Skip to content

Commit c680f17

Browse files
rnpridgeonrnpridgeon
committed
Add docker cluster setup
1 parent 435591f commit c680f17

17 files changed

+422
-0
lines changed

‎docker/.env

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/usr/bin/env bash
2+
3+
SOURCE="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
4+
TLS=$SOURCE/conf/tls
5+
6+
export MY_BOOTSTRAP_SERVER_ENV=localhost:29092
7+
export MY_SCHEMA_REGISTRY_URL_ENV="http://ckp_tester:test_secret@localhost:8081"
8+
export MY_SCHEMA_REGISTRY_SSL_URL_ENV="https://ckp_tester:test_secret@$(hostname -f):8082"
9+
export MY_SCHEMA_REGISTRY_SSL_CA_LOCATION_ENV=$TLS/ca-cert
10+
export MY_SCHEMA_REGISTRY_SSL_CERTIFICATE_LOCATION_ENV=$TLS/client.pem
11+
export MY_SCHEMA_REGISTRY_SSL_KEY_LOCATION_ENV=$TLS/client.key

‎docker/bin/certify

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/usr/bin/env bash
2+
3+
source $SOURCE/../.env
4+
export SOURCE="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
5+
export TLS=$SOURCE/../conf/tls
6+
7+
# Clean up old certs
8+
for file in $(ls $TLS);do
9+
rm $TLS/$file
10+
done
11+
12+
echo "Creating ca-cert..."
13+
$SOURCE/gen-ssl-certs.sh ca $TLS/ca-cert $(hostname -f)
14+
echo "Creating server cert..."
15+
$SOURCE/gen-ssl-certs.sh -k server $TLS/ca-cert $TLS/ $(hostname -f) $(hostname -f)
16+
echo "Creating client cert..."
17+
$SOURCE/gen-ssl-certs.sh client $TLS/ca-cert $TLS/ $(hostname -f) $(hostname -f)
18+
19+
echo "Creating key ..."
20+
openssl rsa -in $TLS/client.key -out $TLS/client.key -passin pass:abcdefgh
21+

‎docker/bin/gen-ssl-certs.sh

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
#!/bin/bash
2+
#
3+
#
4+
# This scripts generates:
5+
# - root CA certificate
6+
# - server certificate and keystore
7+
# - client keys
8+
#
9+
# https://cwiki.apache.org/confluence/display/KAFKA/Deploying+SSL+for+Kafka
10+
#
11+
12+
13+
if [[ "$1" == "-k" ]]; then
14+
USE_KEYTOOL=1
15+
shift
16+
else
17+
USE_KEYTOOL=0
18+
fi
19+
20+
OP="$1"
21+
CA_CERT="$2"
22+
PFX="$3"
23+
HOST="$4"
24+
25+
C=NN
26+
ST=NN
27+
L=NN
28+
O=NN
29+
OU=NN
30+
CN="$HOST"
31+
32+
33+
# Password
34+
PASS="abcdefgh"
35+
36+
# Cert validity, in days
37+
VALIDITY=10000
38+
39+
set -e
40+
41+
export LC_ALL=C
42+
43+
if [[ $OP == "ca" && ! -z "$CA_CERT" && ! -z "$3" ]]; then
44+
CN="$3"
45+
openssl req -new -x509 -newkey rsa:2048 -sha256 -keyout ${CA_CERT}.key -out $CA_CERT -days $VALIDITY -passin "pass:$PASS" -passout "pass:$PASS" <<EOF
46+
${C}
47+
${ST}
48+
${L}
49+
${O}
50+
${OU}
51+
${CN}
52+
$USER@${CN}
53+
.
54+
.
55+
EOF
56+
57+
58+
59+
elif [[ $OP == "server" && ! -z "$CA_CERT" && ! -z "$PFX" && ! -z "$CN" ]]; then
60+
61+
#Step 1
62+
echo "############ Generating key"
63+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}server.keystore.jks -alias localhost -validity $VALIDITY -genkey -keyalg RSA <<EOF
64+
$CN
65+
$OU
66+
$O
67+
$L
68+
$ST
69+
$C
70+
yes
71+
yes
72+
EOF
73+
74+
#Step 2
75+
echo "############ Adding CA"
76+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}server.truststore.jks -alias CARoot -import -file $CA_CERT <<EOF
77+
yes
78+
EOF
79+
80+
#Step 3
81+
echo "############ Export certificate"
82+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}server.keystore.jks -alias localhost -certreq -file ${PFX}cert-file -ext san=ip:127.0.0.1
83+
84+
echo "############ Sign certificate"
85+
openssl x509 -req -CA $CA_CERT -CAkey ${CA_CERT}.key -in ${PFX}cert-file -out ${PFX}cert-signed -days $VALIDITY -CAcreateserial -passin "pass:$PASS"
86+
mv $SOURCE/.srl $TLS/ca-cert.srl
87+
88+
echo "############ Import CA"
89+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}server.keystore.jks -alias CARoot -import -file $CA_CERT <<EOF
90+
yes
91+
EOF
92+
93+
echo "############ Import signed CA"
94+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}server.keystore.jks -alias localhost -import -file ${PFX}cert-signed
95+
96+
97+
elif [[ $OP == "client" && ! -z "$CA_CERT" && ! -z "$PFX" && ! -z "$CN" ]]; then
98+
99+
if [[ $USE_KEYTOOL == 1 ]]; then
100+
echo "############ Creating client truststore"
101+
102+
[[ -f ${PFX}client.truststore.jks ]] || keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}client.truststore.jks -alias CARoot -import -file $CA_CERT <<EOF
103+
yes
104+
EOF
105+
106+
echo "############ Generating key"
107+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}client.keystore.jks -alias localhost -validity $VALIDITY -genkey -keyalg RSA <<EOF
108+
$CN
109+
$OU
110+
$O
111+
$L
112+
$ST
113+
$C
114+
yes
115+
yes
116+
EOF
117+
echo "########### Export certificate"
118+
keytool -storepass "$PASS" -keystore ${PFX}client.keystore.jks -alias localhost -certreq -file ${PFX}cert-file -ext san=ip:127.0.0.1
119+
120+
echo "########### Sign certificate"
121+
openssl x509 -req -CA ${CA_CERT} -CAkey ${CA_CERT}.key -in ${PFX}cert-file -out ${PFX}cert-signed -days $VALIDITY -CAcreateserial -passin pass:$PASS
122+
mv $SOURCE/.srl $TLS/ca-cert.srl
123+
124+
echo "########### Import CA"
125+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}client.keystore.jks -alias CARoot -import -file ${CA_CERT} <<EOF
126+
yes
127+
EOF
128+
129+
echo "########### Import signed CA"
130+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}client.keystore.jks -alias localhost -import -file ${PFX}cert-signed
131+
132+
else
133+
# Standard OpenSSL keys
134+
echo "############ Generating key"
135+
openssl genrsa -des3 -passout "pass:$PASS" -out ${PFX}client.key 2048
136+
137+
echo "############ Generating request"
138+
openssl req -passin "pass:$PASS" -passout "pass:$PASS" -key ${PFX}client.key -new -out ${PFX}client.req \
139+
<<EOF
140+
$C
141+
$ST
142+
$L
143+
$O
144+
$OU
145+
$CN
146+
.
147+
$PASS
148+
.
149+
EOF
150+
151+
echo "########### Signing key"
152+
openssl x509 -req -passin "pass:$PASS" -in ${PFX}client.req -CA $CA_CERT -CAkey ${CA_CERT}.key -CAserial ${CA_CERT}.srl -out ${PFX}client.pem -days $VALIDITY
153+
154+
fi
155+
156+
157+
158+
159+
else
160+
echo "Usage: $0 ca <ca-cert-file> <CN>"
161+
echo " $0 [-k] server|client <ca-cert-file> <file_prefix> <hostname>"
162+
echo ""
163+
echo " -k = Use keytool/Java Keystore, else standard SSL keys"
164+
exit 1
165+
fi
166+

‎docker/conf/schema-registry/login.properties

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ckp_tester: test_secret, Testers
2+
disallowed: no_access

‎docker/conf/schema-registry/schema-registry.jaas

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
SchemaRegistry {
2+
org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required
3+
file="/conf/schema-registry/login.properties";
4+
};

‎docker/conf/testconf.json

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"topic": "test-topic",
3+
"bootstrap.servers": "$MY_BOOTSTRAP_SERVER_ENV",
4+
"schema.registry.url": "$MY_SCHEMA_REGISTRY_URL_ENV",
5+
"avro-https": {
6+
"schema.registry.url": "$MY_SCHEMA_REGISTRY_SSL_URL_ENV",
7+
"schema.registry.ssl.ca.location": "$MY_SCHEMA_REGISTRY_SSL_CA_LOCATION_ENV",
8+
"schema.registry.ssl.certificate.location": "$MY_SCHEMA_REGISTRY_SSL_CERTIFICATE_LOCATION_ENV",
9+
"schema.registry.ssl.key.location": "$MY_SCHEMA_REGISTRY_SSL_KEY_LOCATION_ENV"
10+
},
11+
"avro-basic-auth": {
12+
"schema.registry.basic.auth.user.info": "ckp_tester:test_secret",
13+
"sasl.username": "ckp_tester",
14+
"sasl.password": "test_secret"
15+
}
16+
}

‎docker/conf/tls/ca-cert

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDpjCCAo4CCQDsov561tiF8zANBgkqhkiG9w0BAQsFADCBlDELMAkGA1UEBhMC
3+
Tk4xCzAJBgNVBAgMAk5OMQswCQYDVQQHDAJOTjELMAkGA1UECgwCTk4xCzAJBgNV
4+
BAsMAk5OMSIwIAYDVQQDDBlSeWFucy1NYWNCb29rLVByby0zLmxvY2FsMS0wKwYJ
5+
KoZIhvcNAQkBFh5yeWFuQFJ5YW5zLU1hY0Jvb2stUHJvLTMubG9jYWwwHhcNMTgw
6+
ODMwMTMwNjUxWhcNNDYwMTE1MTMwNjUxWjCBlDELMAkGA1UEBhMCTk4xCzAJBgNV
7+
BAgMAk5OMQswCQYDVQQHDAJOTjELMAkGA1UECgwCTk4xCzAJBgNVBAsMAk5OMSIw
8+
IAYDVQQDDBlSeWFucy1NYWNCb29rLVByby0zLmxvY2FsMS0wKwYJKoZIhvcNAQkB
9+
Fh5yeWFuQFJ5YW5zLU1hY0Jvb2stUHJvLTMubG9jYWwwggEiMA0GCSqGSIb3DQEB
10+
AQUAA4IBDwAwggEKAoIBAQDcfci/SCZl9PlBCB1bY9gn8pJjhyuzIXHnqMYxyRTF
11+
UGF1fvzDYfdaOrI8CCghgHgz8A9yPylwRxUWguchiZwpeHinvnAlLIgjPb0WiUW+
12+
W6TCD7ZsATN5iULcKTYJQrcVD/rcdZwFz7IPgce1nN3vPApkpiK4bvHMABsSq5D/
13+
T7ADhCFnTsjaY7eXuh3aYdVz1AYgNClM8TrQTLtp5YnfbGbBPCSGMv2LoVEPEarc
14+
Xv8bEEmsLejiX84Ka6avRiUilsVTttUjKA8SLR5WnVmVcuORuWKfmU3vi61geaud
15+
EyIdg9Lv1cLhxvf7Ajx4ytaYJ/ZH0IqHpfgUA+DnFdvNAgMBAAEwDQYJKoZIhvcN
16+
AQELBQADggEBAJ82qUDhr8GPfz23k7CK43jKv9V43zz3yoHurc1ax1fChundowDb
17+
1DxS/tRJ+XZlgKZ2uQpZLlE4zowKVyMyP1TMIhDwR7HAe82yY4lF2066n5R68KnC
18+
CS9xC/iUfzI7jI/o9SYg/Zu1y6iJevme2ScgrtCW2XMdBTtXsBixe6PrqYrWQ5xJ
19+
qIg+Nn6i1fUFfI4r6yQZbqOU9MvrijK8yVBorydCX3FkEt2FPTMWAmPeRHsfzinp
20+
oXmCa7/hu/tP0EGTtDnOW1C7/NcqU/DICc42VTWwwFcpkX9YX95P9DhfxLk3SsYQ
21+
AuPO7LwYK/0r9nC6M+oKFIR6PWkXAuJyzEU=
22+
-----END CERTIFICATE-----

‎docker/conf/tls/ca-cert.key

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
-----BEGIN ENCRYPTED PRIVATE KEY-----
2+
MIIFHzBJBgkqhkiG9w0BBQ0wPDAbBgkqhkiG9w0BBQwwDgQI2xYiShHEDL0CAggA
3+
MB0GCWCGSAFlAwQBKgQQu5GZ0dORuGTb+t/iX9QkcASCBNAP8zuYKSvS6peueTkb
4+
vW/LIw8yQk8jjlUT9RAvCKHVKdNMDn27dJn1jO4IHyQEMSs2/zUdN1oqcpLBiqH5
5+
WUI2vSE9r+dxHDM4EosfH/yvxH60aGdjZsQyXYbIHdq7ZUh4jf+d15muLEUUlpuv
6+
8MOnzzql8TZgqN0mHMHaOXpff4ga4yFR276HW3o4bbQxI4E9/ywPeaXhJDuQdDtD
7+
qB4+zf2wYjeBqpg4eQxu8QZsDU9FTETcCa1grX3WDnd+h8FrrG7/zToPqBToFlow
8+
A4+PmHGt+zOn52iPnhAotiF4ynAbZwQoZ0W1aWUwCrZKmaov7djVO0PfnkL4GQ9k
9+
0SEZHgM4tS4qT4wRYrmDTlAH/3/M9vBUAdqHQnY9Ln75++efTNB0t1bTRIebBr65
10+
rTigyuJgLXtxbBeX1DyC2S4C6oKp7T4dlWX0f1Ie6ZVHxe8KlUS96fTXpPDqCk60
11+
Lox7F+WCz73txc2w8yoSz18KJ/ukpD2KzcV5UqfRGfoXvFMGT2o0FAlKYMeoZwD8
12+
d50KLqPXCimD/TIL5mpj9cfwj9GADIi676SxuY78MbfI6oaZR8fKuHws552s5Zvn
13+
wVqrfifF6IuqpimqOtigLfd63c+5xJ5GDV8TavkzgO69J4nqSHPImQDxfsXtRfdo
14+
XUAf3X9vCAzlhNYKnf57QWjLp7IRSDxmpzs7kpOCGPtjwSCYBH27+h60qTbZaTpR
15+
Tnhy4D/3329mFg70SRqOU+9Nui7rbFwbyasJgDeKEidHVNA9WrV6Z+mKjTcimt4N
16+
JnjToYYtbxh/99Cu+yu46vrQdtQ4+A49lFOksEe4NUJdRU7FKC+e1Ro1je4tQqX/
17+
l6rtZcRrLa1Yt9s7GVf0mX7p74zAYObAh5s67+upwsvgpqk/V2EdpAGeFZ3mq3fA
18+
MuAYnzlp4PC9RFBzI8B3YAdzP4iVwY+bsrdiywR93vR6nSwRwIQwsXn5PyDxoyVZ
19+
U0e4DL8Ow+pEMHTlOOORRk2frIr1QJ5dYlbC8mnGFZ8NXpA/1/Wqa0/plWij07Rq
20+
zXgwjTbJTruD/z7Ew3QzkfT88fZkyZ3LvOwFsNgiPrdwxPFOu/EHKQhDZytOFRdn
21+
ybBYufehj79VLttp7jKXK30GOICjPBZs0IvdG08Kd0SU0wPMA4QRN3zOwngpfc/6
22+
2iUa3KKk/s7Qc4aZT94c4xj4m7cPk1DHSHrBla9JIyGb0UX//ZDDT3ESZhkazi/F
23+
TrgDqHGbtakP0ha1fA0O5HASDzLHbbgnDE+qQH0UlyoLiYKomuoQ8RBpaJN0bve9
24+
7uWQV7qFZroMi34nrogRJKVXU0z56r8rueJ/OIE+bWHKF9b5ZEEFXcnfLnRplcyr
25+
kcySoMuGwPoN41gj9lks5gIk3Q2600zHG92y2Q8ZmTpm5TpLkS+E2srLxdA+tXBn
26+
Jje0xrLI9APPXMD0nj5hxd1zrH+cvFNR/ikUcZ4nAB69EixDvvPVFmvSLa9cGd4h
27+
N+F73nEL15gHI0j14A1FmjM67ZuEg9uELy4gfap+tTf9FNpx3qgqTzE5UqM4tnTm
28+
dHLG35+Rtb2XTdO0WLds/PTbdWBdhv1aOoVlrLlEGS4UwAu8rOnEykpIrlDs5lIR
29+
e2Ym44ra7s6QxuGP/2pVHXDq1Q==
30+
-----END ENCRYPTED PRIVATE KEY-----

‎docker/conf/tls/ca-cert.srl

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
96DDBE878BD1CB9C

‎docker/conf/tls/cert-file

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-----BEGIN NEW CERTIFICATE REQUEST-----
2+
MIIC6zCCAdMCAQAwZTELMAkGA1UEBhMCTk4xCzAJBgNVBAgTAk5OMQswCQYDVQQH
3+
EwJOTjELMAkGA1UEChMCTk4xCzAJBgNVBAsTAk5OMSIwIAYDVQQDExlSeWFucy1N
4+
YWNCb29rLVByby0zLmxvY2FsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
5+
AQEAm2mT+5qhtsxHdA1ot8G54WK8/Bzkqt9IKLT+j0Zy/MyTqS6U+hrD9mSXIFLs
6+
xRD88/EwYe7uUQXLm2C8o/eJNJkMcpDj40tPhbI6uAdDRdcMr/Uf7h7PxJxBwl36
7+
rmAzYN2hg+UTSCvCkpBioxN093xpGeWBxrCSVYaNAtYj/GgnPsI4QW4hUeHtH1Xl
8+
gMqB8+DtJKU9E/CF2RPGEYMLbcoi0uvXOStnLVVx7ZJSaLVT1klcTof04wPyQ8x4
9+
LXvAjDbhSYgGZIf2FOueCs/0QJtiUAzXhOkrcVn38sn6opVeeVlpde5WnDRFZ5b6
10+
cOYGJ/7wzitdJqxZ2rMGlaitUQIDAQABoEEwPwYJKoZIhvcNAQkOMTIwMDAPBgNV
11+
HREECDAGhwR/AAABMB0GA1UdDgQWBBTnQ5+RysrPg144asYVxAeQc49aRTANBgkq
12+
hkiG9w0BAQsFAAOCAQEACtOKH/f9SiH7PUAimCF/16Wm7AaaFt3bV8kJPkALi9jx
13+
btWFKChhiz/3WLFlRGpzxbtJEuAJspjm7EuY/WcgJMg+opT7DXtKzWEGz79L8G9T
14+
VM9tI2UmWFJK0Zvv53rBCGzmbAWCE2Rn0efLHJtwzdld9+soYZd8mgVJQhn9Hzef
15+
g1B6DH23vvp2i9f18oqxuxDdFxjIhkWdnRAYJV5h6ede85Dyugh6Slw3cx8TMRcM
16+
pIwhjRMTzaslXmEGs44TCEfc7+lsjWnLqRKpErdD4MXEeUGYtkULCvMVrKqVLSm4
17+
a0PJU+6xG1fvPJW6e9SxLt8jmycdRNUkg8Sebq9Pog==
18+
-----END NEW CERTIFICATE REQUEST-----

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy