confluent-platform-mtls-sasl-rbac.yaml

apiVersion: platform.confluent.io/v1beta1
kind: Zookeeper
metadata:
  name: zookeeper
  namespace: confluent
spec:
  replicas: 3
  image:
    application: confluentinc/cp-zookeeper:7.9.0
    init: confluentinc/confluent-init-container:2.11.0
  dataVolumeCapacity: 10Gi
  logVolumeCapacity: 10Gi
  authentication:
    type: mtls
  tls:
    secretRef: tls-zookeeper
---
apiVersion: platform.confluent.io/v1beta1
kind: Kafka
metadata:
  name: kafka
  namespace: confluent
spec:
  replicas: 3
  image:
    application: confluentinc/cp-server:7.9.0
    init: confluentinc/confluent-init-container:2.11.0
  dataVolumeCapacity: 10Gi
  tls:
    secretRef: tls-kafka
  listeners:
    internal:
      authentication:
        type: mtls
        principalMappingRules:
          - RULE:.*CN[\\s]?=[\\s]?([a-zA-Z0-9.]*)?.*/$1/
      tls:
        enabled: true
        # Will use the certificates in the parent secretRef tls-kafka
    external:
      authentication:
        type: plain
        jaasConfig:
          secretRef: credential
      tls:
        enabled: true
        # Will use the certificates in the parent secretRef tls-kafka
      externalAccess:
        type: loadBalancer
        loadBalancer:
          domain: cfk-demo.app
          brokerPrefix: kafka
          bootstrapPrefix: kafka
  authorization:
    type: rbac
    superUsers:
    - User:kafka
  services:
    mds:
      tls:
        enabled: true
      tokenKeyPair:
        secretRef: mds-token
      provider:
        type: ldap
        ldap:
          address: ldap://ldap.confluent.svc.cluster.local:389
          authentication:
            type: simple
            simple:
              secretRef: credential
          configurations:
            groupNameAttribute: cn
            groupObjectClass: group
            groupMemberAttribute: member
            groupMemberAttributePattern: CN=(.*),DC=test,DC=com
            groupSearchBase: dc=test,dc=com
            groupSearchScope: 1
            userNameAttribute: cn
            userMemberOfAttributePattern: CN=(.*),DC=test,DC=com
            userObjectClass: organizationalRole
            userSearchBase: dc=test,dc=com
            userSearchScope: 1
  dependencies:
    kafkaRest:
      authentication:
        type: bearer
        bearer:
          secretRef: mds-client
    zookeeper:
      endpoint: zookeeper.confluent.svc.cluster.local:2182
      authentication:
        type: mtls
      tls:
        enabled: true
---
apiVersion: platform.confluent.io/v1beta1
kind: Connect
metadata:
  name: connect
  namespace: confluent
spec:
  replicas: 2
  image:
    application: confluentinc/cp-server-connect:7.9.0
    init: confluentinc/confluent-init-container:2.11.0
  tls:
    secretRef: tls-connect
  externalAccess:
    type: loadBalancer
    loadBalancer:
      domain: cfk-demo.app
      prefix: connect
  authorization:
    type: rbac
  dependencies:
    kafka:
      bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
      authentication:
        type: mtls
      tls:
        enabled: true
    mds:
      endpoint: https://kafka.confluent.svc.cluster.local:8090
      tokenKeyPair:
        secretRef: mds-token
      authentication:
        type: bearer
        bearer:
          secretRef: connect-mds-client
      tls:
        enabled: true
---
apiVersion: platform.confluent.io/v1beta1
kind: SchemaRegistry
metadata:
  name: schemaregistry
  namespace: confluent
spec:
  replicas: 1
  image:
    application: confluentinc/cp-schema-registry:7.9.0
    init: confluentinc/confluent-init-container:2.11.0
  tls:
    secretRef: tls-schemaregistry
  externalAccess:
    type: loadBalancer
    loadBalancer:
      domain: cfk-demo.app
      prefix: sr
  authorization:
    type: rbac
  dependencies:
    kafka:
      bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
      authentication:
        type: mtls
      tls:
        enabled: true
    mds:
      endpoint: https://kafka.confluent.svc.cluster.local:8090
      tokenKeyPair:
        secretRef: mds-token
      authentication:
        type: bearer
        bearer:
          secretRef: sr-mds-client
      tls:
        enabled: true
---
apiVersion: platform.confluent.io/v1beta1
kind: KsqlDB
metadata:
  name: ksqldb
  namespace: confluent
spec:
  replicas: 2
  image:
    application: confluentinc/cp-ksqldb-server:7.9.0
    init: confluentinc/confluent-init-container:2.11.0
  dataVolumeCapacity: 10Gi
  authorization:
    type: rbac
  externalAccess:
    type: loadBalancer
    loadBalancer:
      domain: cfk-demo.app
      prefix: ksql
  tls:
    secretRef: tls-ksqldb
  dependencies:
    kafka:
      bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
      authentication:
        type: mtls
      tls:
        enabled: true
    mds:
      endpoint: https://kafka.confluent.svc.cluster.local:8090
      tokenKeyPair:
        secretRef: mds-token
      authentication:
        type: bearer
        bearer:
          secretRef: ksqldb-mds-client
      tls:
        enabled: true
---
apiVersion: platform.confluent.io/v1beta1
kind: ControlCenter
metadata:
  name: controlcenter
  namespace: confluent
spec:
  replicas: 1
  podTemplate:
    probe:
      liveness:
        periodSeconds: 10
        failureThreshold: 5
        timeoutSeconds: 500
    resources:
      requests:
        memory: "8Gi"
        cpu: "2000m"
  image:
    application: confluentinc/cp-enterprise-control-center:7.9.0
    init: confluentinc/confluent-init-container:2.11.0
  dataVolumeCapacity: 10Gi
  authorization:
    type: rbac
  externalAccess:
    type: loadBalancer
    loadBalancer:
      domain: cfk-demo.app
      prefix: controlcenter
  tls:
    secretRef: tls-controlcenter
  dependencies:
    kafka:
      bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
      authentication:
        type: mtls
      tls:
        enabled: true
    mds:
      endpoint: https://kafka.confluent.svc.cluster.local:8090
      tokenKeyPair:
        secretRef: mds-token
      authentication:
        type: bearer
        bearer:
          secretRef: c3-mds-client
      tls:
        enabled: true
    connect:
      - name: connect
        url:  https://connect.confluent.svc.cluster.local:8083
        tls:
          enabled: true
    ksqldb:
      - name: ksqldb
        url:  https://ksqldb.confluent.svc.cluster.local:8088
        tls:
          enabled: true
    schemaRegistry:
      url: https://schemaregistry.confluent.svc.cluster.local:8081
      tls:
        enabled: true
---
apiVersion: platform.confluent.io/v1beta1
kind: KafkaRestClass
metadata:
  name: default
  namespace: confluent
spec:
  kafkaRest:
    authentication:
      type: bearer
      bearer:
        secretRef: rest-credential