-
Notifications
You must be signed in to change notification settings - Fork 78
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
kafka: kerberos and authz support (#79)
* Added Kerberos Authz support and configuration, modified health check to support kerberos and authz * Added description and display name for kerberos and authz params * Use mesosphere kafka image * Use kafka image 0.3.0, Minor Fixes * [DCOS-58615] KUDO Kafka document kerberos feature (#1) * Add security.md * Updated settings.md * Added documentation for Kerberos and ACL functionality of KUDO Kafka * Added kerberos with health check settings in configuration.md
- Loading branch information
1 parent
9b461c1
commit 01ed089
Showing
11 changed files
with
409 additions
and
29 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| # Security | ||
|
|
||
| ## Authentication | ||
|
|
||
| KUDO Kafka currently supports Kerberos authentication. | ||
|
|
||
| ### Kerberos Authentication | ||
|
|
||
| Kerberos authentication relies on a central authority to verify that Kafka clients (be it broker, consumer, or producer) are who they say they are. KUDO Kafka integrates with your existing Kerberos infrastructure to verify the identity of clients. | ||
|
|
||
| #### Prerequisites | ||
|
|
||
| * The hostname and port of a KDC reachable from the inside of k8s cluster | ||
| * Sufficient access to the KDC to create Kerberos principals | ||
| * Sufficient access to the KDC to retrieve a keytab for the generated principals | ||
| * `kubectl` installed | ||
|
|
||
| #### Configure Kerberos Authentication | ||
|
|
||
| ##### Create principals | ||
|
|
||
| The KUDO Kafka service requires a Kerberos principal for each broker to be deployed. Each principal must be of the form | ||
| ``` | ||
| <service primary>/kafka-kafka-<broker index>.kafka-svc.<namespace>.svc.cluster.local@<service realm> | ||
| ``` | ||
| with: | ||
| * ```service primary = KERBEROS_PRIMARY``` | ||
| * ```broker index = 0 up to BROKER_COUNT - 1``` | ||
| * ```namespace = kubernetes namespace``` | ||
| * ```service realm = KERBEROS_REALM``` | ||
|
|
||
| For example, if installing with these options: | ||
| ``` | ||
| kubectl kudo install kafka \ | ||
| --instance=kafka --namespace=kudo-kafka \ | ||
| -p ZOOKEEPER_URI=zk-zookeeper-0.zk-hs:2181,zk-zookeeper-1.zk-hs:2181,zk-zookeeper-2.zk-hs:2181 \ | ||
| -p KERBEROS_ENABLED=true \ | ||
| -p KERBEROS_DEBUG=false\ | ||
| -p KERBEROS_PRIMARY=kafka\ | ||
| -p KERBEROS_REALM=LOCAL\ | ||
| -p KERBEROS_KDC_HOSTNAME=kdc-service.kudo-kafka.svc.cluster.local \ | ||
| -p KERBEROS_KDC_PORT=2500 \ | ||
| -p KERBEROS_KEYTAB_SECRET="base64-kafka-keytab-secret" | ||
| ``` | ||
| then the principals to create would be: | ||
| ``` | ||
| kafka/kafka-kafka-0.kafka-svc.kudo-kafka.svc.cluster.local@LOCAL | ||
| kafka/kafka-kafka-1.kafka-svc.kudo-kafka.svc.cluster.local@LOCAL | ||
| kafka/kafka-kafka-2.kafka-svc.kudo-kafka.svc.cluster.local@LOCAL | ||
| ``` | ||
| #### Place Service Keytab in Kubernetes Secret Store | ||
|
|
||
| The KUDO Kafka service uses a keytab containing all node principals (service keytab). After creating the principals above, generate the service keytab making sure to include all the node principals. This should be stored as a secret in the Kubernetes Secret Store using `base64` encoding. | ||
|
|
||
| ## Authorization | ||
|
|
||
| The KUDO Kafka service supports Kafka’s ACL-based authorization system. To use Kafka’s ACLs, Kerberos authentication must be enabled as detailed above. | ||
|
|
||
| ### Enable Authorization | ||
|
|
||
| #### Prerequisites | ||
|
|
||
| * Completion of Kerberos authentication above. | ||
|
|
||
| ### Install the Service | ||
|
|
||
| Install the KUDO Kafka service with the following options in addition to your own (remember, Kerberos must be enabled): | ||
|
|
||
| ``` | ||
| kubectl kudo install kafka \ | ||
| --instance=kafka --namespace=kudo-kafka \ | ||
| -p ZOOKEEPER_URI=zk-zookeeper-0.zk-hs:2181,zk-zookeeper-1.zk-hs:2181,zk-zookeeper-2.zk-hs:2181 \ | ||
| -p BROKER_COUNT=3 \ | ||
| -p KERBEROS_ENABLED=true \ | ||
| -p KERBEROS_DEBUG=false \ | ||
| -p KERBEROS_PRIMARY=kafka\ | ||
| -p KERBEROS_REALM=LOCAL\ | ||
| -p KERBEROS_KEYTAB_SECRET="base64-kafka-keytab-secret" | ||
| -p AUTHORIZATION_ENABLED=<true|false default false> \ | ||
| -p AUTHORIZATION_ALLOW_EVERYONE_IF_NO_ACL_FOUND=<true|false default false> \ | ||
| -p AUTHORIZATION_SUPER_USERS="User:User1" | ||
| ``` | ||
|
|
||
| The format of the list is `User:user1;User:user2;....` Using Kerberos authentication, the “user” value is the Kerberos primary. The Kafka brokers themselves are automatically designated as super users. | ||
|
|
||
| NOTE: It is possible to enable Authorization after initial installation but the service may become unavailable during the transition. Additionally, Kafka clients may fail to function if they do not have the correct ACLs assigned to their principals. During the transition `AUTHORIZATION_ALLOW_EVERYONE_IF_NO_ACL_FOUND` can be set to `true` to prevent clients from failing until their ACLs can be set correctly. After the transition, `AUTHORIZATION_ALLOW_EVERYONE_IF_NO_ACL_FOUND` should be reset back to `false`. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,99 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: bootstrap | ||
| data: | ||
| bootstrap.sh: | | ||
| #!/usr/bin/env bash | ||
| cp /health-check-script/health-check.sh health-check.sh; | ||
| chmod +x health-check.sh; | ||
| {{ if eq .Params.KERBEROS_ENABLED "true" }} | ||
| cat /kafka-keytab/kafka.keytab | base64 --decode > kafka.keytab; | ||
| cp /jass-config/kafka_server_jaas.conf $KAFKA_HOME/config/kafka_server_jaas.conf; | ||
| cp /krb5-config/krb5.conf $KAFKA_HOME/config/krb5.conf; | ||
| sed -i "s/<HOSTNAME>/$(hostname -f)/g" $KAFKA_HOME/config/kafka_server_jaas.conf; | ||
| export KAFKA_OPTS="-Djava.security.auth.login.config=${KAFKA_HOME}/config/kafka_server_jaas.conf -Djava.security.krb5.conf=${KAFKA_HOME}/config/krb5.conf $KAFKA_OPTS" | ||
| {{ if eq .Params.KERBEROS_DEBUG "true" }} | ||
| export KAFKA_OPTS="-Dsun.security.krb5.debug=true $KAFKA_OPTS" | ||
| {{ end }} | ||
| {{ end }} | ||
| KAFKA_BROKER_ID=${HOSTNAME##*-} | ||
| # LISTENERS CONFIGURATION | ||
| LISTENERS="INTERNAL://0.0.0.0:${KAFKA_BROKER_PORT}" | ||
| # ADVERTISED LISTENERS | ||
| ADVERTISED_LISTENERS="INTERNAL://$(hostname -f):${KAFKA_BROKER_PORT}" | ||
| {{ if eq .Params.KERBEROS_ENABLED "true" }} | ||
| LISTENER_SECURITY_PROTOCOL_MAP="INTERNAL:SASL_PLAINTEXT" | ||
| # INTER_BROKER_SECURITY_PROTOCOL="SASL_PLAINTEXT" | ||
| {{ else }} | ||
| LISTENER_SECURITY_PROTOCOL_MAP="INTERNAL:PLAINTEXT" | ||
| # INTER_BROKER_SECURITY_PROTOCOL="PLAINTEXT" | ||
| {{ end }} | ||
| SASL_ENABLED_MECHANISMS="" | ||
| if [[ "$KAFKA_CLIENT_ENABLED" = "true" ]]; then | ||
| LISTENERS="${LISTENERS},CLIENT://0.0.0.0:${KAFKA_CLIENT_PORT}" | ||
| ADVERTISED_LISTENERS="${ADVERTISED_LISTENERS},CLIENT://$(hostname -f):${KAFKA_CLIENT_PORT}" | ||
| if [[ "$KAFKA_CLIENT_AUTHENTICATION" = "scram-sha-512" ]]; then | ||
| SASL_ENABLED_MECHANISMS="SCRAM-SHA-512\n$SASL_ENABLED_MECHANISMS" | ||
| LISTENER_SECURITY_PROTOCOL_MAP="${LISTENER_SECURITY_PROTOCOL_MAP},CLIENT:SASL_PLAINTEXT" | ||
| CLIENT_LISTENER=$(cat <<EOF | ||
| # CLIENT listener authentication | ||
| listener.name.client.scram-sha-512.sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required; | ||
| EOF | ||
| ) | ||
| else | ||
| LISTENER_SECURITY_PROTOCOL_MAP="${LISTENER_SECURITY_PROTOCOL_MAP},CLIENT:PLAINTEXT" | ||
| fi | ||
| fi | ||
| export KAFKA_LOG_DIR_PATH="${LOG_DIR}/log${KAFKA_BROKER_ID}" | ||
| if [[ -e ${KAFKA_HOME}/init/rack.id ]]; then | ||
| export RACK_ID=$(cat ${KAFKA_HOME}/init/rack.id) | ||
| fi | ||
| {{ if eq .Params.AUTHORIZATION_ENABLED "true" }} | ||
| # Calculate Kafka Authorization Super Users | ||
| SUPER_USERS=() | ||
| {{ if .Params.AUTHORIZATION_SUPER_USERS }} | ||
| SUPER_USERS="{{ .Params.AUTHORIZATION_SUPER_USERS }}" | ||
| SUPER_USERS=(${SUPER_USERS//;/ }) | ||
| {{ end }} | ||
| {{ if eq .Params.KERBEROS_ENABLED "true" }} | ||
| SUPER_USERS=("${SUPER_USERS[@]}" "User:{{ .Params.KERBEROS_PRIMARY }}") | ||
| {{ end }} | ||
| SUPER_USERS=$(printf ";%s" "${SUPER_USERS[@]}") | ||
| SUPER_USERS=${SUPER_USERS:1} | ||
| {{ end }} | ||
| # Set Environment | ||
| echo "KAFKA_OPTS=\"$KAFKA_OPTS\"" > ${KAFKA_HOME}/.env | ||
| KAFKA_CONFIGURATION=$(cat /config/server.properties) | ||
| # Write the config file | ||
| cat > ${KAFKA_HOME}/server.properties <<EOF | ||
| broker.id=${KAFKA_BROKER_ID} | ||
| broker.rack=${RACK_ID} | ||
| # Listeners | ||
| listeners=${LISTENERS} | ||
| advertised.listeners=${ADVERTISED_LISTENERS} | ||
| listener.security.protocol.map=${LISTENER_SECURITY_PROTOCOL_MAP} | ||
| inter.broker.listener.name=INTERNAL | ||
| #security.inter.broker.protocol=${INTER_BROKER_SECURITY_PROTOCOL} | ||
| {{ if eq .Params.AUTHORIZATION_ENABLED "true" }} | ||
| super.users=${SUPER_USERS} | ||
| {{ end }} | ||
| # Logs | ||
| log.dirs=${KAFKA_LOG_DIR_PATH} | ||
| # Provided configuration | ||
| ${KAFKA_CONFIGURATION} | ||
| EOF |
Oops, something went wrong.