Skip to content

Commit 2efde81

Browse files
ljupcovangelskiljupcovangelski
authored
[#4167] Kafka certificate authentication (#4168)
1 parent 2f052cd commit 2efde81

File tree

23 files changed

+270
-7
lines changed

23 files changed

+270
-7
lines changed

‎backend/components/chat-plugin/helm/templates/backend/deployment.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,11 @@ spec:
5151
initialDelaySeconds: 120
5252
periodSeconds: 10
5353
failureThreshold: 3
54+
{{ if .Values.global.kafkaCertAuth }}
55+
volumeMounts:
56+
- name: kafka-config-certs
57+
mountPath: /opt/kafka/certs
58+
{{ end }}
5459
resources:
5560
{{ toYaml .Values.backend.resources | indent 10 }}
5661
initContainers:
@@ -68,3 +73,8 @@ spec:
6873
- name: provisioning-scripts
6974
configMap:
7075
name: provisioning-scripts
76+
{{ if .Values.global.kafkaCertAuth }}
77+
- name: kafka-config-certs
78+
configMap:
79+
name: kafka-config-certs
80+
{{ end }}

‎backend/components/contacts/helm/templates/deployment.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@ spec:
4545
initialDelaySeconds: 120
4646
periodSeconds: 10
4747
failureThreshold: 3
48+
{{ if .Values.global.kafkaCertAuth }}
49+
volumeMounts:
50+
- name: kafka-config-certs
51+
mountPath: /opt/kafka/certs
52+
{{ end }}
4853
resources:
4954
{{ toYaml .Values.resources | indent 10 }}
5055
initContainers:
@@ -62,3 +67,8 @@ spec:
6267
- name: provisioning-scripts
6368
configMap:
6469
name: provisioning-scripts
70+
{{ if .Values.global.kafkaCertAuth }}
71+
- name: kafka-config-certs
72+
configMap:
73+
name: kafka-config-certs
74+
{{ end }}

‎backend/components/facebook/helm/templates/deployments.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,11 @@ spec:
5959
- name: Health-Check
6060
value: health-check
6161
initialDelaySeconds: 120
62+
{{ if .Values.global.kafkaCertAuth }}
63+
volumeMounts:
64+
- name: kafka-config-certs
65+
mountPath: /opt/kafka/certs
66+
{{ end }}
6267
resources:
6368
{{ toYaml .Values.connector.resources | indent 12 }}
6469
initContainers:
@@ -76,6 +81,11 @@ spec:
7681
- name: provisioning-scripts
7782
configMap:
7883
name: provisioning-scripts
84+
{{ if .Values.global.kafkaCertAuth }}
85+
- name: kafka-config-certs
86+
configMap:
87+
name: kafka-config-certs
88+
{{ end }}
7989
---
8090
apiVersion: apps/v1
8191
kind: Deployment
@@ -124,6 +134,11 @@ spec:
124134
initialDelaySeconds: 120
125135
periodSeconds: 10
126136
failureThreshold: 3
137+
{{ if .Values.global.kafkaCertAuth }}
138+
volumeMounts:
139+
- name: kafka-config-certs
140+
mountPath: /opt/kafka/certs
141+
{{ end }}
127142
resources:
128143
{{ toYaml .Values.eventsRouter.resources | indent 10 }}
129144
initContainers:
@@ -141,3 +156,8 @@ spec:
141156
- name: provisioning-scripts
142157
configMap:
143158
name: provisioning-scripts
159+
{{ if .Values.global.kafkaCertAuth }}
160+
- name: kafka-config-certs
161+
configMap:
162+
name: kafka-config-certs
163+
{{ end }}

‎backend/components/google/helm/templates/deployments.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,11 @@ spec:
5454
- name: Health-Check
5555
value: health-check
5656
initialDelaySeconds: 120
57+
{{ if .Values.global.kafkaCertAuth }}
58+
volumeMounts:
59+
- name: kafka-config-certs
60+
mountPath: /opt/kafka/certs
61+
{{ end }}
5762
resources:
5863
{{ toYaml .Values.connector.resources | indent 12 }}
5964
initContainers:
@@ -71,6 +76,11 @@ spec:
7176
- name: provisioning-scripts
7277
configMap:
7378
name: provisioning-scripts
79+
{{ if .Values.global.kafkaCertAuth }}
80+
- name: kafka-config-certs
81+
configMap:
82+
name: kafka-config-certs
83+
{{ end }}
7484
---
7585
apiVersion: apps/v1
7686
kind: Deployment
@@ -122,6 +132,11 @@ spec:
122132
initialDelaySeconds: 120
123133
periodSeconds: 10
124134
failureThreshold: 3
135+
{{ if .Values.global.kafkaCertAuth }}
136+
volumeMounts:
137+
- name: kafka-config-certs
138+
mountPath: /opt/kafka/certs
139+
{{ end }}
125140
resources:
126141
{{ toYaml .Values.eventsRouter.resources | indent 10 }}
127142
initContainers:
@@ -139,3 +154,8 @@ spec:
139154
- name: provisioning-scripts
140155
configMap:
141156
name: provisioning-scripts
157+
{{ if .Values.global.kafkaCertAuth }}
158+
- name: kafka-config-certs
159+
configMap:
160+
name: kafka-config-certs
161+
{{ end }}

‎backend/components/media-resolver/helm/templates/deployment.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@ spec:
4545
initialDelaySeconds: 120
4646
periodSeconds: 10
4747
failureThreshold: 3
48+
{{ if .Values.global.kafkaCertAuth }}
49+
volumeMounts:
50+
- name: kafka-config-certs
51+
mountPath: /opt/kafka/certs
52+
{{ end }}
4853
resources:
4954
{{ toYaml .Values.resources | indent 12 }}
5055
initContainers:
@@ -62,3 +67,8 @@ spec:
6267
- name: provisioning-scripts
6368
configMap:
6469
name: provisioning-scripts
70+
{{ if .Values.global.kafkaCertAuth }}
71+
- name: kafka-config-certs
72+
configMap:
73+
name: kafka-config-certs
74+
{{ end }}

‎backend/components/sources-api/helm/templates/deployment.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,11 @@ spec:
5050
initialDelaySeconds: 120
5151
periodSeconds: 10
5252
failureThreshold: 3
53+
{{ if .Values.global.kafkaCertAuth }}
54+
volumeMounts:
55+
- name: kafka-config-certs
56+
mountPath: /opt/kafka/certs
57+
{{ end }}
5358
resources:
5459
{{ toYaml .Values.resources | indent 10 }}
5560
initContainers:
@@ -67,3 +72,8 @@ spec:
6772
- name: provisioning-scripts
6873
configMap:
6974
name: provisioning-scripts
75+
{{ if .Values.global.kafkaCertAuth }}
76+
- name: kafka-config-certs
77+
configMap:
78+
name: kafka-config-certs
79+
{{ end }}

‎backend/components/streams/helm/templates/deployment.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ spec:
4848
initialDelaySeconds: 120
4949
periodSeconds: 10
5050
failureThreshold: 3
51+
{{ if .Values.global.kafkaCertAuth }}
52+
volumeMounts:
53+
- name: kafka-config-certs
54+
mountPath: /opt/kafka/certs
55+
{{ end }}
5156
resources:
5257
{{ toYaml .Values.resources | indent 10 }}
5358
initContainers:
@@ -67,3 +72,8 @@ spec:
6772
- name: provisioning-scripts
6873
configMap:
6974
name: provisioning-scripts
75+
{{ if .Values.global.kafkaCertAuth }}
76+
- name: kafka-config-certs
77+
configMap:
78+
name: kafka-config-certs
79+
{{ end }}

‎backend/components/twilio/helm/templates/deployments.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,11 @@ spec:
5454
- name: Health-Check
5555
value: health-check
5656
initialDelaySeconds: 120
57+
{{ if .Values.global.kafkaCertAuth }}
58+
volumeMounts:
59+
- name: kafka-config-certs
60+
mountPath: /opt/kafka/certs
61+
{{ end }}
5762
resources:
5863
{{ toYaml .Values.connector.resources | indent 12 }}
5964
initContainers:
@@ -141,3 +146,8 @@ spec:
141146
- name: provisioning-scripts
142147
configMap:
143148
name: provisioning-scripts
149+
{{ if .Values.global.kafkaCertAuth }}
150+
- name: kafka-config-certs
151+
configMap:
152+
name: kafka-config-certs
153+
{{ end }}

‎backend/components/viber/helm/templates/deployments.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ spec:
4949
- name: Health-Check
5050
value: health-check
5151
initialDelaySeconds: 120
52+
{{ if .Values.global.kafkaCertAuth }}
53+
volumeMounts:
54+
- name: kafka-config-certs
55+
mountPath: /opt/kafka/certs
56+
{{ end }}
5257
resources:
5358
{{ toYaml .Values.connector.resources | indent 12 }}
5459
initContainers:
@@ -66,3 +71,8 @@ spec:
6671
- name: provisioning-scripts
6772
configMap:
6873
name: provisioning-scripts
74+
{{ if .Values.global.kafkaCertAuth }}
75+
- name: kafka-config-certs
76+
configMap:
77+
name: kafka-config-certs
78+
{{ end }}

‎backend/components/webhook/helm/templates/deployments.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,11 @@ spec:
5555
- name: Health-Check
5656
value: health-check
5757
initialDelaySeconds: 120
58+
{{ if .Values.global.kafkaCertAuth }}
59+
volumeMounts:
60+
- name: kafka-config-certs
61+
mountPath: /opt/kafka/certs
62+
{{ end }}
5863
resources:
5964
{{ toYaml .Values.consumer.resources | indent 10 }}
6065
initContainers:
@@ -157,3 +162,8 @@ spec:
157162
- name: provisioning-scripts
158163
configMap:
159164
name: provisioning-scripts
165+
{{ if .Values.global.kafkaCertAuth }}
166+
- name: kafka-config-certs
167+
configMap:
168+
name: kafka-config-certs
169+
{{ end }}

‎backend/components/whatsapp/helm/templates/deployments.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,11 @@ spec:
113113
initialDelaySeconds: 120
114114
periodSeconds: 10
115115
failureThreshold: 3
116+
{{ if .Values.global.kafkaCertAuth }}
117+
volumeMounts:
118+
- name: kafka-config-certs
119+
mountPath: /opt/kafka/certs
120+
{{ end }}
116121
resources:
117122
{{ toYaml .Values.eventsRouter.resources | indent 10 }}
118123
initContainers:
@@ -130,3 +135,8 @@ spec:
130135
- name: provisioning-scripts
131136
configMap:
132137
name: provisioning-scripts
138+
{{ if .Values.global.kafkaCertAuth }}
139+
- name: kafka-config-certs
140+
configMap:
141+
name: kafka-config-certs
142+
{{ end }}

‎docs/docs/getting-started/installation/helm.md

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -290,6 +290,39 @@ Run the following command to create the `Airy` platform without the bundled inst
290290
helm install airy airy/airy --timeout 10m --set prerequisites.kafka.enabled=false --values ./airy.yaml
291291
```
292292

293+
#### Confluent
294+
295+
To connect to a Kafka instance in Confluent cloud, settings the `config.kafka.brokers` and `config.kafka.aurhJaas` is enough, prior to deploying the Helm chart.
296+
297+
#### Aiven
298+
299+
Aiven cloud uses a keystore and truststore certificates that need to be loaded on the workloads that are connecting to Kafka. Get the necessary certificates and connection files from Aiven using the `avn` CLI and place them in a separate directory.
300+
301+
```
302+
avn service user-kafka-java-creds {KAFKA_INSTANCE} --username {USERNAME} -d ./aiven/ --password {PASSWORD}
303+
```
304+
305+
Create a Kubernetes ConfigMap that contains the contents of the created directory:
306+
307+
```
308+
kubectl create configmap kafka-config-certs --from-file aiven/
309+
```
310+
311+
Set the connection appropriate parameters in your `airy.yaml` file:
312+
313+
```yaml
314+
config:
315+
kafka:
316+
brokers: "the-aiven-kafka-broker-url"
317+
keyTrustSecret: "the-key-trust-secret"
318+
```
319+
320+
Then install Airy with the following command:
321+
322+
```sh
323+
helm install airy airy/airy --timeout 10m --set prerequisites.kafka.enabled=false --set global.kafkaCertAuth=true --values ./airy.yaml
324+
```
325+
293326
### Kafka partitions per topic
294327

295328
Currently all the default topics in the Airy instance are created with 10 partitions. To create these topics with a different number of partitions, add the following to your `airy.yaml` file before running `helm install` (before the initial creation of the topics):

‎infrastructure/helm-chart/templates/components/api-admin/deployment.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,11 @@ spec:
6060
initialDelaySeconds: 120
6161
periodSeconds: 10
6262
failureThreshold: 3
63+
{{ if .Values.global.kafkaCertAuth }}
64+
volumeMounts:
65+
- name: kafka-config-certs
66+
mountPath: /opt/kafka/certs
67+
{{ end }}
6368
resources:
6469
{{ toYaml .Values.components.api.admin.resources | indent 10 }}
6570
initContainers:
@@ -77,3 +82,8 @@ spec:
7782
- name: provisioning-scripts
7883
configMap:
7984
name: provisioning-scripts
85+
{{ if .Values.global.kafkaCertAuth }}
86+
- name: kafka-config-certs
87+
configMap:
88+
name: kafka-config-certs
89+
{{ end }}

‎infrastructure/helm-chart/templates/components/api-communication/deployment.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@ spec:
4545
initialDelaySeconds: 120
4646
periodSeconds: 10
4747
failureThreshold: 3
48+
{{ if .Values.global.kafkaCertAuth }}
49+
volumeMounts:
50+
- name: kafka-config-certs
51+
mountPath: /opt/kafka/certs
52+
{{ end }}
4853
resources:
4954
{{ toYaml .Values.components.api.communication.resources | indent 10 }}
5055
initContainers:
@@ -62,3 +67,8 @@ spec:
6267
- name: provisioning-scripts
6368
configMap:
6469
name: provisioning-scripts
70+
{{ if .Values.global.kafkaCertAuth }}
71+
- name: kafka-config-certs
72+
configMap:
73+
name: kafka-config-certs
74+
{{ end }}

‎infrastructure/helm-chart/templates/components/api-components-installer/deployment.yaml

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,11 @@ spec:
8181
initialDelaySeconds: 60
8282
periodSeconds: 10
8383
failureThreshold: 3
84+
{{ if .Values.global.kafkaCertAuth }}
85+
volumeMounts:
86+
- name: kafka-config-certs
87+
mountPath: /opt/kafka/certs
88+
{{ end }}
8489
resources:
8590
{{ toYaml .Values.components.api.components.installer.resources | indent 10 }}
8691
initContainers:
@@ -102,4 +107,8 @@ spec:
102107
- name: provisioning-scripts
103108
configMap:
104109
name: provisioning-scripts
105-
110+
{{ if .Values.global.kafkaCertAuth }}
111+
- name: kafka-config-certs
112+
configMap:
113+
name: kafka-config-certs
114+
{{ end }}

0 commit comments

Comments
 (0)