Skip to content

Commit 3c369ae

Browse files
sionsmithsionsmith
committed
working tenant namespaced topics with bare opa
1 parent 221f0ad commit 3c369ae

23 files changed

+331
-0
lines changed

‎examples/multi-tenacy/confluent/control-centre.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
apiVersion: platform.confluent.io/v1beta1
3+
kind: ControlCenter
4+
metadata:
5+
name: controlcenter
6+
spec:
7+
tls:
8+
autoGeneratedCerts: true
9+
dependencies:
10+
kafka:
11+
bootstrapEndpoint: kafka.sandbox.svc.cluster.local:9071
12+
tls:
13+
enabled: true
14+
connect:
15+
- name: connect
16+
url: https://connect.sandbox.svc.cluster.local:8083
17+
tls:
18+
enabled: true
19+
ksqldb:
20+
- name: ksqldb
21+
url: https://ksqldb.sandbox.svc.cluster.local:8088
22+
tls:
23+
enabled: true
24+
schemaRegistry:
25+
url: https://schemaregistry.sandbox.svc.cluster.local:8081
26+
tls:
27+
enabled: true

‎examples/multi-tenacy/confluent/kafka.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: platform.confluent.io/v1beta1
2+
kind: Kafka
3+
metadata:
4+
name: kafka
5+
spec:
6+
configOverrides:
7+
server:
8+
- confluent.schema.registry.url=https://schemaregistry.sandbox.svc.cluster.local:8081
9+
tls:
10+
autoGeneratedCerts: true
11+
listeners:
12+
internal:
13+
tls:
14+
enabled: true
15+
external:
16+
tls:
17+
enabled: true
18+
dependencies:
19+
zookeeper:
20+
endpoint: zookeeper.sandbox.svc.cluster.local:2182
21+
tls:
22+
enabled: true

‎examples/multi-tenacy/confluent/kustomization.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
namespace: sandbox
4+
resources:
5+
- namespace.yaml
6+
- ../../../kustomize/base/confluent
7+
- ../../../kustomize/base/secrets-tls
8+
patchesStrategicMerge:
9+
- zookeeper.yaml
10+
- kafka.yaml
11+
- control-centre.yaml
12+
- schema-registry.yaml

‎examples/multi-tenacy/confluent/namespace.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: sandbox

‎examples/multi-tenacy/confluent/schema-registry.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: platform.confluent.io/v1beta1
2+
kind: SchemaRegistry
3+
metadata:
4+
name: schemaregistry
5+
spec:
6+
tls:
7+
autoGeneratedCerts: true
8+
dependencies:
9+
kafka:
10+
bootstrapEndpoint: kafka.sandbox.svc.cluster.local:9071
11+
tls:
12+
enabled: true

‎examples/multi-tenacy/confluent/zookeeper.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: platform.confluent.io/v1beta1
2+
kind: Zookeeper
3+
metadata:
4+
name: zookeeper
5+
spec:
6+
tls:
7+
autoGeneratedCerts: true

‎examples/multi-tenacy/kustomization.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
resources:
2+
- open-policy-agent
3+
- confluent
4+
- operator
5+
- tenant-a
6+
- tenant-b

‎examples/multi-tenacy/open-policy-agent/deployment.yaml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
---
2+
# Source: opa/templates/deployment.yaml
3+
apiVersion: apps/v1
4+
kind: Deployment
5+
metadata:
6+
name: opa
7+
labels:
8+
app: opa
9+
chart: "opa-2.0.0"
10+
release: "RELEASE-NAME"
11+
heritage: "Helm"
12+
spec:
13+
replicas: 1
14+
selector:
15+
matchLabels:
16+
app: opa
17+
template:
18+
metadata:
19+
annotations:
20+
checksum/certs: 8b0af3ffc1e4a45847580d3650728057e5aba2869d5bf9f51780777916e801f7
21+
labels:
22+
app: opa
23+
name: opa
24+
spec:
25+
containers:
26+
- name: opa
27+
ports:
28+
- name: https
29+
containerPort: 443
30+
image: openpolicyagent/opa:0.32.0
31+
imagePullPolicy: IfNotPresent
32+
resources:
33+
{}
34+
args:
35+
- "run"
36+
- "--server"
37+
- "--tls-cert-file=/certs/tls.crt"
38+
- "--tls-private-key-file=/certs/tls.key"
39+
- "--addr=0.0.0.0:443"
40+
- "--log-level=info"
41+
- "--log-format=json"
42+
volumeMounts:
43+
- name: certs
44+
readOnly: true
45+
mountPath: /certs
46+
readinessProbe:
47+
httpGet:
48+
path: /health
49+
scheme: HTTPS
50+
port: 443
51+
initialDelaySeconds: 5
52+
periodSeconds: 10
53+
livenessProbe:
54+
httpGet:
55+
path: /health
56+
scheme: HTTPS
57+
port: 443
58+
initialDelaySeconds: 10
59+
periodSeconds: 15
60+
- name: sarproxy
61+
image: lachlanevenson/k8s-kubectl:latest
62+
imagePullPolicy: IfNotPresent
63+
resources:
64+
{}
65+
command:
66+
- kubectl
67+
- proxy
68+
- --accept-paths=^/apis/authorization.k8s.io/v1/subjectaccessreviews$
69+
serviceAccountName: opa
70+
volumes:
71+
- name: certs
72+
secret:
73+
secretName: opa-cert
74+
affinity:
75+
{}
76+
nodeSelector:
77+
{}
78+
tolerations:
79+
[]

‎examples/multi-tenacy/open-policy-agent/kustomization.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
namespace: opa
4+
resources:
5+
- namespace.yaml
6+
- sar-clusterrole.yaml
7+
- sar-clusterrolebinding.yaml
8+
- serviceaccount.yaml
9+
- service.yaml
10+
- webhookconfiguration.yaml
11+
- deployment.yaml

‎examples/multi-tenacy/open-policy-agent/namespace.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: opa

0 commit comments

Comments
 (0)