Skip to content

Commit 18d953a

Browse files
rnpridgeonRyan P
rnpridgeon
authored and
Ryan P
committed
Add docker-compose cluster for use in integration tests
1 parent 15800d0 commit 18d953a

File tree

9 files changed

+325
-0
lines changed

9 files changed

+325
-0
lines changed

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,3 +21,4 @@ dl-*
2121
*.whl
2222
.pytest_cache
2323
staging
24+
tests/docker/conf/tls/*

‎tests/docker/.env

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/usr/bin/env bash
2+
3+
export DOCKER_SOURCE="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
4+
export DOCKER_CONTEXT=$DOCKER_SOURCE/docker-compose.yaml
5+
export DOCKER_BIN=$DOCKER_SOURCE/bin
6+
export DOCKER_CONF=$DOCKER_SOURCE/conf
7+
export TLS=$DOCKER_CONF/tls
8+
9+
export MY_BOOTSTRAP_SERVER_ENV=localhost:29092
10+
export MY_SCHEMA_REGISTRY_URL_ENV=http://$(hostname):8081
11+
export MY_SCHEMA_REGISTRY_SSL_URL_ENV=https://$(hostname -f):8082
12+
export MY_SCHEMA_REGISTRY_SSL_CA_LOCATION_ENV=$TLS/ca-cert
13+
export MY_SCHEMA_REGISTRY_SSL_CERTIFICATE_LOCATION_ENV=$TLS/client.pem
14+
export MY_SCHEMA_REGISTRY_SSL_KEY_LOCATION_ENV=$TLS/client.key

‎tests/docker/bin/certify.sh

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/usr/bin/env bash -eu
2+
3+
DOCKER_BIN="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
4+
export PASS="abcdefgh"
5+
6+
source ${DOCKER_BIN}/../.env
7+
8+
mkdir -p ${TLS}
9+
10+
if [[ -f ${TLS}/ca-cert ]]; then
11+
echo "${TLS}/ca-cert found; skipping certificate generation.."
12+
exit 0
13+
fi
14+
15+
HOST=$(hostname -f)
16+
17+
echo "Creating ca-cert..."
18+
${DOCKER_BIN}/gen-ssl-certs.sh ca ${TLS}/ca-cert ${HOST}
19+
echo "Creating server cert..."
20+
${DOCKER_BIN}/gen-ssl-certs.sh -k server ${TLS}/ca-cert ${TLS}/ ${HOST} ${HOST}
21+
echo "Creating client cert..."
22+
${DOCKER_BIN}/gen-ssl-certs.sh client ${TLS}/ca-cert ${TLS}/ ${HOST} ${HOST}
23+
24+
echo "Creating key ..."
25+
openssl rsa -in ${TLS}/client.key -out ${TLS}/client.key -passin pass:${PASS}
26+

‎tests/docker/bin/cluster_down.sh

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#!/usr/bin/env bash
2+
set -eu
3+
4+
DOCKER_BIN="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
5+
source ${DOCKER_BIN}/../.env
6+
7+
echo "Destroying cluster.."
8+
docker-compose -f ${DOCKER_CONTEXT} down -v --remove-orphans

‎tests/docker/bin/cluster_up.sh

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/usr/bin/env bash -eu
2+
3+
DOCKER_BIN="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null && pwd )"
4+
source ${DOCKER_BIN}/../.env
5+
6+
# Wait for http service listener to come up and start serving
7+
# $1 http service name
8+
# $2 http service address
9+
await_http() {
10+
local exit_code
11+
local attempt=0
12+
13+
until curl ${2} || [[ ${attempt} -gt 5 ]]; do
14+
echo "awaiting $1..."
15+
let "attempt+=1"
16+
sleep 6
17+
done
18+
19+
if [[ ${attempt} -lt 5 ]]; then
20+
return
21+
fi
22+
23+
echo "$1 readiness test failed: aborting"
24+
exit 1
25+
}
26+
27+
echo "Configuring Environment..."
28+
source ${DOCKER_SOURCE}/.env
29+
30+
echo "Generating SSL certs..."
31+
${DOCKER_BIN}/certify.sh
32+
33+
echo "Deploying cluster..."
34+
docker-compose -f ${DOCKER_CONTEXT} up -d
35+
36+
echo "Setting throttle for throttle test..."
37+
docker-compose -f ${DOCKER_CONTEXT} exec kafka sh -c "
38+
/usr/bin/kafka-configs --zookeeper zookeeper:2181 \
39+
--alter --add-config 'producer_byte_rate=1,consumer_byte_rate=1,request_percentage=001' \
40+
--entity-name throttled_client --entity-type clients"
41+
42+
await_http "schema-registry" "http://localhost:8081"
43+
await_http "schema-registry-basic-auth" "http://localhost:8083"
44+

‎tests/docker/bin/gen-ssl-certs.sh

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
#!/usr/bin/env bash -eu
2+
#
3+
#
4+
# This scripts generates:
5+
# - root CA certificate
6+
# - server certificate and keystore
7+
# - client keys
8+
#
9+
# https://cwiki.apache.org/confluence/display/KAFKA/Deploying+SSL+for+Kafka
10+
#
11+
12+
if [[ "$1" == "-k" ]]; then
13+
USE_KEYTOOL=1
14+
shift
15+
else
16+
USE_KEYTOOL=0
17+
fi
18+
19+
OP="${1:-}"
20+
CA_CERT="${2:-}"
21+
PFX="${3:-}"
22+
HOST="${4:-$(hostname -f)}"
23+
24+
C=NN
25+
ST=NN
26+
L=NN
27+
O=NN
28+
OU=NN
29+
CN="$HOST"
30+
31+
# Cert validity, in days
32+
VALIDITY=10000
33+
34+
set -e
35+
36+
export LC_ALL=C
37+
38+
if [[ $OP == "ca" && ! -z "$CA_CERT" && ! -z "$3" ]]; then
39+
CN="$3"
40+
openssl req -new -x509 -newkey rsa:2048 -sha256 -keyout ${CA_CERT}.key -out $CA_CERT -days $VALIDITY -passin "pass:$PASS" -passout "pass:$PASS" <<EOF
41+
${C}
42+
${ST}
43+
${L}
44+
${O}
45+
${OU}
46+
${CN}
47+
$USER@${CN}
48+
.
49+
.
50+
EOF
51+
52+
53+
54+
elif [[ $OP == "server" && ! -z "$CA_CERT" && ! -z "$PFX" && ! -z "$CN" ]]; then
55+
56+
#Step 1
57+
echo "############ Generating key"
58+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}server.keystore.jks -alias localhost -validity $VALIDITY -genkey -keyalg RSA <<EOF
59+
$CN
60+
$OU
61+
$O
62+
$L
63+
$ST
64+
$C
65+
yes
66+
yes
67+
EOF
68+
69+
#Step 2
70+
echo "############ Adding CA"
71+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}server.truststore.jks -alias CARoot -import -file $CA_CERT <<EOF
72+
yes
73+
EOF
74+
75+
#Step 3
76+
echo "############ Export certificate"
77+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}server.keystore.jks -alias localhost -certreq -file ${PFX}cert-file -ext san=ip:127.0.0.1
78+
79+
echo "############ Sign certificate"
80+
openssl x509 -req -CA $CA_CERT -CAkey ${CA_CERT}.key -in ${PFX}cert-file -out ${PFX}cert-signed -days $VALIDITY -CAcreateserial -passin "pass:$PASS"
81+
82+
echo "############ Import CA"
83+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}server.keystore.jks -alias CARoot -import -file $CA_CERT <<EOF
84+
yes
85+
EOF
86+
87+
echo "############ Import signed CA"
88+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}server.keystore.jks -alias localhost -import -file ${PFX}cert-signed
89+
90+
91+
elif [[ $OP == "client" && ! -z "$CA_CERT" && ! -z "$PFX" && ! -z "$CN" ]]; then
92+
93+
if [[ $USE_KEYTOOL == 1 ]]; then
94+
echo "############ Creating client truststore"
95+
96+
[[ -f ${PFX}client.truststore.jks ]] || keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}client.truststore.jks -alias CARoot -import -file $CA_CERT <<EOF
97+
yes
98+
EOF
99+
100+
echo "############ Generating key"
101+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}client.keystore.jks -alias localhost -validity $VALIDITY -genkey -keyalg RSA <<EOF
102+
$CN
103+
$OU
104+
$O
105+
$L
106+
$ST
107+
$C
108+
yes
109+
yes
110+
EOF
111+
echo "########### Export certificate"
112+
keytool -storepass "$PASS" -keystore ${PFX}client.keystore.jks -alias localhost -certreq -file ${PFX}cert-file -ext san=ip:127.0.0.1
113+
114+
echo "########### Sign certificate"
115+
openssl x509 -req -CA ${CA_CERT} -CAkey ${CA_CERT}.key -in ${PFX}cert-file -out ${PFX}cert-signed -days $VALIDITY -CAcreateserial -passin pass:$PASS
116+
117+
echo "########### Import CA"
118+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}client.keystore.jks -alias CARoot -import -file ${CA_CERT} <<EOF
119+
yes
120+
EOF
121+
122+
echo "########### Import signed CA"
123+
keytool -storepass "$PASS" -keypass "$PASS" -keystore ${PFX}client.keystore.jks -alias localhost -import -file ${PFX}cert-signed
124+
125+
else
126+
# Standard OpenSSL keys
127+
echo "############ Generating key"
128+
openssl genrsa -des3 -passout "pass:$PASS" -out ${PFX}client.key 2048
129+
130+
echo "############ Generating request"
131+
openssl req -passin "pass:$PASS" -passout "pass:$PASS" -key ${PFX}client.key -new -out ${PFX}client.req \
132+
<<EOF
133+
$C
134+
$ST
135+
$L
136+
$O
137+
$OU
138+
$CN
139+
.
140+
$PASS
141+
.
142+
EOF
143+
144+
echo "########### Signing key"
145+
openssl x509 -req -passin "pass:$PASS" -in ${PFX}client.req -CA $CA_CERT -CAkey ${CA_CERT}.key -CAserial ${CA_CERT}.srl -out ${PFX}client.pem -days $VALIDITY
146+
147+
fi
148+
149+
150+
151+
152+
else
153+
echo "Usage: $0 ca <ca-cert-file> <CN>"
154+
echo " $0 [-k] server|client <ca-cert-file> <file_prefix> <hostname>"
155+
echo ""
156+
echo " -k = Use keytool/Java Keystore, else standard SSL keys"
157+
exit 1
158+
fi
159+

‎tests/docker/conf/schema-registry/login.properties

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ckp_tester:test_secret, Testers

‎tests/docker/conf/schema-registry/schema-registry.jaas

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
SchemaRegistry {
2+
org.eclipse.jetty.jaas.spi.PropertyFileLoginModule required
3+
file="/conf/schema-registry/login.properties";
4+
};

‎tests/docker/docker-compose.yaml

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
version: '3'
2+
services:
3+
zookeeper:
4+
image: confluentinc/cp-zookeeper:5.0.0
5+
ports:
6+
- 2181:2181
7+
environment:
8+
ZOOKEEPER_CLIENT_PORT: 2181
9+
kafka:
10+
image: confluentinc/cp-kafka
11+
depends_on:
12+
- zookeeper
13+
ports:
14+
- 29092:29092
15+
environment:
16+
KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT, PLAINTEXT_HOST:PLAINTEXT
17+
KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://kafka:9092, PLAINTEXT_HOST://localhost:29092
18+
KAFKA_INTER_BROKER_LISTENER_NAME: PLAINTEXT
19+
KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
20+
KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
21+
schema-registry:
22+
image: confluentinc/cp-schema-registry:5.0.0
23+
depends_on:
24+
- zookeeper
25+
- kafka
26+
ports:
27+
- 8081:8081
28+
- 8082:8082
29+
volumes:
30+
- ./conf:/conf
31+
environment:
32+
SCHEMA_REGISTRY_HOST_NAME: schema-registry
33+
SCHEMA_REGISTRY_KAFKASTORE_BOOTSTRAP_SERVERS: PLAINTEXT://kafka:9092
34+
SCHEMA_REGISTRY_LISTENERS: http://0.0.0.0:8081, https://0.0.0.0:8082
35+
SCHEMA_REGISTRY_INTER_INSTANCE_PROTOCOL: https
36+
SCHEMA_REGISTRY_SSL_KEYSTORE_LOCATION: /conf/tls/server.keystore.jks
37+
SCHEMA_REGISTRY_SSL_KEYSTORE_PASSWORD: ${PASS:-abcdefgh}
38+
SCHEMA_REGISTRY_SSL_KEY_PASSWORD: ${PASS:-abcdefgh}
39+
SCHEMA_REGISTRY_SSL_TRUSTSTORE_LOCATION: /conf/tls/server.truststore.jks
40+
SCHEMA_REGISTRY_SSL_TRUSTSTORE_PASSWORD: abcdefgh
41+
SCHEMA_REGISTRY_KAFKASTORE_CONNECTION_URL: zookeeper:2181
42+
schema-registry-basic-auth:
43+
image: confluentinc/cp-schema-registry:5.0.0
44+
depends_on:
45+
- zookeeper
46+
- kafka
47+
ports:
48+
- 8083:8083
49+
- 8084:8084
50+
volumes:
51+
- ./conf:/conf
52+
environment:
53+
SCHEMA_REGISTRY_HOST_NAME: schema-registry2
54+
SCHEMA_REGISTRY_KAFKASTORE_TOPIC: _schemas2
55+
SCHEMA_REGISTRY_SCHEMA_REGISTRY_ZK_NAMESPACE: schema_registry2
56+
SCHEMA_REGISTRY_KAFKASTORE_BOOTSTRAP_SERVERS: PLAINTEXT://kafka:9092
57+
SCHEMA_REGISTRY_LISTENERS: http://0.0.0.0:8083, https://0.0.0.0:8084
58+
SCHEMA_REGISTRY_INTER_INSTANCE_PROTOCOL: https
59+
SCHEMA_REGISTRY_SSL_KEYSTORE_LOCATION: /conf/tls/server.keystore.jks
60+
SCHEMA_REGISTRY_SSL_KEYSTORE_PASSWORD: ${PASS:-abcdefgh}
61+
SCHEMA_REGISTRY_SSL_KEY_PASSWORD: ${PASS:-abcdefgh}
62+
SCHEMA_REGISTRY_SSL_TRUSTSTORE_LOCATION: /conf/tls/server.truststore.jks
63+
SCHEMA_REGISTRY_SSL_TRUSTSTORE_PASSWORD: abcdefgh
64+
SCHEMA_REGISTRY_KAFKASTORE_CONNECTION_URL: zookeeper:2181
65+
SCHEMA_REGISTRY_AUTHENTICATION_METHOD: BASIC
66+
SCHEMA_REGISTRY_AUTHENTICATION_REALM: SchemaRegistry
67+
SCHEMA_REGISTRY_AUTHENTICATION_ROLES: Testers
68+
SCHEMA_REGISTRY_OPTS: -Djava.security.auth.login.config=/conf/schema-registry/schema-registry.jaas

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy