mirror of
https://github.com/bitnami/charts.git
synced 2026-08-10 14:15:55 +08:00
[bitnami/kafka] Use an array for existing secrets containing TLS certs (#8060)
This commit is contained in:
Juan Ariza Toledano
@@ -29,4 +29,4 @@ name: kafka
|
||||
sources:
|
||||
- https://github.com/bitnami/bitnami-docker-kafka
|
||||
- https://kafka.apache.org/
|
||||
version: 14.2.6
|
||||
version: 14.3.0
|
||||
|
||||
+24
-22
@@ -130,14 +130,15 @@ The command removes all the Kubernetes components associated with the chart and
|
||||
| `auth.saslInterBrokerMechanism` | DEPRECATED: use `auth.sasl.interBrokerMechanism` instead. | `plain` |
|
||||
| `auth.jaas` | DEPRECATED: use `auth.sasl.jaas` instead. | `{}` |
|
||||
| `auth.tls.type` | Format to use for TLS certificates. Allowed types: `jks` and `pem` | `jks` |
|
||||
| `auth.tls.existingSecret` | Name of the existing secret containing the TLS certificates for the Kafka brokers | `""` |
|
||||
| `auth.tls.existingSecrets` | Array existing secrets containing the TLS certificates for the Kafka brokers | `[]` |
|
||||
| `auth.tls.existingSecret` | DEPRECATED: use `auth.tls.existingSecrets` instead. | `""` |
|
||||
| `auth.tls.autoGenerated` | Generate automatically self-signed TLS certificates for Kafka brokers. Currently only supported if `auth.tls.type` is `pem` | `false` |
|
||||
| `auth.tls.password` | Password to access the JKS files or PEM key when they are password-protected. | `""` |
|
||||
| `auth.tls.jksTruststoreSecret` | Name of the existing secret containing your truststore if truststore not existing or different from the one in the `auth.tls.existingSecret` | `""` |
|
||||
| `auth.tls.jksTruststoreSecret` | Name of the existing secret containing your truststore if truststore not existing or different from the ones in the `auth.tls.existingSecrets` | `""` |
|
||||
| `auth.tls.jksKeystoreSAN` | The secret key from the `auth.tls.existingSecret` containing the keystore with a SAN certificate | `""` |
|
||||
| `auth.tls.jksTruststore` | The secret key from the `auth.tls.existingSecret` or `auth.tls.jksTruststoreSecret` containing the truststore | `""` |
|
||||
| `auth.tls.endpointIdentificationAlgorithm` | The endpoint identification algorithm to validate server hostname using server certificate | `https` |
|
||||
| `auth.jksSecret` | DEPRECATED: use `auth.tls.existingSecret` instead. | `""` |
|
||||
| `auth.jksSecret` | DEPRECATED: use `auth.tls.existingSecrets` instead. | `""` |
|
||||
| `auth.jksTruststoreSecret` | DEPRECATED: use `auth.tls.jksTruststoreSecret` instead. | `""` |
|
||||
| `auth.jksKeystoreSAN` | DEPRECATED: use `auth.tls.jksKeystoreSAN` instead. | `""` |
|
||||
| `auth.jksTruststore` | DEPRECATED: use `auth.tls.jksTruststore` instead. | `""` |
|
||||
@@ -429,27 +430,26 @@ If you enabled SASL authentication on any listener, you can set the SASL credent
|
||||
- `auth.sasl.jaas.interBrokerUser`/`auth.sasl.jaas.interBrokerPassword`: when enabling SASL authentication for inter-broker communications.
|
||||
- `auth.jaas.zookeeperUser`/`auth.jaas.zookeeperPassword`: In the case that the Zookeeper chart is deployed with SASL authentication enabled.
|
||||
|
||||
In order to configure TLS authentication/encryption, you **can** create a secret containing the Java Key Stores (JKS) files: the truststore (`kafka.truststore.jks`) and one keystore (`kafka.keystore.jks`) per Kafka broker you have in the cluster. Then, you need pass the secret name with the `--auth.jksSecret` parameter when deploying the chart.
|
||||
In order to configure TLS authentication/encryption, you **can** create a secret per Kafka broker you have in the cluster containing the Java Key Stores (JKS) files: the truststore (`kafka.truststore.jks`) and the keystore (`kafka.keystore.jks`). Then, you need pass the secret names with the `auth.tls.existingSecrets` parameter when deploying the chart.
|
||||
|
||||
> **Note**: If the JKS files are password protected (recommended), you will need to provide the password to get access to the keystores. To do so, use the `auth.jksPassword` parameter to provide your password.
|
||||
> **Note**: If the JKS files are password protected (recommended), you will need to provide the password to get access to the keystores. To do so, use the `auth.tls.password` parameter to provide your password.
|
||||
|
||||
For instance, to configure TLS authentication on a Kafka cluster with 2 Kafka brokers use the command below to create the secret:
|
||||
For instance, to configure TLS authentication on a Kafka cluster with 2 Kafka brokers use the commands below to create the secrets:
|
||||
|
||||
```console
|
||||
kubectl create secret generic kafka-jks --from-file=./kafka.truststore.jks --from-file=./kafka-0.keystore.jks --from-file=./kafka-1.keystore.jks
|
||||
kubectl create secret generic kafka-jks-0 --from-file=kafka.truststore.jks=./kafka.truststore.jks --from-file=kafka.keystore.jks=./kafka-0.keystore.jks
|
||||
kubectl create secret generic kafka-jks-1 --from-file=kafka.truststore.jks=./kafka.truststore.jks --from-file=kafka.keystore.jks=./kafka-1.keystore.jks
|
||||
```
|
||||
|
||||
> **Note**: the command above assumes you already created the trustore and keystores files. This [script](https://raw.githubusercontent.com/confluentinc/confluent-platform-security-tools/master/kafka-generate-ssl.sh) can help you with the JKS files generation.
|
||||
|
||||
As an alternative to manually create the secret before installing the chart, you can put your JKS files inside the chart folder `files/jks`, an a secret including them will be generated. Please note this alternative requires to have the chart downloaded locally, so you will have to clone this repository or fetch the chart before installing it.
|
||||
> **Note**: the command above assumes you already created the truststore and keystores files. This [script](https://raw.githubusercontent.com/confluentinc/confluent-platform-security-tools/master/kafka-generate-ssl.sh) can help you with the JKS files generation.
|
||||
|
||||
If, for some reason (like using Cert-Manager) you can not use the default JKS secret scheme, you can use the additional parameters:
|
||||
|
||||
- `auth.jksTruststoreSecret` to define additional secret, where the `kafka.truststore.jks` is being kept. The truststore password **must** be the same as in `auth.jksPassword`
|
||||
- `auth.jksTruststore` to overwrite the default value of the truststore key (`kafka.truststore.jks`).
|
||||
- `auth.jksKeystoreSAN` if you want to use a SAN certificate for your brokers. Setting this parameter would mean that the chart expects a existing key in the `auth.jksSecret` with the `auth.jksKeystoreSAN`-value and use this as a keystore for **all** brokers
|
||||
- `auth.tls.jksTruststoreSecret` to define additional secret, where the `kafka.truststore.jks` is being kept. The truststore password **must** be the same as in `auth.tls.password`
|
||||
- `auth.tls.jksTruststore` to overwrite the default value of the truststore key (`kafka.truststore.jks`).
|
||||
- `auth.tls.jksKeystoreSAN` if you want to use a SAN certificate for your brokers. Setting this parameter would mean that the chart expects a existing key in the `auth.tls.jksTruststoreSecret` with the `auth.tls.jksKeystoreSAN` value and use this as a keystore for **all** brokers
|
||||
|
||||
> **Note**: The truststore/keystore from above **must** be protected with the same password as in `auth.jksPassword`
|
||||
> **Note**: The truststore/keystore from above **must** be protected with the same password as in `auth.tls.password`
|
||||
|
||||
You can deploy the chart with authentication using the following parameters:
|
||||
|
||||
@@ -457,12 +457,13 @@ You can deploy the chart with authentication using the following parameters:
|
||||
replicaCount=2
|
||||
auth.clientProtocol=sasl
|
||||
auth.interBrokerProtocol=tls
|
||||
auth.certificatesSecret=kafka-jks
|
||||
auth.certificatesPassword=jksPassword
|
||||
auth.tls.existingSecrets[0]=kafka-jks-0
|
||||
auth.tls.existingSecrets[1]=kafka-jks-1
|
||||
auth.tls.password=jksPassword
|
||||
auth.sasl.jaas.clientUsers[0]=brokerUser
|
||||
auth.sasl.jaas.clientPasswords[0]=brokerPassword
|
||||
auth.jaas.zookeeperUser=zookeeperUser
|
||||
auth.jaas.zookeeperPassword=zookeeperPassword
|
||||
auth.sasl.jaas.zookeeperUser=zookeeperUser
|
||||
auth.sasl.jaas.zookeeperPassword=zookeeperPassword
|
||||
zookeeper.auth.enabled=true
|
||||
zookeeper.auth.serverUsers=zookeeperUser
|
||||
zookeeper.auth.serverPasswords=zookeeperPassword
|
||||
@@ -476,10 +477,11 @@ You can deploy the chart with AclAuthorizer using the following parameters:
|
||||
replicaCount=2
|
||||
auth.clientProtocol=sasl
|
||||
auth.interBrokerProtocol=sasl_tls
|
||||
auth.tls.existingSecret=kafka-jks
|
||||
auth.tls.existingSecrets[0]=kafka-jks-0
|
||||
auth.tls.existingSecrets[1]=kafka-jks-1
|
||||
auth.tls.password=jksPassword
|
||||
'auth.sasl.jaas.clientUsers[0]=brokerUser'
|
||||
'auth.sasl.jaas.clientPasswords[0]=brokerPassword'
|
||||
auth.sasl.jaas.clientUsers[0]=brokerUser
|
||||
auth.sasl.jaas.clientPasswords[0]=brokerPassword
|
||||
auth.sasl.jaas.zookeeperUser=zookeeperUser
|
||||
auth.sasl.jaas.zookeeperPassword=zookeeperPassword
|
||||
zookeeper.auth.enabled=true
|
||||
@@ -492,7 +494,7 @@ allowEveryoneIfNoAclFound=false
|
||||
superUsers=User:admin
|
||||
```
|
||||
|
||||
If you also enable exposing metrics using the Kafka expoter, and you are using `sasl_tls`, `tls`, or `mtls` authentication protocols, you need to mount the CA certificated used to sign the brokers certificates in the exporter so it can validate the Kafka brokers. To do so, create a secret containing the CA, and set the `metrics.certificatesSecret` parameter. As an alternative, you can skip TLS validation using extra flags:
|
||||
If you also enable exposing metrics using the Kafka exporter, and you are using `sasl_tls`, `tls`, or `mtls` authentication protocols, you need to mount the CA certificated used to sign the brokers certificates in the exporter so it can validate the Kafka brokers. To do so, create a secret containing the CA, and set the `metrics.certificatesSecret` parameter. As an alternative, you can skip TLS validation using extra flags:
|
||||
|
||||
```console
|
||||
metrics.kafka.extraFlags={tls.insecure-skip-tls-verify: ""}
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
# TLS certificates
|
||||
|
||||
You can copy here your JKS or PEM certificates.
|
||||
You can copy here your JKS or PEM certificates. Find more info in [this section](https://github.com/bitnami/charts/tree/master/bitnami/kafka#enable-security-for-kafka-and-zookeeper) of the README.md file.
|
||||
|
||||
Find more info in [this section](https://github.com/bitnami/charts/tree/master/bitnami/kafka#enable-security-for-kafka-and-zookeeper) of the README.md file.
|
||||
> Note: DEPRECATED!! Please create a secret following the instructions available in the values.yaml instead of copying here your JKS or PEM certificates.
|
||||
|
||||
## Java Key Stores
|
||||
|
||||
|
||||
@@ -204,26 +204,14 @@ Return true if a JAAS credentials secret object should be created
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the Kafka TLS credentials secret
|
||||
*/}}
|
||||
{{- define "kafka.tlsSecretName" -}}
|
||||
{{- $secretName := coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret -}}
|
||||
{{- if $secretName -}}
|
||||
{{- printf "%s" (tpl $secretName $) -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-tls" (include "kafka.fullname" .) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if a TLS credentials secret object should be created
|
||||
*/}}
|
||||
{{- define "kafka.createTlsSecret" -}}
|
||||
{{- $secretName := coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret -}}
|
||||
{{- if and (include "kafka.tlsEncryption" .) (empty $secretName) (eq .Values.auth.tls.type "jks") (.Files.Glob "files/tls/*.jks") }}
|
||||
{{- if and (include "kafka.tlsEncryption" .) (empty .Values.auth.tls.existingSecrets) (empty $secretName) (eq .Values.auth.tls.type "jks") (.Files.Glob "files/tls/*.jks") }}
|
||||
{{- true -}}
|
||||
{{- else if and (include "kafka.tlsEncryption" .) (empty $secretName) (eq .Values.auth.tls.type "pem") (or (.Files.Glob "files/tls/*.{crt,pem}") .Values.auth.tls.autoGenerated) }}
|
||||
{{- else if and (include "kafka.tlsEncryption" .) (empty .Values.auth.tls.existingSecrets) (empty $secretName) (eq .Values.auth.tls.type "pem") (or (.Files.Glob "files/tls/*.{crt,pem}") .Values.auth.tls.autoGenerated) }}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -313,7 +301,8 @@ Compile all warnings into a single message, and call fail.
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessServiceType" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.externalAccessAutoDiscoveryRBAC" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.saslMechanisms" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.tlsSecret" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.tlsSecrets" .) -}}
|
||||
{{- $messages := append $messages (include "kafka.validateValues.tlsSecrets.length" .) -}}
|
||||
{{- $messages := without $messages "" -}}
|
||||
{{- $message := join "\n" $messages -}}
|
||||
|
||||
@@ -354,7 +343,7 @@ kafka: externalAccess.service.type
|
||||
{{- if and .Values.externalAccess.enabled .Values.externalAccess.autoDiscovery.enabled (not .Values.rbac.create )}}
|
||||
kafka: rbac.create
|
||||
By specifying "externalAccess.enabled=true" and "externalAccess.autoDiscovery.enabled=true"
|
||||
an initContainer will be used to autodetect the external IPs/ports by querying the
|
||||
an initContainer will be used to auto-detect the external IPs/ports by querying the
|
||||
K8s API. Please note this initContainer requires specific RBAC resources. You can create them
|
||||
by specifying "--set rbac.create=true".
|
||||
{{- end -}}
|
||||
@@ -372,16 +361,28 @@ kafka: auth.saslMechanisms
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - A secret containing TLS certs must be provided when TLS authentication is enabled */}}
|
||||
{{- define "kafka.validateValues.tlsSecret" -}}
|
||||
{{/* Validate values of Kafka - Secrets containing TLS certs must be provided when TLS authentication is enabled */}}
|
||||
{{- define "kafka.validateValues.tlsSecrets" -}}
|
||||
{{- $secretName := coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret -}}
|
||||
{{- if and (include "kafka.tlsEncryption" .) (eq .Values.auth.tls.type "jks") (empty $secretName) (not (.Files.Glob "files/tls/*.jks}")) }}
|
||||
{{- if and (include "kafka.tlsEncryption" .) (eq .Values.auth.tls.type "jks") (empty .Values.auth.tls.existingSecrets) (empty $secretName) (not (.Files.Glob "files/tls/*.jks}")) }}
|
||||
kafka: auth.tls.existingSecret
|
||||
A secret containing the Kafka JKS keystores and truststore is required
|
||||
when TLS encryption in enabled and TLS format is "JKS"
|
||||
{{- else if and (include "kafka.tlsEncryption" .) (eq .Values.auth.tls.type "pem") (empty $secretName) (not (.Files.Glob "files/tls/*.{crt,pem}")) (not .Values.auth.tls.autoGenerated) }}
|
||||
{{- else if and (include "kafka.tlsEncryption" .) (eq .Values.auth.tls.type "pem") (empty .Values.auth.tls.existingSecrets) (empty $secretName) (not (.Files.Glob "files/tls/*.{crt,pem}")) (not .Values.auth.tls.autoGenerated) }}
|
||||
kafka: auth.tls.existingSecret
|
||||
A secret containing the Kafka TLS certificates and keys is required
|
||||
when TLS encryption in enabled and TLS format is "PEM"
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Kafka - The number of secrets containing TLS certs should be equal to the number of replicas */}}
|
||||
{{- define "kafka.validateValues.tlsSecrets.length" -}}
|
||||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
{{- if and (include "kafka.tlsEncryption" .) (not (empty .Values.auth.tls.existingSecrets)) }}
|
||||
{{- $existingSecretsLength := len .Values.auth.tls.existingSecrets }}
|
||||
{{- if ne $replicaCount $existingSecretsLength }}
|
||||
kafka: .Values.auth.tls.existingSecrets
|
||||
Number of replicas and existingSecrets array length must be the same. Currently: replicaCount = {{ $replicaCount }} and existingSecrets = {{ $existingSecretsLength }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -1,4 +1,5 @@
|
||||
{{- if .Values.provisioning.enabled }}
|
||||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
kind: Job
|
||||
apiVersion: batch/v1
|
||||
metadata:
|
||||
@@ -106,9 +107,23 @@ spec:
|
||||
subPath: log4j.properties
|
||||
{{- end }}
|
||||
{{- if (include "kafka.tlsEncryption" .) }}
|
||||
- name: kafka-certificates
|
||||
{{- if not (empty .Values.auth.tls.existingSecrets) }}
|
||||
{{- range $index := .Values.auth.tls.existingSecrets }}
|
||||
- name: kafka-certs-{{ $index }}
|
||||
mountPath: /certs-{{ $index }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- else if or (not (empty (coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret))) (.Files.Glob "files/tls/*.{crt,pem}") }}
|
||||
- name: kafka-certs
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
{{- else if .Values.auth.tls.autoGenerated }}
|
||||
{{- range $index := until $replicaCount }}
|
||||
- name: kafka-certs-{{ $index }}
|
||||
mountPath: /certs-{{ $index }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if or .Values.config .Values.existingConfigmap }}
|
||||
@@ -122,9 +137,25 @@ spec:
|
||||
name: {{ include "kafka.log4j.configMapName" . }}
|
||||
{{ end }}
|
||||
{{- if (include "kafka.tlsEncryption" .) }}
|
||||
- name: kafka-certificates
|
||||
{{- if not (empty .Values.auth.tls.existingSecrets) }}
|
||||
{{- range $index, $secret := .Values.auth.tls.existingSecrets }}
|
||||
- name: kafka-certs-{{ $index }}
|
||||
secret:
|
||||
secretName: {{ include "kafka.tlsSecretName" . }}
|
||||
secretName: {{ tpl $secret $ }}
|
||||
defaultMode: 256
|
||||
{{- end }}
|
||||
{{- else if or (not (empty (coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret))) (.Files.Glob "files/tls/*.{crt,pem}") }}
|
||||
- name: kafka-certs
|
||||
secret:
|
||||
secretName: {{ if not (empty (coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret)) }}{{ tpl (coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret) . }}{{ else }}{{ printf "%s-tls" (include "kafka.fullname" .) }}{{ end }}
|
||||
defaultMode: 256
|
||||
{{- else if .Values.auth.tls.autoGenerated }}
|
||||
{{- range $index := until $replicaCount }}
|
||||
- name: kafka-certs-{{ $index }}
|
||||
secret:
|
||||
secretName: {{ printf "%s-%d-tls" (include "kafka.fullname" $) $index }}
|
||||
defaultMode: 256
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -118,8 +118,13 @@ data:
|
||||
{{- if (include "kafka.tlsEncryption" .) }}
|
||||
mkdir -p /opt/bitnami/kafka/config/certs
|
||||
{{- if eq .Values.auth.tls.type "jks" }}
|
||||
{{- if not (empty .Values.auth.tls.existingSecrets) }}
|
||||
JKS_TRUSTSTORE={{ printf "/%s/%s" (ternary "certs-${ID}" "truststore" (empty $jksTruststoreSecret)) (default "kafka.truststore.jks" $jksTruststore) | quote }}
|
||||
JKS_KEYSTORE="/certs-${ID}/kafka-keystore.jks"
|
||||
{{- else }}
|
||||
JKS_TRUSTSTORE={{ printf "/%s/%s" (ternary "certs" "truststore" (empty $jksTruststoreSecret)) (default "kafka.truststore.jks" $jksTruststore) | quote }}
|
||||
JKS_KEYSTORE={{ printf "/certs/%s" (default "kafka-${ID}.keystore.jks" $jksKeystoreSAN) | quote }}
|
||||
{{- end }}
|
||||
if [[ -f "$JKS_TRUSTSTORE" ]] && [[ -f "$JKS_KEYSTORE" ]]; then
|
||||
cp "$JKS_TRUSTSTORE" "/opt/bitnami/kafka/config/certs/kafka.truststore.jks"
|
||||
cp "$JKS_KEYSTORE" "/opt/bitnami/kafka/config/certs/kafka.keystore.jks"
|
||||
@@ -130,9 +135,15 @@ data:
|
||||
export KAFKA_TLS_TRUSTSTORE_FILE="/opt/bitnami/kafka/config/certs/kafka.truststore.jks"
|
||||
|
||||
{{- else if eq .Values.auth.tls.type "pem" }}
|
||||
{{- if or (not (empty .Values.auth.tls.existingSecrets)) (and .Values.auth.tls.autoGenerated (empty (coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret)) (not (.Files.Glob "files/tls/*.{crt,pem}"))) }}
|
||||
PEM_CA="/certs-${ID}/ca.crt"
|
||||
PEM_CERT="/certs-${ID}/tls.crt"
|
||||
PEM_KEY="/certs-${ID}/tls.key"
|
||||
{{- else }}
|
||||
PEM_CA="/certs/kafka.truststore.pem"
|
||||
PEM_CERT="/certs/kafka-${ID}.keystore.pem"
|
||||
PEM_KEY="/certs/kafka-${ID}.keystore.key"
|
||||
{{- end }}
|
||||
if [[ -f "$PEM_CA" ]] && [[ -f "$PEM_CERT" ]] && [[ -f "$PEM_KEY" ]]; then
|
||||
cp "$PEM_CA" "/opt/bitnami/kafka/config/certs/kafka.truststore.pem"
|
||||
cp "$PEM_CERT" "/opt/bitnami/kafka/config/certs/kafka.keystore.pem"
|
||||
|
||||
@@ -394,9 +394,23 @@ spec:
|
||||
mountPath: /shared
|
||||
{{- end }}
|
||||
{{- if (include "kafka.tlsEncryption" .) }}
|
||||
- name: kafka-certificates
|
||||
{{- if not (empty .Values.auth.tls.existingSecrets) }}
|
||||
{{- range $index, $_ := .Values.auth.tls.existingSecrets }}
|
||||
- name: kafka-certs-{{ $index }}
|
||||
mountPath: /certs-{{ $index }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- else if or (not (empty (coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret))) (.Files.Glob "files/tls/*.{crt,pem}") }}
|
||||
- name: kafka-certs
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
{{- else if .Values.auth.tls.autoGenerated }}
|
||||
{{- range $index := until $replicaCount }}
|
||||
- name: kafka-certs-{{ $index }}
|
||||
mountPath: /certs-{{ $index }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if (coalesce .Values.auth.tls.jksTruststoreSecret .Values.auth.jksTruststoreSecret) }}
|
||||
- name: kafka-truststore
|
||||
mountPath: /truststore
|
||||
@@ -463,10 +477,26 @@ spec:
|
||||
name: {{ include "kafka.metrics.jmx.configmapName" . }}
|
||||
{{- end }}
|
||||
{{- if (include "kafka.tlsEncryption" .) }}
|
||||
- name: kafka-certificates
|
||||
{{- if not (empty .Values.auth.tls.existingSecrets) }}
|
||||
{{- range $index, $secret := .Values.auth.tls.existingSecrets }}
|
||||
- name: kafka-certs-{{ $index }}
|
||||
secret:
|
||||
secretName: {{ include "kafka.tlsSecretName" . }}
|
||||
secretName: {{ tpl $secret $ }}
|
||||
defaultMode: 256
|
||||
{{- end }}
|
||||
{{- else if or (not (empty (coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret))) (.Files.Glob "files/tls/*.{crt,pem}") }}
|
||||
- name: kafka-certs
|
||||
secret:
|
||||
secretName: {{ if not (empty (coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret)) }}{{ tpl (coalesce .Values.auth.tls.existingSecret .Values.auth.jksSecret) . }}{{ else }}{{ printf "%s-tls" (include "kafka.fullname" .) }}{{ end }}
|
||||
defaultMode: 256
|
||||
{{- else if .Values.auth.tls.autoGenerated }}
|
||||
{{- range $index := until $replicaCount }}
|
||||
- name: kafka-certs-{{ $index }}
|
||||
secret:
|
||||
secretName: {{ printf "%s-%d-tls" (include "kafka.fullname" $) $index }}
|
||||
defaultMode: 256
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if (coalesce .Values.auth.tls.jksTruststoreSecret .Values.auth.jksTruststoreSecret) }}
|
||||
- name: kafka-truststore
|
||||
secret:
|
||||
|
||||
@@ -1,8 +1,9 @@
|
||||
{{- if (include "kafka.createTlsSecret" .) }}
|
||||
{{- if .Files.Glob "files/tls/*.{crt,pem,jks}" }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "kafka.fullname" . }}-tls
|
||||
name: {{ printf "%s-tls" (include "kafka.fullname" .) }}
|
||||
labels: {{- include "common.labels.standard" . | nindent 4 }}
|
||||
{{- if .Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
@@ -16,19 +17,33 @@ data:
|
||||
{{- range $path, $bytes := .Files.Glob "files/tls/*.{crt,pem,jks}" }}
|
||||
{{ base $path }}: {{ $root.Files.Get $path | b64enc | quote }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.auth.tls.type "pem") .Values.auth.tls.autoGenerated }}
|
||||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
{{- $releaseNamespace := .Release.Namespace }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $fullname := include "kafka.fullname" . }}
|
||||
{{- $ca := genCA "kafka-ca" 365 }}
|
||||
{{- range $i := until $replicaCount }}
|
||||
{{- $replicaHost := printf "%s-%d.%s-headless" $fullname $i $fullname }}
|
||||
{{- $altNames := list (printf "%s.%s.svc.%s" $replicaHost $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "%s.%s" $replicaHost $releaseNamespace) (printf "%s.%s" $fullname $releaseNamespace) $replicaHost $fullname }}
|
||||
{{- $cert := genSignedCert $replicaHost nil $altNames 365 $ca }}
|
||||
kafka-{{ $i }}.keystore.pem: {{ $cert.Cert | b64enc | quote }}
|
||||
kafka-{{ $i }}.keystore.key: {{ $cert.Key | b64enc | quote }}
|
||||
{{- end }}
|
||||
kafka.truststore.pem: {{ $ca.Cert | b64enc | quote }}
|
||||
{{- else if and .Values.auth.tls.autoGenerated (eq .Values.auth.tls.type "pem") }}
|
||||
{{- $replicaCount := int .Values.replicaCount }}
|
||||
{{- $releaseNamespace := .Release.Namespace }}
|
||||
{{- $clusterDomain := .Values.clusterDomain }}
|
||||
{{- $fullname := include "kafka.fullname" . }}
|
||||
{{- $ca := genCA "kafka-ca" 365 }}
|
||||
{{- range $i := until $replicaCount }}
|
||||
{{- $replicaHost := printf "%s-%d.%s-headless" $fullname $i $fullname }}
|
||||
{{- $altNames := list (printf "%s.%s.svc.%s" $replicaHost $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $fullname $releaseNamespace $clusterDomain) (printf "%s.%s" $replicaHost $releaseNamespace) (printf "%s.%s" $fullname $releaseNamespace) $replicaHost $fullname }}
|
||||
{{- $cert := genSignedCert $replicaHost nil $altNames 365 $ca }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ printf "%s-%d-tls" (include "kafka.fullname" $) $i }}
|
||||
labels: {{- include "common.labels.standard" $ | nindent 4 }}
|
||||
{{- if $.Values.commonLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" $.Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if $.Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $.Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: {{ $ca.Cert | b64enc | quote }}
|
||||
tls.crt: {{ $cert.Cert | b64enc | quote }}
|
||||
tls.key: {{ $cert.Key | b64enc | quote }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
+23
-22
@@ -320,39 +320,40 @@ auth:
|
||||
## @param auth.tls.type Format to use for TLS certificates. Allowed types: `jks` and `pem`
|
||||
##
|
||||
type: jks
|
||||
## @param auth.tls.existingSecret Name of the existing secret containing the TLS certificates for the Kafka brokers
|
||||
##
|
||||
## When using 'jks' format for certificates, the secret should contain:
|
||||
## - A truststore
|
||||
## - One keystore per Kafka broker you have in the cluster
|
||||
## Create this secret following the steps below:
|
||||
## 1) Generate your trustore and keystore files. Helpful script: https://raw.githubusercontent.com/confluentinc/confluent-platform-security-tools/master/kafka-generate-ssl.sh
|
||||
## @param auth.tls.existingSecrets Array existing secrets containing the TLS certificates for the Kafka brokers
|
||||
## When using 'jks' format for certificates, each secret should contain a truststore and a keystore.
|
||||
## Create these secrets following the steps below:
|
||||
## 1) Generate your truststore and keystore files. Helpful script: https://raw.githubusercontent.com/confluentinc/confluent-platform-security-tools/master/kafka-generate-ssl.sh
|
||||
## 2) Rename your truststore to `kafka.truststore.jks`.
|
||||
## 3) Rename your keystores to `kafka-X.keystore.jks` where X is the ID of each Kafka broker.
|
||||
## 4) Run the command below where SECRET_NAME is the name of the secret you want to create:
|
||||
## kubectl create secret generic SECRET_NAME --from-file=./kafka.truststore.jks --from-file=./kafka-0.keystore.jks --from-file=./kafka-1.keystore.jks ...
|
||||
## 4) Run the command below one time per broker to create its associated secret (SECRET_NAME_X is the name of the secret you want to create):
|
||||
## kubectl create secret generic SECRET_NAME_0 --from-file=kafka.truststore.jks=./kafka.truststore.jks --from-file=kafka.keystore.jks=./kafka-0.keystore.jks
|
||||
## kubectl create secret generic SECRET_NAME_1 --from-file=kafka.truststore.jks=./kafka.truststore.jks --from-file=kafka.keystore.jks=./kafka-1.keystore.jks
|
||||
## ...
|
||||
##
|
||||
## When using 'pem' format for certificates, the secret should contain:
|
||||
## - A public CA certificate
|
||||
## - One public certificate and one private key per Kafka broker you have in the cluster
|
||||
## Create this secret following the steps below:
|
||||
## When using 'pem' format for certificates, each secret should contain a public CA certificate, a public certificate and one private key.
|
||||
## Create these secrets following the steps below:
|
||||
## 1) Create a certificate key and signing request per Kafka broker, and sign the signing request with your CA
|
||||
## 2) Rename your CA file to `kafka.truststore.pem`.
|
||||
## 3) Rename your certificates to `kafka-X.keystore.pem` where X is the ID of each Kafka broker.
|
||||
## 3) Rename your keys to `kafka-X.keystore.key` where X is the ID of each Kafka broker.
|
||||
## 5) Run the command below where SECRET_NAME is the name of the secret you want to create:
|
||||
## kubectl create secret generic SECRET_NAME --from-file=./kafka.truststore.pem --from-file=./kafka-0.keystore.pem --from-file=./kafka-0.keystore.key --from-file=./kafka-1.keystore.pem --from-file=./kafka-1.keystore.key ...
|
||||
## 2) Rename your CA file to `kafka.ca.crt`.
|
||||
## 3) Rename your certificates to `kafka-X.tls.crt` where X is the ID of each Kafka broker.
|
||||
## 3) Rename your keys to `kafka-X.tls.key` where X is the ID of each Kafka broker.
|
||||
## 4) Run the command below one time per broker to create its associated secret (SECRET_NAME_X is the name of the secret you want to create):
|
||||
## kubectl create secret generic SECRET_NAME_0 --from-file=ca.crt=./kafka.ca.crt --from-file=tls.crt=./kafka-0.tls.crt --from-file=tls.key=./kafka-0.tls.key
|
||||
## kubectl create secret generic SECRET_NAME_1 --from-file=ca.crt=./kafka.ca.crt --from-file=tls.crt=./kafka-1.tls.crt --from-file=tls.key=./kafka-1.tls.key
|
||||
## ...
|
||||
##
|
||||
existingSecrets: []
|
||||
## @param auth.tls.existingSecret DEPRECATED: use `auth.tls.existingSecrets` instead.
|
||||
##
|
||||
existingSecret: ""
|
||||
## @param auth.tls.autoGenerated Generate automatically self-signed TLS certificates for Kafka brokers. Currently only supported if `auth.tls.type` is `pem`
|
||||
## Note: ignored when using 'jks' format or `auth.tls.existingSecret` is not empty
|
||||
## Note: ignored when using 'jks' format or `auth.tls.existingSecrets` is not empty
|
||||
##
|
||||
autoGenerated: false
|
||||
## @param auth.tls.password Password to access the JKS files or PEM key when they are password-protected.
|
||||
##
|
||||
password: ""
|
||||
## @param auth.tls.jksTruststoreSecret Name of the existing secret containing your truststore if truststore not existing or different from the one in the `auth.tls.existingSecret`
|
||||
## or is different from the one in the `auth.tls.existingSecret`.
|
||||
## @param auth.tls.jksTruststoreSecret Name of the existing secret containing your truststore if truststore not existing or different from the ones in the `auth.tls.existingSecrets`
|
||||
## Note: ignored when using 'pem' format for certificates .
|
||||
##
|
||||
jksTruststoreSecret: ""
|
||||
@@ -373,7 +374,7 @@ auth:
|
||||
## ref: https://docs.confluent.io/current/kafka/authentication_ssl.html#optional-settings
|
||||
##
|
||||
endpointIdentificationAlgorithm: https
|
||||
## @param auth.jksSecret DEPRECATED: use `auth.tls.existingSecret` instead.
|
||||
## @param auth.jksSecret DEPRECATED: use `auth.tls.existingSecrets` instead.
|
||||
##
|
||||
jksSecret: ""
|
||||
## @param auth.jksTruststoreSecret DEPRECATED: use `auth.tls.jksTruststoreSecret` instead.
|
||||
|
||||
Reference in New Issue
Block a user