Merge pull request #53 from twosixlabs/enh-kafka-certs

Enh kafka certs

bin/update_tools.sh

@@ -3,7 +3,7 @@
 
 # push the get_certificates.py script and requirements where ever we need it
 echo "Updating Certificate tools"
-for push_dir in "control/api_server/tools"
+for push_dir in "control/api_server/tools" "control/logging/tools"
 do
 	echo " ... [$push_dir]"
 	cp ./tools/certificates/get_certificates.py ./$push_dir/get_certificates.py

control/api_server/config/config.exs

@@ -9,8 +9,8 @@ use Mix.Config
 config :api_server,
   ecto_repos: [ApiServer.Repo],
   c2_kafka_topic: "api-server-control",
-  sensor_kafka_bootstrap: ["kafka:9092"],
-  client_kafka_bootstrap: ["kafka:9092"],
+  sensor_kafka_bootstrap: ["kafka:9455"],
+  client_kafka_bootstrap: ["kafka:9455"],
   ca_cert_file: "/app/certs/ca.pem",
   cfssl_host: "cfssl",
   cfssl_port: 3030,
@@ -49,7 +49,7 @@ config :kafka_ex,
 
   # brokers
   brokers: [
-    {"kafka", 9092}
+    {"kafka", 9455}
   ],
 
   consumer_group: "kafka_ex",
@@ -66,7 +66,13 @@ config :kafka_ex,
 
   commit_threshold: 100,
 
-  use_ssl: false,
+  use_ssl: true,
+
+  ssl_options: [
+
+    cacertfile: "/app/certs/ca.pem"
+    # see https://hexdocs.pm/kafka_ex/KafkaEx.Config.html#content for info on using client certs as well
+  ],
 
   kafka_version: "0.9.0"
 

control/logging/Dockerfile

@@ -0,0 +1,27 @@
+FROM spotify/kafka:latest
+
+# We need python3
+RUN apt-get update
+RUN apt-get install -y python3 python3-pip
+
+# install the certificate support tools
+RUN mkdir -p /var/tools/
+COPY tools/* /var/tools/
+RUN chmod ugo+x /var/tools/*
+
+RUN pip3 install -r /var/tools/get_certificates_requirements.txt
+
+# place our configuration
+COPY config/server.properties /opt/kafka_2.11-0.10.1.0/config
+
+# prep for our certifictes
+RUN mkdir -p /opt/kafka_2.11-0.10.1.0/certs
+
+# Place the run command
+COPY run.sh /opt/kafka_2.11-0.10.1.0/
+RUN chmod ugo+x /opt/kafka_2.11-0.10.1.0/run.sh
+
+EXPOSE 9455 9092 2181
+
+CMD "/opt/kafka_2.11-0.10.1.0/run.sh"
+

control/logging/config/server.properties

@@ -0,0 +1,147 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# see kafka.server.KafkaConfig for additional details and defaults
+
+############################# Server Basics #############################
+
+# The id of the broker. This must be set to a unique integer for each broker.
+broker.id=0
+
+############################# Socket Server Settings #############################
+
+# The address the socket server listens on. It will get the value returned from 
+# java.net.InetAddress.getCanonicalHostName() if not configured.
+#   FORMAT:
+#     listeners = listener_name://host_name:port
+#   EXAMPLE:
+#     listeners = PLAINTEXT://your.host.name:9092
+#listeners=PLAINTEXT://:9092
+
+# Hostname and port the broker will advertise to producers and consumers. If not set, 
+# it uses the value for "listeners" if configured.  Otherwise, it will use the value
+# returned from java.net.InetAddress.getCanonicalHostName().
+#advertised.listeners=PLAINTEXT://your.host.name:9092
+
+listeners=SSL://kafka:9455
+advertised.listeners=SSL://kafka:9455
+ssl.keystore.location=/opt/kafka_2.11-0.10.1.0/certs/server.keystore.jks
+ssl.keystore.password=kafka_key_store
+ssl.key.password=
+ssl.keystore.type=JKS
+ssl.truststore.location=/opt/kafka_2.11-0.10.1.0/certs/server.truststore.jks
+ssl.truststore.password=kafka_trust_store
+ssl.truststore.type=JKS
+
+security.inter.broker.protocol=SSL
+# Maps listener names to security protocols, the default is for them to be the same. See the config documentation for more details
+#listener.security.protocol.map=PLAINTEXT:PLAINTEXT,SSL:SSL,SASL_PLAINTEXT:SASL_PLAINTEXT,SASL_SSL:SASL_SSL
+
+# The number of threads that the server uses for receiving requests from the network and sending responses to the network
+num.network.threads=3
+
+# The number of threads that the server uses for processing requests, which may include disk I/O
+num.io.threads=8
+
+# The send buffer (SO_SNDBUF) used by the socket server
+socket.send.buffer.bytes=102400
+
+# The receive buffer (SO_RCVBUF) used by the socket server
+socket.receive.buffer.bytes=102400
+
+# The maximum size of a request that the socket server will accept (protection against OOM)
+socket.request.max.bytes=104857600
+
+
+############################# Log Basics #############################
+
+# A comma seperated list of directories under which to store log files
+log.dirs=/tmp/kafka-logs
+
+# The default number of log partitions per topic. More partitions allow greater
+# parallelism for consumption, but this will also result in more files across
+# the brokers.
+num.partitions=1
+
+# The number of threads per data directory to be used for log recovery at startup and flushing at shutdown.
+# This value is recommended to be increased for installations with data dirs located in RAID array.
+num.recovery.threads.per.data.dir=1
+
+############################# Internal Topic Settings  #############################
+# The replication factor for the group metadata internal topics "__consumer_offsets" and "__transaction_state"
+# For anything other than development testing, a value greater than 1 is recommended for to ensure availability such as 3.
+offsets.topic.replication.factor=1
+transaction.state.log.replication.factor=1
+transaction.state.log.min.isr=1
+
+############################# Log Flush Policy #############################
+
+# Messages are immediately written to the filesystem but by default we only fsync() to sync
+# the OS cache lazily. The following configurations control the flush of data to disk.
+# There are a few important trade-offs here:
+#    1. Durability: Unflushed data may be lost if you are not using replication.
+#    2. Latency: Very large flush intervals may lead to latency spikes when the flush does occur as there will be a lot of data to flush.
+#    3. Throughput: The flush is generally the most expensive operation, and a small flush interval may lead to exceessive seeks.
+# The settings below allow one to configure the flush policy to flush data after a period of time or
+# every N messages (or both). This can be done globally and overridden on a per-topic basis.
+
+# The number of messages to accept before forcing a flush of data to disk
+#log.flush.interval.messages=10000
+
+# The maximum amount of time a message can sit in a log before we force a flush
+#log.flush.interval.ms=1000
+
+############################# Log Retention Policy #############################
+
+# The following configurations control the disposal of log segments. The policy can
+# be set to delete segments after a period of time, or after a given size has accumulated.
+# A segment will be deleted whenever *either* of these criteria are met. Deletion always happens
+# from the end of the log.
+
+# The minimum age of a log file to be eligible for deletion due to age
+log.retention.hours=168
+
+# A size-based retention policy for logs. Segments are pruned from the log unless the remaining
+# segments drop below log.retention.bytes. Functions independently of log.retention.hours.
+#log.retention.bytes=1073741824
+
+# The maximum size of a log segment file. When this size is reached a new log segment will be created.
+log.segment.bytes=1073741824
+
+# The interval at which log segments are checked to see if they can be deleted according
+# to the retention policies
+log.retention.check.interval.ms=300000
+
+############################# Zookeeper #############################
+
+# Zookeeper connection string (see zookeeper docs for details).
+# This is a comma separated host:port pairs, each corresponding to a zk
+# server. e.g. "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002".
+# You can also append an optional chroot string to the urls to specify the
+# root directory for all kafka znodes.
+zookeeper.connect=localhost:2181
+
+# Timeout in ms for connecting to zookeeper
+zookeeper.connection.timeout.ms=6000
+
+
+############################# Group Coordinator Settings #############################
+
+# The following configuration specifies the time, in milliseconds, that the GroupCoordinator will delay the initial consumer rebalance.
+# The rebalance will be further delayed by the value of group.initial.rebalance.delay.ms as new members join the group, up to a maximum of max.poll.interval.ms.
+# The default value for this is 3 seconds.
+# We override this to 0 here as it makes for a better out-of-the-box experience for development and testing.
+# However, in production environments the default value of 3 seconds is more suitable as this will help to avoid unnecessary, and potentially expensive, rebalances during application startup.
+group.initial.rebalance.delay.ms=0

control/logging/run.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+
+# Get certificates
+python3 /var/tools/get_certificates.py --cfssl-host cfssl --hostname kafka -d $KAFKA_HOME/certs
+
+# Build the certs into a java trust store and certificate store
+
+## 1. Pack everything into a PKCS12 format
+openssl pkcs12 -export -inkey $KAFKA_HOME/certs/cert-key.pem -in $KAFKA_HOME/certs/cert.pem -certfile $KAFKA_HOME/certs/ca.pem -out $KAFKA_HOME/certs/kafka.server.pfx -passout pass:
+
+## 2. Build the public/private key store
+keytool -importkeystore -deststorepass kafka_key_store -destkeystore $KAFKA_HOME/certs/server.keystore.jks -srckeystore $KAFKA_HOME/certs/kafka.server.pfx -srcstoretype PKCS12 -alias 1 -srcstorepass ""
+
+## 3. Build the trust store with the root CA certificate
+keytool -keystore $KAFKA_HOME/certs/server.truststore.jks -alias CARoot -import -file $KAFKA_HOME/certs/ca.pem -deststorepass kafka_trust_store -noprompt
+
+# Run the server
+supervisord -n