Skip to content

Commit b3e12fa

Browse files
author
Bernhard Berg
committed
Add KRaft broker deployment and augment README
1 parent b741af7 commit b3e12fa

File tree

2 files changed

+358
-1
lines changed

2 files changed

+358
-1
lines changed

‎security/production-secure-deploy-ldap-rbac-all/README.rst

+14-1
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,12 @@ Note that it is assumed that your Kubernetes cluster has a ``confluent`` namespa
4848

4949
helm upgrade --install operator confluentinc/confluent-for-kubernetes --namespace confluent
5050
51+
In case you choose to use KRaft brokers instead of zookeeper install the operator using:
52+
53+
::
54+
55+
helm upgrade --install operator confluentinc/confluent-for-kubernetes -n confluent --set kRaftEnabled=true
56+
5157
#. Check that the Confluent For Kubernetes pod comes up and is running:
5258

5359
::
@@ -137,7 +143,8 @@ Provide authentication credentials
137143

138144
This secret object contains file based properties. These files are in the
139145
format that each respective Confluent component requires for authentication
140-
credentials.
146+
credentials. If a KRaft broker is desired instead of zookeeper the credential
147+
files for zookeeper can still be used regardless.
141148

142149
::
143150
@@ -253,6 +260,12 @@ Deploy Confluent Platform
253260

254261
kubectl apply -f $TUTORIAL_HOME/confluent-platform-production.yaml --namespace confluent
255262

263+
If you choose a KRaft broker setup instead of zookeeper simply deploy:
264+
265+
::
266+
267+
kubectl apply -f $TUTORIAL_HOME/confluent-platform-production-using-kraft.yaml --namespace confluent
268+
256269
#. Check that all Confluent Platform resources are deployed:
257270

258271
::

‎security/production-secure-deploy-ldap-rbac-all/confluent-platform-production-using-kraft.yaml

+344
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,344 @@
1+
apiVersion: platform.confluent.io/v1beta1
2+
kind: KRaftController
3+
metadata:
4+
name: kraftcontroller
5+
namespace: confluent
6+
spec:
7+
replicas: 3
8+
image:
9+
application: confluentinc/cp-server:7.6.0
10+
init: confluentinc/confluent-init-container:2.8.0
11+
listeners:
12+
controller:
13+
tls:
14+
enabled: true
15+
authentication:
16+
type: plain
17+
jaasConfig:
18+
secretRef: credential
19+
tls:
20+
secretRef: tls-group1
21+
dataVolumeCapacity: 10G
22+
---
23+
apiVersion: platform.confluent.io/v1beta1
24+
kind: Kafka
25+
metadata:
26+
name: kafka
27+
namespace: confluent
28+
spec:
29+
replicas: 3
30+
image:
31+
application: confluentinc/cp-server:7.6.0
32+
init: confluentinc/confluent-init-container:2.8.0
33+
dataVolumeCapacity: 10Gi
34+
tls:
35+
secretRef: tls-group1
36+
listeners:
37+
internal:
38+
authentication:
39+
type: ldap
40+
jaasConfig:
41+
secretRef: credential
42+
tls:
43+
enabled: true
44+
external:
45+
externalAccess:
46+
type: nodePort
47+
nodePort:
48+
host: localhost
49+
nodePortOffset: 30000
50+
authentication:
51+
type: ldap
52+
jaasConfig:
53+
secretRef: credential
54+
tls:
55+
enabled: true
56+
authorization:
57+
type: rbac
58+
superUsers:
59+
- User:kafka
60+
services:
61+
kafkaRest:
62+
externalAccess:
63+
type: nodePort
64+
nodePort:
65+
host: localhost
66+
nodePortOffset: 30100
67+
mds:
68+
tls:
69+
enabled: true
70+
tokenKeyPair:
71+
secretRef: mds-token
72+
externalAccess:
73+
type: nodePort
74+
nodePort:
75+
host: localhost
76+
nodePortOffset: 30200
77+
provider:
78+
type: ldap
79+
ldap:
80+
address: ldap://ldap.confluent.svc.cluster.local:389
81+
authentication:
82+
type: simple
83+
simple:
84+
secretRef: credential
85+
configurations:
86+
groupNameAttribute: cn
87+
groupObjectClass: group
88+
groupMemberAttribute: member
89+
groupMemberAttributePattern: CN=(.*),DC=test,DC=com
90+
groupSearchBase: dc=test,dc=com
91+
userNameAttribute: cn
92+
userMemberOfAttributePattern: CN=(.*),DC=test,DC=com
93+
userObjectClass: organizationalRole
94+
userSearchBase: dc=test,dc=com
95+
dependencies:
96+
kafkaRest:
97+
authentication:
98+
type: bearer
99+
bearer:
100+
secretRef: mds-client
101+
kRaftController:
102+
controllerListener:
103+
tls:
104+
enabled: true
105+
authentication:
106+
type: ldap
107+
jaasConfig:
108+
secretRef: credential
109+
clusterRef:
110+
name: kraftcontroller
111+
namespace: confluent
112+
---
113+
apiVersion: platform.confluent.io/v1beta1
114+
kind: Connect
115+
metadata:
116+
name: connect
117+
namespace: confluent
118+
spec:
119+
replicas: 2
120+
image:
121+
application: confluentinc/cp-server-connect:7.6.0
122+
init: confluentinc/confluent-init-container:2.8.0
123+
tls:
124+
secretRef: tls-group1
125+
externalAccess:
126+
type: nodePort
127+
nodePort:
128+
host: localhost
129+
nodePortOffset: 30300
130+
authorization:
131+
type: rbac
132+
dependencies:
133+
kafka:
134+
bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
135+
authentication:
136+
type: plain
137+
jaasConfig:
138+
secretRef: credential
139+
tls:
140+
enabled: true
141+
mds:
142+
endpoint: https://kafka.confluent.svc.cluster.local:8090
143+
tokenKeyPair:
144+
secretRef: mds-token
145+
authentication:
146+
type: bearer
147+
bearer:
148+
secretRef: connect-mds-client
149+
tls:
150+
enabled: true
151+
---
152+
apiVersion: platform.confluent.io/v1beta1
153+
kind: SchemaRegistry
154+
metadata:
155+
name: schemaregistry
156+
namespace: confluent
157+
spec:
158+
replicas: 1
159+
image:
160+
application: confluentinc/cp-schema-registry:7.6.0
161+
init: confluentinc/confluent-init-container:2.8.0
162+
tls:
163+
secretRef: tls-group1
164+
externalAccess:
165+
type: nodePort
166+
nodePort:
167+
host: localhost
168+
nodePortOffset: 30400
169+
authorization:
170+
type: rbac
171+
dependencies:
172+
kafka:
173+
bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
174+
authentication:
175+
type: plain
176+
jaasConfig:
177+
secretRef: credential
178+
tls:
179+
enabled: true
180+
mds:
181+
endpoint: https://kafka.confluent.svc.cluster.local:8090
182+
tokenKeyPair:
183+
secretRef: mds-token
184+
authentication:
185+
type: bearer
186+
bearer:
187+
secretRef: sr-mds-client
188+
tls:
189+
enabled: true
190+
---
191+
apiVersion: platform.confluent.io/v1beta1
192+
kind: KafkaRestProxy
193+
metadata:
194+
name: kafkarestproxy
195+
namespace: confluent
196+
spec:
197+
replicas: 1
198+
image:
199+
application: confluentinc/cp-kafka-rest:7.6.0
200+
init: confluentinc/confluent-init-container:2.8.0
201+
tls:
202+
secretRef: tls-group1
203+
externalAccess:
204+
type: nodePort
205+
nodePort:
206+
host: localhost
207+
nodePortOffset: 30500
208+
authorization:
209+
type: rbac
210+
dependencies:
211+
kafka:
212+
bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
213+
authentication:
214+
type: plain
215+
jaasConfig:
216+
secretRef: credential
217+
tls:
218+
enabled: true
219+
mds:
220+
endpoint: https://kafka.confluent.svc.cluster.local:8090
221+
tokenKeyPair:
222+
secretRef: mds-token
223+
authentication:
224+
type: bearer
225+
bearer:
226+
secretRef: krp-mds-client
227+
tls:
228+
enabled: true
229+
schemaRegistry:
230+
url: https://schemaregistry.confluent.svc.cluster.local:8081
231+
tls:
232+
enabled: true
233+
---
234+
apiVersion: platform.confluent.io/v1beta1
235+
kind: KsqlDB
236+
metadata:
237+
name: ksqldb
238+
namespace: confluent
239+
spec:
240+
replicas: 2
241+
image:
242+
application: confluentinc/cp-ksqldb-server:7.6.0
243+
init: confluentinc/confluent-init-container:2.8.0
244+
dataVolumeCapacity: 10Gi
245+
authorization:
246+
type: rbac
247+
externalAccess:
248+
type: nodePort
249+
nodePort:
250+
host: localhost
251+
nodePortOffset: 30600
252+
tls:
253+
secretRef: tls-group1
254+
dependencies:
255+
kafka:
256+
bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
257+
authentication:
258+
type: plain
259+
jaasConfig:
260+
secretRef: credential
261+
tls:
262+
enabled: true
263+
mds:
264+
endpoint: https://kafka.confluent.svc.cluster.local:8090
265+
tokenKeyPair:
266+
secretRef: mds-token
267+
authentication:
268+
type: bearer
269+
bearer:
270+
secretRef: ksqldb-mds-client
271+
tls:
272+
enabled: true
273+
---
274+
apiVersion: platform.confluent.io/v1beta1
275+
kind: ControlCenter
276+
metadata:
277+
name: controlcenter
278+
namespace: confluent
279+
spec:
280+
replicas: 1
281+
podTemplate:
282+
probe:
283+
liveness:
284+
periodSeconds: 10
285+
failureThreshold: 5
286+
timeoutSeconds: 500
287+
image:
288+
application: confluentinc/cp-enterprise-control-center:7.6.0
289+
init: confluentinc/confluent-init-container:2.8.0
290+
dataVolumeCapacity: 10Gi
291+
authorization:
292+
type: rbac
293+
externalAccess:
294+
type: nodePort
295+
nodePort:
296+
host: localhost
297+
nodePortOffset: 30700
298+
tls:
299+
secretRef: tls-group1
300+
dependencies:
301+
kafka:
302+
bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
303+
authentication:
304+
type: plain
305+
jaasConfig:
306+
secretRef: credential
307+
tls:
308+
enabled: true
309+
mds:
310+
endpoint: https://kafka.confluent.svc.cluster.local:8090
311+
tokenKeyPair:
312+
secretRef: mds-token
313+
authentication:
314+
type: bearer
315+
bearer:
316+
secretRef: c3-mds-client
317+
tls:
318+
enabled: true
319+
connect:
320+
- name: connect
321+
url: https://connect.confluent.svc.cluster.local:8083
322+
tls:
323+
enabled: true
324+
ksqldb:
325+
- name: ksqldb
326+
url: https://ksqldb.confluent.svc.cluster.local:8088
327+
tls:
328+
enabled: true
329+
schemaRegistry:
330+
url: https://schemaregistry.confluent.svc.cluster.local:8081
331+
tls:
332+
enabled: true
333+
---
334+
apiVersion: platform.confluent.io/v1beta1
335+
kind: KafkaRestClass
336+
metadata:
337+
name: default
338+
namespace: confluent
339+
spec:
340+
kafkaRest:
341+
authentication:
342+
type: bearer
343+
bearer:
344+
secretRef: rest-credential

0 commit comments

Comments
 (0)