Native Kubernetes/OpenShift Secret Management for Kafka Sensor Credentials

Problem Statement

Kafka environments frequently require SSL/mTLS authentication using truststores, keystores, and associated passwords. Security best practices prohibit storing these credentials in plaintext configuration files.

Customers attempting to use Instana's secret loading mechanism for Kafka sensor credentials encounter issues, including failures related to secret resolution and sensor access to agent-based secret providers.

Enhancement Request

Provide native secret management support for Kafka sensor configuration by allowing credentials to be sourced directly from:

• Kubernetes Secrets
• OpenShift Secrets
• Mounted secret files
• Existing Instana secret provider mechanisms
• Example: 

sslTrustStorePassword:

type: k8s_secret

secretName: kafka-ssl-secret

key: truststore-password
 

sslKeyStorePassword:

type: k8s_secret

secretName: kafka-ssl-secret

key: keystore-password

In addition:

• Ensure all Kafka sensor components can access secret provider functionality consistently.
• Eliminate classloader dependency issues that prevent secret resolution.
• Fully document supported secret-management patterns.

Business Justification

• Security and compliance requirements increasingly mandate secret-based credential management.
• Plaintext passwords in ConfigMaps or configuration files are unacceptable in many regulated industries.
• Aligns Instana with Kubernetes and OpenShift security best practices.
• Reduces security risk and operational burden for customers.