Varnost: Gesel, zasebnih ključev in drugih dostopnih podatkov ne shranjujte v wiki. V spodnjih primerih uporabite lastne varne vrednosti namesto označenih nadomestnih vrednosti.
Ta stran opisuje pripravo TLS-certifikatov in osnovno konfiguracijo Kafka strežnika v načinu KRaft. Pred izvedbo preverite imena gostiteljev, IP-naslove in poti v svojem okolju.
mkdir -p certs && cd certs
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 -out ca.crt -subj "/CN=kafka-ca"
Datoteko broker.cnf prilagodite dejanskemu DNS-imenu in IP-naslovu strežnika.
[ req ]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn
req_extensions = req_ext
[ dn ]
CN = kafka-broker
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = eggmanu.eggos.si
IP.1 = 172.20.10.53
Ustvarite zasebni ključ in podpisan certifikat:
openssl genrsa -out broker.key 2048
openssl req -new -key broker.key -out broker.csr -config broker.cnf
openssl x509 -req -in broker.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out broker.crt -days 3650 -sha256 -extensions req_ext -extfile broker.cnf
openssl pkcs12 -export -in broker.crt -inkey broker.key -name kafka-broker -out broker.p12 -password pass:<PKCS12_GESLO>
Če uporabite obstoječi strežniški certifikat:
openssl pkcs12 -export -in /etc/apache2/certificate/cloud_eggos_si.crt -inkey /etc/apache2/certificate/cloud_eggos_si.key -certfile /etc/apache2/certificate/bundle.crt -name kafka-server -out /home/janez/kafka_ssl/kafka_2.13-4.1.1/certs/broker.p12 -passout pass:<PKCS12_GESLO>
keytool -importcert -file /etc/apache2/certificate/bundle.crt -alias kafka-ca -keystore /home/janez/kafka_ssl/kafka_2.13-4.1.1/certs/truststore-java8.p12 -storetype PKCS12 -storepass <TRUSTSTORE_GESLO> -noprompt
server.properties# Server basics
process.roles=broker,controller
node.id=1
# Controller quorum
controller.quorum.voters=1@localhost:10093
# Socket server settings
listeners=SASL_SSL://0.0.0.0:10092,CONTROLLER://0.0.0.0:10093
advertised.listeners=SASL_SSL://eggmanu.eggos.si:10092,CONTROLLER://eggmanu.eggos.si:10093
listener.security.protocol.map=SASL_SSL:SASL_SSL,CONTROLLER:PLAINTEXT
inter.broker.listener.name=SASL_SSL
controller.listener.names=CONTROLLER
# TLS
ssl.keystore.location=/home/janez/kafka_ssl/kafka_2.13-4.1.1/certs/broker.p12
ssl.keystore.password=<PKCS12_GESLO>
ssl.keystore.type=PKCS12
ssl.truststore.location=/home/janez/kafka_ssl/kafka_2.13-4.1.1/certs/truststore-java8.p12
ssl.truststore.password=<TRUSTSTORE_GESLO>
ssl.truststore.type=PKCS12
# SASL
sasl.enabled.mechanisms=PLAIN
sasl.mechanism.inter.broker.protocol=PLAIN
# Log directories
log.dirs=/home/janez/kafka_ssl/data/kraft
# Topic defaults
num.partitions=1
offsets.topic.replication.factor=1
transaction.state.log.replication.factor=1
transaction.state.log.min.isr=1
# Misc
group.initial.rebalance.delay.ms=0
advertised.listeners.broker.p12 in truststore-java8.p12.10092 in 10093.Varnost: Zasebne ključe in gesla hranite izven repozitorija ter omejite dostop na skrbnike infrastrukture.