Skip to content

Commit 30ebc0e

Browse files
zhaochun-mazhaochun-ma
authored
example for mds, kafkaRest, schema-registry and ksqldb separate certs example (#220)
1 parent 285a2a0 commit 30ebc0e

35 files changed

+1671
-0
lines changed

‎security/separate-listener-tls-rbac/README.rst

+415
Large diffs are not rendered by default.

‎security/separate-listener-tls-rbac/bearer.txt

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
username=kafka
2+
password=kafka-secret

‎security/separate-listener-tls-rbac/c3-mds-client.txt

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
username=c3
2+
password=c3-secret

‎security/separate-listener-tls-rbac/ca-key.pem

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
MIIEowIBAAKCAQEAuAQ98+MtD+Nncd9EszvDONGpCDdt4DpaU6MRMJS3LDcas2nf
3+
AN7Jo3yov4nRszE7mvCTGOmdEspcYV4kDgveTNxIQVqoIQ9m9MUyHnYG5KpBqRDd
4+
epW4g8FhIWV5wC57NcENOWvZaFRN9KEcAhnQbjQ0C81BKzbDwiEgU2QhtOYPyBQh
5+
9yzZ5Sl1ahYzHMBgqbuoscfX+52EFkse7PSv3AQ6wEGRNS5NrX2Tsc3YN/6g7rup
6+
dVQfq2jovs7cq5zKs0/lrfd83Q2Qyxy2giHvkjDA8D48H0csdnjhjEmHv9C5QipY
7+
aCTmJFdUhkOQtY65xMwHoxDbpbdhgFSprvt/KQIDAQABAoIBACVa9xijbWpkR4Oe
8+
R1v7Lc5DAYVhezSho+SGnd620dhv90OkoliS4WwGylrXp3Iw9GCnpbTQ98nwuoAp
9+
lDglwKLptOFPfgH4FnZp8ZqtawjQZzPi8JMKAcL9ZrJY3zZcOTbYUc7uTdwYARs/
10+
+WeTxfQZNNeQe0JCg8rM3rsPAKiwEwdKB5SFoBTxGmiJhKRQd50LIdQfUGH7xHiD
11+
HfqVM78XZ0AqifdMHvKrsHmftGBoyc8pcjYs6vlIfGqUW4Uc8wL5/he+/C8PM6TX
12+
62pn20Qj0bM0LGTPFs8Bs0vn9OkmrnMpR5jwvsZWphcXrmTwvyUtXNeYJu0YqODF
13+
b4R1QWECgYEA51AIWDXol0CSvPXuhRHPCtqLEVJL/Jj7IbwFAz5jMP5v0pQ1icd/
14+
Bj64sjFeLaVrG8b6NSMtme1HjB+j+6U7qPwh7mDFnNQ2iFqgIUK4dWRQzRkWrc4n
15+
lNGqkomPK29Zc4Exn4E8ydYLS18OhJ+GPGWlbKp4/cfEnyJKwmFHvg8CgYEAy6f6
16+
QsdS8ylC1iHgTn0RH/qMNN3YcP0b3x1Sc8dx+GT8MYg4yL12M5kNK+fhKFaYP+JE
17+
Rpu/+ieqaVb0k0Hx1ObN40GNPTR+T/FrLtVwcwVoE2qrLmTqGyTfgWUIPOO3UZJV
18+
VxuzeBIoFTQuUoBEcntjhrWwEEIEMXvIAyFGp0cCgYBENgef65XBNJuQ+Xzy5MOH
19+
Udb8rqYVwQ8dbZKU2Err4bwb/vSiwp+kuc5BTemV0Ff7gvu5u7vwzlXw7kuvI5Sq
20+
Sl+/Ke5cRwAlyYO7Cy/V/lUNhj531nk5m3KPb902U8mvFAQMI1JHusTt3wQq+9fb
21+
66WSm9q+C7DhtH0TQRik5QKBgQCxpXow7AvYXiKWBQDTllbszTGmH+ngTXkVe09j
22+
/RLWeMhgMJJP0Kydv6D0rpUCCd9OwoGKEew5OoZ00swO89QOQbJQzOp1/Cc+drln
23+
Jfmr64hof4CIvLBVMynfhhDUhFJxTjMxA9HeKABc1qKdhpOuRSGA7VWCKQPdYjsL
24+
N+iYmwKBgD67+49A4fh6aOCSuo2S10e7T38io1aHobR/Kdx23wyW9gMHGO6fwX3X
25+
lDPq2a6gJelXTbsdoA3snZ93eIxbO9ovpx31Ab+rSVyNEzuI46zJU4NhBMzi7QO6
26+
BsvtrvwxIlx1KZ/4YMCq3YxKesIDBg6TZGgO+tEyM1ej5NyVGo3d
27+
-----END RSA PRIVATE KEY-----

‎security/separate-listener-tls-rbac/ca.pem

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDTjCCAjYCCQDJPjAdif7VsTANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJV
3+
UzELMAkGA1UECAwCQ0ExFTATBgNVBAcMDE1vdW50YWluVmlldzESMBAGA1UECgwJ
4+
Q29uZmx1ZW50MREwDwYDVQQLDAhPcGVyYXRvcjEPMA0GA1UEAwwGVGVzdENBMB4X
5+
DTIxMDQxOTE0MzcyOVoXDTI0MDExNDE0MzcyOVowaTELMAkGA1UEBhMCVVMxCzAJ
6+
BgNVBAgMAkNBMRUwEwYDVQQHDAxNb3VudGFpblZpZXcxEjAQBgNVBAoMCUNvbmZs
7+
dWVudDERMA8GA1UECwwIT3BlcmF0b3IxDzANBgNVBAMMBlRlc3RDQTCCASIwDQYJ
8+
KoZIhvcNAQEBBQADggEPADCCAQoCggEBALgEPfPjLQ/jZ3HfRLM7wzjRqQg3beA6
9+
WlOjETCUtyw3GrNp3wDeyaN8qL+J0bMxO5rwkxjpnRLKXGFeJA4L3kzcSEFaqCEP
10+
ZvTFMh52BuSqQakQ3XqVuIPBYSFlecAuezXBDTlr2WhUTfShHAIZ0G40NAvNQSs2
11+
w8IhIFNkIbTmD8gUIfcs2eUpdWoWMxzAYKm7qLHH1/udhBZLHuz0r9wEOsBBkTUu
12+
Ta19k7HN2Df+oO67qXVUH6to6L7O3KucyrNP5a33fN0NkMsctoIh75IwwPA+PB9H
13+
LHZ44YxJh7/QuUIqWGgk5iRXVIZDkLWOucTMB6MQ26W3YYBUqa77fykCAwEAATAN
14+
BgkqhkiG9w0BAQsFAAOCAQEAEBzR8yhMM3w0zfOObXqoEfTNJcAQ/naMfdb4qH5V
15+
IWFqY5cbru65rc66+kNpfliDyWsivh5UACahLnewTbiIp55a9WYzqXhChuw1TMfm
16+
J8Bm/fqcqtxT6thJX/wGsss+EZVZwbzid54tw2fC7wOUv76XUxa5OHYuWmSShaA9
17+
S83GjOh5yAdWvVStKM9KtxVty9uU1tJ95ouM4I8FvHMUbVrBlw/Zx0yBlaaVVuEZ
18+
b/m7I6kp/8dePDUlIR8OScDfQr5W0fFAcUO8n0/if6ZfGsIcuPm0gnhdCv61zZ8c
19+
QetbxfeQyAu/Hu9RmiPeOwHxMuIxChOnm2dYabYe1N2XeQ==
20+
-----END CERTIFICATE-----

‎security/separate-listener-tls-rbac/confluent-platform-mds-separate-listener.yaml

+339
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,339 @@
1+
apiVersion: platform.confluent.io/v1beta1
2+
kind: Zookeeper
3+
metadata:
4+
name: zookeeper
5+
namespace: confluent
6+
spec:
7+
replicas: 1
8+
image:
9+
application: confluentinc/cp-zookeeper:7.4.0
10+
init: confluentinc/confluent-init-container:2.6.0
11+
dataVolumeCapacity: 10Gi
12+
logVolumeCapacity: 10Gi
13+
authentication:
14+
type: digest
15+
jaasConfig:
16+
secretRef: credential
17+
tls:
18+
autoGeneratedCerts: true
19+
---
20+
apiVersion: platform.confluent.io/v1beta1
21+
kind: Kafka
22+
metadata:
23+
name: kafka
24+
namespace: confluent
25+
spec:
26+
replicas: 1
27+
image:
28+
application: confluentinc/cp-server:7.4.0
29+
init: confluentinc/confluent-init-container:2.6.0
30+
dataVolumeCapacity: 10Gi
31+
tls:
32+
autoGeneratedCerts: true
33+
listeners:
34+
internal:
35+
authentication:
36+
type: plain
37+
jaasConfig:
38+
secretRef: credential
39+
tls:
40+
enabled: true
41+
external:
42+
authentication:
43+
type: plain
44+
jaasConfig:
45+
secretRef: credential
46+
externalAccess:
47+
type: loadBalancer
48+
loadBalancer:
49+
domain: my.domain
50+
brokerPrefix: rb
51+
bootstrapPrefix: rb
52+
tls:
53+
enabled: true
54+
authorization:
55+
type: rbac
56+
superUsers:
57+
- User:kafka
58+
services:
59+
mds:
60+
tls:
61+
enabled: true
62+
tokenKeyPair:
63+
secretRef: mds-token
64+
listeners:
65+
internal:
66+
# Since no secretRef is specified, the mds internal listener
67+
# tls will piggyback mds.tls which also has no secretRef is specified,
68+
# so the Kafka auto-generated tls configuration will be used for this listener.
69+
tls:
70+
enabled: true
71+
external:
72+
tls:
73+
enabled: true
74+
secretRef: tls-mds
75+
externalAccess:
76+
type: loadBalancer
77+
loadBalancer:
78+
domain: my.domain
79+
prefix: rb-mds
80+
provider:
81+
type: ldap
82+
ldap:
83+
address: ldap://ldap.confluent.svc.cluster.local:389
84+
authentication:
85+
type: simple
86+
simple:
87+
secretRef: credential
88+
configurations:
89+
groupNameAttribute: cn
90+
groupObjectClass: group
91+
groupMemberAttribute: member
92+
groupMemberAttributePattern: CN=(.*),DC=test,DC=com
93+
groupSearchBase: dc=test,dc=com
94+
userNameAttribute: cn
95+
userMemberOfAttributePattern: CN=(.*),DC=test,DC=com
96+
userObjectClass: organizationalRole
97+
userSearchBase: dc=test,dc=com
98+
dependencies:
99+
kafkaRest:
100+
authentication:
101+
type: bearer
102+
bearer:
103+
secretRef: mds-client
104+
zookeeper:
105+
endpoint: zookeeper.confluent.svc.cluster.local:2182
106+
authentication:
107+
type: digest
108+
jaasConfig:
109+
secretRef: credential
110+
tls:
111+
enabled: true
112+
---
113+
apiVersion: platform.confluent.io/v1beta1
114+
kind: Connect
115+
metadata:
116+
name: connect
117+
namespace: confluent
118+
spec:
119+
replicas: 1
120+
image:
121+
application: confluentinc/cp-server-connect:7.4.0
122+
init: confluentinc/confluent-init-container:2.6.0
123+
tls:
124+
autoGeneratedCerts: true
125+
externalAccess:
126+
type: loadBalancer
127+
loadBalancer:
128+
domain: my.domain
129+
prefix: rb-connect
130+
authorization:
131+
type: rbac
132+
dependencies:
133+
kafka:
134+
bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
135+
authentication:
136+
type: plain
137+
jaasConfig:
138+
secretRef: credential
139+
tls:
140+
enabled: true
141+
mds:
142+
endpoint: https://kafka.confluent.svc.cluster.local:9090
143+
tokenKeyPair:
144+
secretRef: mds-token
145+
authentication:
146+
type: bearer
147+
bearer:
148+
secretRef: connect-mds-client
149+
tls:
150+
enabled: true
151+
---
152+
apiVersion: platform.confluent.io/v1beta1
153+
kind: SchemaRegistry
154+
metadata:
155+
name: schemaregistry
156+
namespace: confluent
157+
spec:
158+
replicas: 1
159+
image:
160+
application: confluentinc/cp-schema-registry:7.4.0
161+
init: confluentinc/confluent-init-container:2.6.0
162+
tls:
163+
autoGeneratedCerts: true
164+
externalAccess:
165+
type: loadBalancer
166+
loadBalancer:
167+
domain: my.domain
168+
prefix: rb-sr
169+
authorization:
170+
type: rbac
171+
dependencies:
172+
kafka:
173+
bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
174+
authentication:
175+
type: plain
176+
jaasConfig:
177+
secretRef: credential
178+
tls:
179+
enabled: true
180+
mds:
181+
endpoint: https://kafka.confluent.svc.cluster.local:9090
182+
tokenKeyPair:
183+
secretRef: mds-token
184+
authentication:
185+
type: bearer
186+
bearer:
187+
secretRef: sr-mds-client
188+
tls:
189+
enabled: true
190+
---
191+
apiVersion: platform.confluent.io/v1beta1
192+
kind: KafkaRestProxy
193+
metadata:
194+
name: kafkarestproxy
195+
namespace: confluent
196+
spec:
197+
replicas: 1
198+
image:
199+
application: confluentinc/cp-kafka-rest:7.4.0
200+
init: confluentinc/confluent-init-container:2.6.0
201+
tls:
202+
autoGeneratedCerts: true
203+
externalAccess:
204+
type: loadBalancer
205+
loadBalancer:
206+
domain: my.domain
207+
prefix: rb-krp
208+
authorization:
209+
type: rbac
210+
dependencies:
211+
kafka:
212+
bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
213+
authentication:
214+
type: plain
215+
jaasConfig:
216+
secretRef: credential
217+
tls:
218+
enabled: true
219+
mds:
220+
endpoint: https://kafka.confluent.svc.cluster.local:9090
221+
tokenKeyPair:
222+
secretRef: mds-token
223+
authentication:
224+
type: bearer
225+
bearer:
226+
secretRef: krp-mds-client
227+
tls:
228+
enabled: true
229+
schemaRegistry:
230+
url: https://schemaregistry.confluent.svc.cluster.local:8081
231+
tls:
232+
enabled: true
233+
---
234+
apiVersion: platform.confluent.io/v1beta1
235+
kind: KsqlDB
236+
metadata:
237+
name: ksqldb
238+
namespace: confluent
239+
spec:
240+
replicas: 1
241+
image:
242+
application: confluentinc/cp-ksqldb-server:7.4.0
243+
init: confluentinc/confluent-init-container:2.6.0
244+
dataVolumeCapacity: 10Gi
245+
authorization:
246+
type: rbac
247+
externalAccess:
248+
type: loadBalancer
249+
loadBalancer:
250+
domain: my.domain
251+
prefix: rb-ksql
252+
tls:
253+
autoGeneratedCerts: true
254+
dependencies:
255+
kafka:
256+
bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
257+
authentication:
258+
type: plain
259+
jaasConfig:
260+
secretRef: credential
261+
tls:
262+
enabled: true
263+
mds:
264+
endpoint: https://kafka.confluent.svc.cluster.local:9090
265+
tokenKeyPair:
266+
secretRef: mds-token
267+
authentication:
268+
type: bearer
269+
bearer:
270+
secretRef: ksqldb-mds-client
271+
tls:
272+
enabled: true
273+
---
274+
apiVersion: platform.confluent.io/v1beta1
275+
kind: ControlCenter
276+
metadata:
277+
name: controlcenter
278+
namespace: confluent
279+
spec:
280+
replicas: 1
281+
podTemplate:
282+
probe:
283+
liveness:
284+
periodSeconds: 10
285+
failureThreshold: 1
286+
timeoutSeconds: 5
287+
image:
288+
application: confluentinc/cp-enterprise-control-center:7.4.0
289+
init: confluentinc/confluent-init-container:2.6.0
290+
dataVolumeCapacity: 10Gi
291+
authorization:
292+
type: rbac
293+
tls:
294+
autoGeneratedCerts: true
295+
dependencies:
296+
kafka:
297+
bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
298+
authentication:
299+
type: plain
300+
jaasConfig:
301+
secretRef: credential
302+
tls:
303+
enabled: true
304+
mds:
305+
endpoint: https://kafka.confluent.svc.cluster.local:9090
306+
tokenKeyPair:
307+
secretRef: mds-token
308+
authentication:
309+
type: bearer
310+
bearer:
311+
secretRef: c3-mds-client
312+
tls:
313+
enabled: true
314+
connect:
315+
- name: connect
316+
url: https://connect.confluent.svc.cluster.local:8083
317+
tls:
318+
enabled: true
319+
ksqldb:
320+
- name: ksqldb
321+
url: https://ksqldb.confluent.svc.cluster.local:8088
322+
tls:
323+
enabled: true
324+
schemaRegistry:
325+
url: https://schemaregistry.confluent.svc.cluster.local:8081
326+
tls:
327+
enabled: true
328+
---
329+
apiVersion: platform.confluent.io/v1beta1
330+
kind: KafkaRestClass
331+
metadata:
332+
name: default
333+
namespace: confluent
334+
spec:
335+
kafkaRest:
336+
authentication:
337+
type: bearer
338+
bearer:
339+
secretRef: rest-credential

‎security/separate-listener-tls-rbac/connect-mds-client.txt

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
username=connect
2+
password=connect-secret

0 commit comments

Comments
 (0)