joycse06

....
  {{- with $d := key $consul_key | parseJSON -}}
    {{- $pki_issuer := $d.primary_issuer -}}
    ....

    {{- with secret $pki_path $common_name_param $ttl_param -}}
    ....

    {{- range $secondary_path := $d.secondary_issuers -}}
    ....

joycse06

0 .. Sectigo Limited….
1 .. The USERTRUST Network/CN=USERTrust RSA
2 .. CN=AddTrust External CA Root
3 .. CN=AddTrust External CA Root

joycse06

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: kafka-consumer
  namespace: default
  labels:
    project: kafka-consumer
    team: event-streamer
  annotations:
    kafka-auth/enable: 'true'

joycse06

{
  "primary_issuer": "kafka-pki/root-b",
  "secondary_issuers": []
}

joycse06

{
  "primary_issuer": "kafka-pki/root-b",
  "secondary_issuers": ["kafka-pki/root-a"]
}

joycse06

{
  "primary_issuer": "kafka-pki/root-a",
  "secondary_issuers": ["kafka-pki/root-b"]
}

joycse06

{
  "primary_issuer": "kafka-pki/root-a",
  "secondary_issuers": []
}

joycse06

resource "consul_keys" "root" {
  key {
    path = "some/path/in/consul"
    value = <<-EOT
    {
      "primary_issuer": "kafka-pki/root-a",
      "secondary_issuers": []
    }
    EOT
  }

joycse06

locals {
  kafka_pki_prefix             = "prefix"
  kafka_broker_allowed_domains = ["broker.kafka.com"]
  kafka_client_allowed_domains = ["client.kafka.com"]
}

module "root_a" {
 source                 = "./common/kafka_pki"
 path                   = "${local.kafka_pki_prefix}/root-a"
 root_ca_common_name    = "Root A"

joycse06

-Dcom.sun.security.enableCRLDP=true -Dcom.sun.net.ssl.checkRevocation=true