Skip to content

Commit 2a1b162

Browse files
sionsmithsionsmith
authored
Merge pull request #19 from osodevops/multi-tenacy
Multi tenacy
2 parents 7e86b22 + c363a89 commit 2a1b162

33 files changed

+737
-0
lines changed

‎examples/multi-tenacy/README.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Multi tenancy Kafka (NICE!)
2+
A multi tenant RBAC enabled production Confluent Platform install. This example showcases how large highly regulated enterprises can leverage CFK to securely deploy Kafka As A Service (KAAS)
3+
4+
### Deploy CRDs
5+
Deploy the CRDS using the standard way:
6+
```shell
7+
kubectl apply -k ../../kustomize/crds
8+
```
9+
10+
### Deploy Confluent Operator, Confluent Services, two namespaces with tenant topics
11+
Deploy the confluent operator and services:
12+
```shell
13+
kubectl apply -k .
14+
```
15+
16+
### Using KafkaRestClass in multiple namespaces
17+
KafkaRestClass is an abstraction that contains information about address and credentials to enable something to talk to a Kafka REST MDS endpoint. We can use this per tenant to authenticate different users in different namespaces.
18+
- You can create default KafkaRestClass object with a user that has cluster access to create rolebindings / topics for Confluent Platform RBAC.
19+
- You can configure multiple KafkaRestClass CRs to manage topics and role bindings across different Kafka clusters.
20+
- Supports basic / bearer authentication methods
21+
- TLS client configuration. Required when MDS is running in the HTTPS mode. (does not support MTLS)
22+
- We can specify the endpoint if kafka cluster is in different namespace to Topic. Two options, directly inline in the Topic CRD or via secretRef which will contain credentials also
23+
24+
#### Notes
25+
Currently working through these example:
26+
27+
- https://medium.com/@hiroyuki.osaki/illustration-open-policy-agent-aaf05bb0de8f
28+
- https://elastisys.com/enforcing-policy-as-code-using-opa-and-gatekeeper-in-kubernetes/
29+
- https://github.com/digiwhite1980/flux/tree/master/bases/open-policy-agent
30+
- https://www.openpolicyagent.org/docs/latest/kubernetes-tutorial/
31+
32+

‎examples/multi-tenacy/confluent/control-centre.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
apiVersion: platform.confluent.io/v1beta1
2+
kind: ControlCenter
3+
metadata:
4+
name: controlcenter
5+
spec:
6+
authorization:
7+
type: rbac
8+
tls:
9+
secretRef: tls-group1
10+
dependencies:
11+
kafka:
12+
bootstrapEndpoint: kafka.sandbox.svc.cluster.local:9071
13+
authentication:
14+
type: plain
15+
jaasConfig:
16+
secretRef: mds-client-connect
17+
tls:
18+
enabled: true
19+
mds:
20+
endpoint: https://kafka.sandbox.svc.cluster.local:8090
21+
tokenKeyPair:
22+
secretRef: mds-public
23+
authentication:
24+
type: bearer
25+
bearer:
26+
secretRef: mds-client-c3
27+
tls:
28+
enabled: true
29+
connect:
30+
- name: connect
31+
url: https://connect.sandbox.svc.cluster.local:8083
32+
tls:
33+
enabled: true
34+
ksqldb:
35+
- name: ksqldb
36+
url: https://ksqldb.sandbox.svc.cluster.local:8088
37+
tls:
38+
enabled: true
39+
schemaRegistry:
40+
url: https://schemaregistry.sandbox.svc.cluster.local:8081
41+
tls:
42+
enabled: true

‎examples/multi-tenacy/confluent/kafka.yaml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
---
2+
apiVersion: platform.confluent.io/v1beta1
3+
kind: Kafka
4+
metadata:
5+
name: kafka
6+
spec:
7+
configOverrides:
8+
server:
9+
- confluent.schema.registry.url=https://schemaregistry.sandbox.svc.cluster.local:8081
10+
- listener.name.internal.plain.sasl.server.callback.handler.class=io.confluent.security.auth.provider.ldap.LdapAuthenticateCallbackHandler
11+
- listener.name.external.plain.sasl.server.callback.handler.class=io.confluent.security.auth.provider.ldap.LdapAuthenticateCallbackHandler
12+
- listener.name.replication.plain.sasl.server.callback.handler.class=io.confluent.security.auth.provider.ldap.LdapAuthenticateCallbackHandler
13+
- authorizer.class.name=io.confluent.kafka.security.authorizer.ConfluentServerAuthorizer
14+
- confluent.authorizer.access.rule.providers=ZK_ACL,CONFLUENT
15+
log4j:
16+
- log4j.logger.io.confluent.security.auth.provider.ldap.LdapGroupManager=DEBUG
17+
tls:
18+
secretRef: tls-group1
19+
metricReporter:
20+
enabled: true
21+
authentication:
22+
type: plain
23+
jaasConfigPassThrough:
24+
secretRef: broker-credential
25+
tls:
26+
enabled: true
27+
listeners:
28+
internal:
29+
authentication:
30+
type: plain
31+
jaasConfigPassThrough:
32+
secretRef: broker-credential
33+
tls:
34+
enabled: true
35+
external:
36+
authentication:
37+
type: plain
38+
jaasConfigPassThrough:
39+
secretRef: broker-credential
40+
tls:
41+
enabled: true
42+
authorization:
43+
type: rbac
44+
superUsers:
45+
- User:kafka
46+
services:
47+
mds:
48+
tls:
49+
enabled: true
50+
tokenKeyPair:
51+
secretRef: broker-credential
52+
provider:
53+
type: ldap
54+
ldap:
55+
address: ldap://ldap.sandbox.svc.cluster.local:389
56+
authentication:
57+
type: simple
58+
simple:
59+
secretRef: broker-credential
60+
tls:
61+
enabled: true
62+
configurations:
63+
groupNameAttribute: cn
64+
groupObjectClass: groupOfNames
65+
groupMemberAttribute: member
66+
groupMemberAttributePattern: cn=(.*),ou=users,dc=test,dc=com
67+
groupSearchBase: ou=groups,dc=test,dc=com
68+
userNameAttribute: cn
69+
userMemberOfAttributePattern: cn=(.*),ou=users,dc=test,dc=com
70+
userObjectClass: organizationalRole
71+
userSearchBase: ou=users,dc=test,dc=com
72+
dependencies:
73+
kafkaRest:
74+
authentication:
75+
type: bearer
76+
bearer:
77+
secretRef: broker-credential
78+
zookeeper:
79+
endpoint: zookeeper.sandbox.svc.cluster.local:2182
80+
authentication:
81+
type: digest
82+
jaasConfig:
83+
secretRef: broker-credential
84+
tls:
85+
enabled: true

‎examples/multi-tenacy/confluent/kustomization.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
namespace: sandbox
4+
resources:
5+
- ldap.yaml
6+
- ../../../kustomize/base/confluent
7+
- ../../../kustomize/base/secrets-tls
8+
- ../../../kustomize/base/secrets-user
9+
patchesStrategicMerge:
10+
- zookeeper.yaml
11+
- kafka.yaml
12+
- rest-class.yaml
13+
- control-centre.yaml
14+
- schema-registry.yaml

‎examples/multi-tenacy/confluent/ldap.yaml‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: ldap
5+
labels:
6+
role: ldap
7+
app: ldap
8+
spec:
9+
containers:
10+
- name: ldap
11+
args:
12+
- --copy-service
13+
- --loglevel=debug
14+
image: osixia/openldap:1.3.0
15+
ports:
16+
- name: ldap
17+
containerPort: 389
18+
- name: ldaps
19+
containerPort: 636
20+
livenessProbe:
21+
tcpSocket:
22+
port: 389
23+
initialDelaySeconds: 15
24+
periodSeconds: 20
25+
env:
26+
- name: LDAP_ORGANISATION
27+
value: "Test Inc."
28+
- name: LDAP_DOMAIN
29+
value: "test.com"
30+
- name: LDAP_ADMIN_PASSWORD
31+
value: "confluentrox"
32+
- name: LDAP_CONFIG_PASSWORD
33+
value: "confluentconfigrox"
34+
- name: LDAP_READONLY_USER
35+
value: "True"
36+
- name: LDAP_READONLY_USER_USERNAME
37+
value: "mds"
38+
- name: LDAP_READONLY_USER_PASSWORD
39+
value: "Developer!"
40+
- name: LDAP_TLS
41+
value: "False"
42+
volumeMounts:
43+
- mountPath: /container/service/slapd/assets/config/bootstrap/ldif/custom
44+
name: customldif
45+
- mountPath: /var/lib/ldap
46+
name: ldap-data
47+
- mountPath: /etc/ldap/slapd.d
48+
name: ldap-config
49+
volumes:
50+
- name: customldif
51+
configMap:
52+
defaultMode: 420
53+
name: ldap-ldifs
54+
- name: ldap-data
55+
emptyDir: {}
56+
- name: ldap-config
57+
emptyDir: {}
58+
restartPolicy: Always
59+
---
60+
apiVersion: v1
61+
kind: ConfigMap
62+
metadata:
63+
name: ldap-ldifs
64+
data:
65+
0_groups.ldif: |-
66+
dn: ou=groups,dc=test,dc=com
67+
objectClass: organizationalUnit
68+
objectClass: top
69+
ou: groups
70+
0_users.ldif: |-
71+
dn: ou=users,dc=test,dc=com
72+
objectClass: organizationalUnit
73+
objectClass: top
74+
ou: users
75+
1_emmy.ldif: |-
76+
dn: cn=emmy,ou=users,dc=test,dc=com
77+
userPassword: emmy-secret
78+
objectClass: simpleSecurityObject
79+
objectClass: organizationalRole
80+
description: Interested in action and conservation. If you like it, you should put a Noetherian Ring on it.
81+
cn: emmy
82+
1_alice.ldif: |-
83+
dn: cn=alice,ou=users,dc=test,dc=com
84+
userPassword: alice-secret
85+
objectClass: simpleSecurityObject
86+
objectClass: organizationalRole
87+
description: Alice is great at changing perspectives, but sometimes chases down rabbit holes
88+
cn: alice
89+
1_developers.ldif: |-
90+
dn: cn=developers,ou=groups,dc=test,dc=com
91+
objectClass: top
92+
objectClass: groupOfNames
93+
description: A group of software developers and the apps they are responsible for
94+
cn: developers
95+
member: cn=alice,ou=users,dc=test,dc=com
96+
1_kafka.ldif: |-
97+
dn: cn=kafka,ou=users,dc=test,dc=com
98+
userPassword: kafka-secret
99+
description: kafka user
100+
objectClass: simpleSecurityObject
101+
objectClass: organizationalRole
102+
cn: kafka
103+
1_erp.ldif: |-
104+
dn: cn=erp,ou=users,dc=test,dc=com
105+
userPassword: erp-secret
106+
description: erp user
107+
objectClass: simpleSecurityObject
108+
objectClass: organizationalRole
109+
cn: erp
110+
1_sr.ldif: |-
111+
dn: cn=sr,ou=users,dc=test,dc=com
112+
userPassword: sr-secret
113+
description: schema registry user
114+
objectClass: simpleSecurityObject
115+
objectClass: organizationalRole
116+
cn: sr
117+
1_c3.ldif: |-
118+
dn: cn=c3,ou=users,dc=test,dc=com
119+
userPassword: c3-secret
120+
description: control center user
121+
objectClass: simpleSecurityObject
122+
objectClass: organizationalRole
123+
cn: c3
124+
1_ksql.ldif: |-
125+
dn: cn=ksql,ou=users,dc=test,dc=com
126+
userPassword: ksql-secret
127+
description: ksql user
128+
objectClass: simpleSecurityObject
129+
objectClass: organizationalRole
130+
cn: ksql
131+
1_connect.ldif: |-
132+
dn: cn=connect,ou=users,dc=test,dc=com
133+
userPassword: connect-secret
134+
description: connect user
135+
objectClass: simpleSecurityObject
136+
objectClass: organizationalRole
137+
cn: connect
138+
1_replicator.ldif: |-
139+
dn: cn=replicator,ou=users,dc=test,dc=com
140+
userPassword: replicator-secret
141+
description: replicator user
142+
objectClass: simpleSecurityObject
143+
objectClass: organizationalRole
144+
cn: replicator
145+
1_c3-test.ldif: |-
146+
dn: cn=testadmin,ou=users,dc=test,dc=com
147+
userPassword: testadmin
148+
description: testadmin user
149+
objectClass: simpleSecurityObject
150+
objectClass: organizationalRole
151+
cn: testadmin
152+
---
153+
apiVersion: v1
154+
kind: Service
155+
metadata:
156+
name: ldap
157+
labels:
158+
app: ldap
159+
spec:
160+
ports:
161+
- port: 389
162+
name: ldap
163+
- port: 636
164+
name: ldaps
165+
clusterIP: None
166+
selector:
167+
app: ldap
168+
169+
170+

‎examples/multi-tenacy/confluent/namespace.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: sandbox

‎examples/multi-tenacy/confluent/rest-class.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: platform.confluent.io/v1beta1
2+
kind: KafkaRestClass
3+
metadata:
4+
name: default
5+
spec:
6+
kafkaRest:
7+
authentication:
8+
type: bearer
9+
bearer:
10+
secretRef: rest-credential

‎examples/multi-tenacy/confluent/schema-registry.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
apiVersion: platform.confluent.io/v1beta1
2+
kind: SchemaRegistry
3+
metadata:
4+
name: schemaregistry
5+
spec:
6+
authorization:
7+
type: rbac
8+
tls:
9+
secretRef: tls-group1
10+
dependencies:
11+
kafka:
12+
bootstrapEndpoint: kafka.sandbox.svc.cluster.local:9071
13+
authentication:
14+
type: plain
15+
jaasConfig:
16+
secretRef: mds-client-sr
17+
tls:
18+
enabled: true
19+
mds:
20+
endpoint: https://kafka.sandbox.svc.cluster.local:8090
21+
tokenKeyPair:
22+
secretRef: mds-public
23+
authentication:
24+
type: bearer
25+
bearer:
26+
secretRef: mds-client-sr
27+
tls:
28+
enabled: true

0 commit comments

Comments
 (0)