Skip to content

Commit a559a96

Browse files
sionsmithsionsmith
committed
Multi tenancy example
1 parent d3f2467 commit a559a96

17 files changed

+345
-12
lines changed

‎examples/multi-tenacy/README.md‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Multi tenancy Kafka (NICE!)
2-
Todo.
2+
A multi tenant RBAC enabled production Confluent Platform install. This example showcases how large highly regulated enterprises can leverage CFK to securely deploy Kafka As A Service (KAAS)
33

44
### Deploy CRDs
55
Deploy the CRDS using the standard way:
@@ -13,9 +13,16 @@ Deploy the confluent operator and services:
1313
kubectl apply -k .
1414
```
1515

16+
### Using KafkaRestClass in multiple namespaces
17+
KafkaRestClass is an abstraction that contains information about address and credentials to enable something to talk to a Kafka REST MDS endpoint. We can use this per tenant to authenticate different users in different namespaces.
18+
- You can create default KafkaRestClass object with a user that has cluster access to create rolebindings / topics for Confluent Platform RBAC.
19+
- You can configure multiple KafkaRestClass CRs to manage topics and role bindings across different Kafka clusters.
20+
- Supports basic / bearer authentication methods
21+
- TLS client configuration. Required when MDS is running in the HTTPS mode. (does not support MTLS)
22+
- We can specify the endpoint if kafka cluster is in different namespace to Topic. Two options, directly inline in the Topic CRD or via secretRef which will contain credentials also
1623

1724
#### Notes
18-
currently working through thsese example:
25+
Currently working through these example:
1926

2027
- https://medium.com/@hiroyuki.osaki/illustration-open-policy-agent-aaf05bb0de8f
2128
- https://elastisys.com/enforcing-policy-as-code-using-opa-and-gatekeeper-in-kubernetes/

‎examples/multi-tenacy/confluent/control-centre.yaml‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,29 @@
1-
---
21
apiVersion: platform.confluent.io/v1beta1
32
kind: ControlCenter
43
metadata:
54
name: controlcenter
65
spec:
6+
authorization:
7+
type: rbac
78
tls:
8-
autoGeneratedCerts: true
9+
secretRef: tls-group1
910
dependencies:
1011
kafka:
1112
bootstrapEndpoint: kafka.sandbox.svc.cluster.local:9071
13+
authentication:
14+
type: plain
15+
jaasConfig:
16+
secretRef: mds-client-connect
17+
tls:
18+
enabled: true
19+
mds:
20+
endpoint: https://kafka.sandbox.svc.cluster.local:8090
21+
tokenKeyPair:
22+
secretRef: mds-public
23+
authentication:
24+
type: bearer
25+
bearer:
26+
secretRef: mds-client-c3
1227
tls:
1328
enabled: true
1429
connect:
@@ -24,4 +39,4 @@ spec:
2439
schemaRegistry:
2540
url: https://schemaregistry.sandbox.svc.cluster.local:8081
2641
tls:
27-
enabled: true
42+
enabled: true

‎examples/multi-tenacy/confluent/kafka.yaml‎

Lines changed: 64 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
apiVersion: platform.confluent.io/v1beta1
23
kind: Kafka
34
metadata:
@@ -6,17 +7,79 @@ spec:
67
configOverrides:
78
server:
89
- confluent.schema.registry.url=https://schemaregistry.sandbox.svc.cluster.local:8081
10+
- listener.name.internal.plain.sasl.server.callback.handler.class=io.confluent.security.auth.provider.ldap.LdapAuthenticateCallbackHandler
11+
- listener.name.external.plain.sasl.server.callback.handler.class=io.confluent.security.auth.provider.ldap.LdapAuthenticateCallbackHandler
12+
- listener.name.replication.plain.sasl.server.callback.handler.class=io.confluent.security.auth.provider.ldap.LdapAuthenticateCallbackHandler
13+
- authorizer.class.name=io.confluent.kafka.security.authorizer.ConfluentServerAuthorizer
14+
- confluent.authorizer.access.rule.providers=ZK_ACL,CONFLUENT
15+
log4j:
16+
- log4j.logger.io.confluent.security.auth.provider.ldap.LdapGroupManager=DEBUG
917
tls:
10-
autoGeneratedCerts: true
18+
secretRef: tls-group1
19+
metricReporter:
20+
enabled: true
21+
authentication:
22+
type: plain
23+
jaasConfigPassThrough:
24+
secretRef: broker-credential
25+
tls:
26+
enabled: true
1127
listeners:
1228
internal:
29+
authentication:
30+
type: plain
31+
jaasConfigPassThrough:
32+
secretRef: broker-credential
1333
tls:
1434
enabled: true
1535
external:
36+
authentication:
37+
type: plain
38+
jaasConfigPassThrough:
39+
secretRef: broker-credential
1640
tls:
1741
enabled: true
42+
authorization:
43+
type: rbac
44+
superUsers:
45+
- User:kafka
46+
services:
47+
mds:
48+
tls:
49+
enabled: true
50+
tokenKeyPair:
51+
secretRef: broker-credential
52+
provider:
53+
type: ldap
54+
ldap:
55+
address: ldap://ldap.sandbox.svc.cluster.local:389
56+
authentication:
57+
type: simple
58+
simple:
59+
secretRef: broker-credential
60+
tls:
61+
enabled: true
62+
configurations:
63+
groupNameAttribute: cn
64+
groupObjectClass: groupOfNames
65+
groupMemberAttribute: member
66+
groupMemberAttributePattern: cn=(.*),ou=users,dc=test,dc=com
67+
groupSearchBase: ou=groups,dc=test,dc=com
68+
userNameAttribute: cn
69+
userMemberOfAttributePattern: cn=(.*),ou=users,dc=test,dc=com
70+
userObjectClass: organizationalRole
71+
userSearchBase: ou=users,dc=test,dc=com
1872
dependencies:
73+
kafkaRest:
74+
authentication:
75+
type: bearer
76+
bearer:
77+
secretRef: broker-credential
1978
zookeeper:
2079
endpoint: zookeeper.sandbox.svc.cluster.local:2182
80+
authentication:
81+
type: digest
82+
jaasConfig:
83+
secretRef: broker-credential
2184
tls:
2285
enabled: true

‎examples/multi-tenacy/confluent/kustomization.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,13 @@ apiVersion: kustomize.config.k8s.io/v1beta1
22
kind: Kustomization
33
namespace: sandbox
44
resources:
5-
- namespace.yaml
6-
- ../../../kustomize/base/confluent
7-
- ../../../kustomize/base/secrets-tls
5+
- ldap.yaml
6+
- ../../../kustomize/base/confluent
7+
- ../../../kustomize/base/secrets-tls
8+
- ../../../kustomize/base/secrets-user
89
patchesStrategicMerge:
910
- zookeeper.yaml
1011
- kafka.yaml
12+
- rest-class.yaml
1113
- control-centre.yaml
1214
- schema-registry.yaml

‎examples/multi-tenacy/confluent/ldap.yaml‎

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: ldap
5+
labels:
6+
role: ldap
7+
app: ldap
8+
spec:
9+
containers:
10+
- name: ldap
11+
args:
12+
- --copy-service
13+
- --loglevel=debug
14+
image: osixia/openldap:1.3.0
15+
ports:
16+
- name: ldap
17+
containerPort: 389
18+
- name: ldaps
19+
containerPort: 636
20+
livenessProbe:
21+
tcpSocket:
22+
port: 389
23+
initialDelaySeconds: 15
24+
periodSeconds: 20
25+
env:
26+
- name: LDAP_ORGANISATION
27+
value: "Test Inc."
28+
- name: LDAP_DOMAIN
29+
value: "test.com"
30+
- name: LDAP_ADMIN_PASSWORD
31+
value: "confluentrox"
32+
- name: LDAP_CONFIG_PASSWORD
33+
value: "confluentconfigrox"
34+
- name: LDAP_READONLY_USER
35+
value: "True"
36+
- name: LDAP_READONLY_USER_USERNAME
37+
value: "mds"
38+
- name: LDAP_READONLY_USER_PASSWORD
39+
value: "Developer!"
40+
- name: LDAP_TLS
41+
value: "False"
42+
volumeMounts:
43+
- mountPath: /container/service/slapd/assets/config/bootstrap/ldif/custom
44+
name: customldif
45+
- mountPath: /var/lib/ldap
46+
name: ldap-data
47+
- mountPath: /etc/ldap/slapd.d
48+
name: ldap-config
49+
volumes:
50+
- name: customldif
51+
configMap:
52+
defaultMode: 420
53+
name: ldap-ldifs
54+
- name: ldap-data
55+
emptyDir: {}
56+
- name: ldap-config
57+
emptyDir: {}
58+
restartPolicy: Always
59+
---
60+
apiVersion: v1
61+
kind: ConfigMap
62+
metadata:
63+
name: ldap-ldifs
64+
data:
65+
0_groups.ldif: |-
66+
dn: ou=groups,dc=test,dc=com
67+
objectClass: organizationalUnit
68+
objectClass: top
69+
ou: groups
70+
0_users.ldif: |-
71+
dn: ou=users,dc=test,dc=com
72+
objectClass: organizationalUnit
73+
objectClass: top
74+
ou: users
75+
1_emmy.ldif: |-
76+
dn: cn=emmy,ou=users,dc=test,dc=com
77+
userPassword: emmy-secret
78+
objectClass: simpleSecurityObject
79+
objectClass: organizationalRole
80+
description: Interested in action and conservation. If you like it, you should put a Noetherian Ring on it.
81+
cn: emmy
82+
1_alice.ldif: |-
83+
dn: cn=alice,ou=users,dc=test,dc=com
84+
userPassword: alice-secret
85+
objectClass: simpleSecurityObject
86+
objectClass: organizationalRole
87+
description: Alice is great at changing perspectives, but sometimes chases down rabbit holes
88+
cn: alice
89+
1_developers.ldif: |-
90+
dn: cn=developers,ou=groups,dc=test,dc=com
91+
objectClass: top
92+
objectClass: groupOfNames
93+
description: A group of software developers and the apps they are responsible for
94+
cn: developers
95+
member: cn=alice,ou=users,dc=test,dc=com
96+
1_kafka.ldif: |-
97+
dn: cn=kafka,ou=users,dc=test,dc=com
98+
userPassword: kafka-secret
99+
description: kafka user
100+
objectClass: simpleSecurityObject
101+
objectClass: organizationalRole
102+
cn: kafka
103+
1_erp.ldif: |-
104+
dn: cn=erp,ou=users,dc=test,dc=com
105+
userPassword: erp-secret
106+
description: erp user
107+
objectClass: simpleSecurityObject
108+
objectClass: organizationalRole
109+
cn: erp
110+
1_sr.ldif: |-
111+
dn: cn=sr,ou=users,dc=test,dc=com
112+
userPassword: sr-secret
113+
description: schema registry user
114+
objectClass: simpleSecurityObject
115+
objectClass: organizationalRole
116+
cn: sr
117+
1_c3.ldif: |-
118+
dn: cn=c3,ou=users,dc=test,dc=com
119+
userPassword: c3-secret
120+
description: control center user
121+
objectClass: simpleSecurityObject
122+
objectClass: organizationalRole
123+
cn: c3
124+
1_ksql.ldif: |-
125+
dn: cn=ksql,ou=users,dc=test,dc=com
126+
userPassword: ksql-secret
127+
description: ksql user
128+
objectClass: simpleSecurityObject
129+
objectClass: organizationalRole
130+
cn: ksql
131+
1_connect.ldif: |-
132+
dn: cn=connect,ou=users,dc=test,dc=com
133+
userPassword: connect-secret
134+
description: connect user
135+
objectClass: simpleSecurityObject
136+
objectClass: organizationalRole
137+
cn: connect
138+
1_replicator.ldif: |-
139+
dn: cn=replicator,ou=users,dc=test,dc=com
140+
userPassword: replicator-secret
141+
description: replicator user
142+
objectClass: simpleSecurityObject
143+
objectClass: organizationalRole
144+
cn: replicator
145+
1_c3-test.ldif: |-
146+
dn: cn=testadmin,ou=users,dc=test,dc=com
147+
userPassword: testadmin
148+
description: testadmin user
149+
objectClass: simpleSecurityObject
150+
objectClass: organizationalRole
151+
cn: testadmin
152+
---
153+
apiVersion: v1
154+
kind: Service
155+
metadata:
156+
name: ldap
157+
labels:
158+
app: ldap
159+
spec:
160+
ports:
161+
- port: 389
162+
name: ldap
163+
- port: 636
164+
name: ldaps
165+
clusterIP: None
166+
selector:
167+
app: ldap
168+
169+
170+

‎examples/multi-tenacy/confluent/rest-class.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: platform.confluent.io/v1beta1
2+
kind: KafkaRestClass
3+
metadata:
4+
name: default
5+
spec:
6+
kafkaRest:
7+
authentication:
8+
type: bearer
9+
bearer:
10+
secretRef: rest-credential

‎examples/multi-tenacy/confluent/schema-registry.yaml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,26 @@ kind: SchemaRegistry
33
metadata:
44
name: schemaregistry
55
spec:
6+
authorization:
7+
type: rbac
68
tls:
7-
autoGeneratedCerts: true
9+
secretRef: tls-group1
810
dependencies:
911
kafka:
1012
bootstrapEndpoint: kafka.sandbox.svc.cluster.local:9071
13+
authentication:
14+
type: plain
15+
jaasConfig:
16+
secretRef: mds-client-sr
1117
tls:
1218
enabled: true
19+
mds:
20+
endpoint: https://kafka.sandbox.svc.cluster.local:8090
21+
tokenKeyPair:
22+
secretRef: mds-public
23+
authentication:
24+
type: bearer
25+
bearer:
26+
secretRef: mds-client-sr
27+
tls:
28+
enabled: true

‎examples/multi-tenacy/confluent/zookeeper.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,9 @@ kind: Zookeeper
33
metadata:
44
name: zookeeper
55
spec:
6+
authentication:
7+
type: digest
8+
jaasConfig:
9+
secretRef: zk-credential
610
tls:
7-
autoGeneratedCerts: true
11+
secretRef: tls-group1

‎examples/multi-tenacy/kustomization.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
13
resources:
24
- open-policy-agent
35
- confluent

0 commit comments

Comments
 (0)