github.com/confluentinc","followers_url":"https://api.github.com/users/confluentinc/followers","following_url":"https://api.github.com/users/confluentinc/following{/other_user}","gists_url":"https://api.github.com/users/confluentinc/gists{/gist_id}","starred_url":"https://api.github.com/users/confluentinc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/confluentinc/subscriptions","organizations_url":"https://api.github.com/users/confluentinc/orgs","repos_url":"https://api.github.com/users/confluentinc/repos","events_url":"https://api.github.com/users/confluentinc/events{/privacy}","received_events_url":"https://api.github.com/users/confluentinc/received_events","type":"Organization","site_admin":false},"repo":{"id":69400326,"name":"ksql","full_name":"confluentinc/ksql","owner":{"login":"confluentinc","id":9439498,"avatar_url":"https://avatars0.githubusercontent.com/u/9439498?v=4","gravatar_id":"","url":"https://api.github.com/users/confluentinc","html_url":"https://github.com/confluentinc","followers_url":"https://api.github.com/users/confluentinc/followers","following_url":"https://api.github.com/users/confluentinc/following{/other_user}","gists_url":"https://api.github.com/users/confluentinc/gists{/gist_id}","starred_url":"https://api.github.com/users/confluentinc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/confluentinc/subscriptions","organizations_url":"https://api.github.com/users/confluentinc/orgs","repos_url":"https://api.github.com/users/confluentinc/repos","events_url":"https://api.github.com/users/confluentinc/events{/privacy}","received_events_url":"https://api.github.com/users/confluentinc/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/confluentinc/ksql","description":"KSQL - the Streaming SQL Engine for Apache Kafka ","fork":false,"url":"https://api.github.com/repos/confluentinc/ksql","forks_url":"https://api.github.com/repos/confluentinc/ksql/forks","keys_url":"https://api.github.com/repos/confluentinc/ksql/keys{/key_id}","collaborators_url":"https://api.github.com/repos/confluentinc/ksql/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/confluentinc/ksql/teams","hooks_url":"https://api.github.com/repos/confluentinc/ksql/hooks","issue_events_url":"https://api.github.com/repos/confluentinc/ksql/issues/events{/number}","events_url":"https://api.github.com/repos/confluentinc/ksql/events","assignees_url":"https://api.github.com/repos/confluentinc/ksql/assignees{/user}","branches_url":"https://api.github.com/repos/confluentinc/ksql/branches{/branch}","tags_url":"https://api.github.com/repos/confluentinc/ksql/tags","blobs_url":"https://api.github.com/repos/confluentinc/ksql/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/confluentinc/ksql/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/confluentinc/ksql/git/refs{/sha}","trees_url":"https://api.github.com/repos/confluentinc/ksql/git/trees{/sha}","statuses_url":"https://api.github.com/repos/confluentinc/ksql/statuses/{sha}","languages_url":"https://api.github.com/repos/confluentinc/ksql/languages","stargazers_url":"https://api.github.com/repos/confluentinc/ksql/stargazers","contributors_url":"https://api.github.com/repos/confluentinc/ksql/contributors","subscribers_url":"https://api.github.com/repos/confluentinc/ksql/subscribers","subscription_url":"https://api.github.com/repos/confluentinc/ksql/subscription","commits_url":"https://api.github.com/repos/confluentinc/ksql/commits{/sha}","git_commits_url":"https://api.github.com/repos/confluentinc/ksql/git/commits{/sha}","comments_url":"https://api.github.com/repos/confluentinc/ksql/comments{/number}","issue_comment_url":"https://api.github.com/repos/confluentinc/ksql/issues/comments{/number}","contents_url":"https://api.github.com/repos/confluentinc/ksql/contents/{+path}","compare_url":"https://api.github.com/repos/confluentinc/ksql/compare/{base}...{head}","merges_url":"https://api.github.com/repos/confluentinc/ksql/merges","archive_url":"https://api.github.com/repos/confluentinc/ksql/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/confluentinc/ksql/downloads","issues_url":"https://api.github.com/repos/confluentinc/ksql/issues{/number}","pulls_url":"https://api.github.com/repos/confluentinc/ksql/pulls{/number}","milestones_url":"https://api.github.com/repos/confluentinc/ksql/milestones{/number}","notifications_url":"https://api.github.com/repos/confluentinc/ksql/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/confluentinc/ksql/labels{/name}","releases_url":"https://api.github.com/repos/confluentinc/ksql/releases{/id}","deployments_url":"https://api.github.com/repos/confluentinc/ksql/deployments","created_at":"2016-09-27T21:30:15Z","updated_at":"2018-03-19T03:51:39Z","pushed_at":"2018-03-19T11:51:46Z","git_url":"git://github.com/confluentinc/ksql.git","ssh_url":"git@github.com:confluentinc/ksql.git","clone_url":"https://github.com/confluentinc/ksql.git","svn_url":"https://github.com/confluentinc/ksql","homepage":"","size":6786,"stargazers_count":1478,"watchers_count":1478,"language":"Java","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":267,"mirror_url":null,"archived":false,"open_issues_count":205,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":267,"open_issues":205,"watchers":1478,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/confluentinc/ksql/pulls/914"},"html":{"href":"https://github.com/confluentinc/ksql/pull/914"},"issue":{"href":"https://api.github.com/repos/confluentinc/ksql/issues/914"},"comments":{"href":"https://api.github.com/repos/confluentinc/ksql/issues/914/comments"},"review_comments":{"href":"https://api.github.com/repos/confluentinc/ksql/pulls/914/comments"},"review_comment":{"href":"https://api.github.com/repos/confluentinc/ksql/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/confluentinc/ksql/pulls/914/commits"},"statuses":{"href":"https://api.github.com/repos/confluentinc/ksql/statuses/bf22ba8a52b414b2239598e8386d1165a1d20aeb"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"miguno"}}