Skip to content
This repository was archived by the owner on Dec 29, 2021. It is now read-only.

Commit f695b6b

Browse files
scholzjscholzj
committed
Initial commit
Signed-off-by: Jakub Scholz <[email protected]>
0 parents  commit f695b6b

6 files changed

+741
-0
lines changed

‎README.md

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
# Demo: Strimzi with Open Policy Agent used for Kafka authorization
2+
3+
This repository contains the example files for using Open Policy Agent (OPA) for Apache Kafka authorization.
4+
This demo is related to the blog post published on [Strimzi website](https://strimzi.io).
5+
6+
## Prerequisites
7+
8+
### Namespace
9+
10+
Create a namespace `myproject` and set it as default.
11+
If you use different namespace, change the `.metadata.namespace` field in the YAML files in this repository
12+
13+
### Install Strimzi 0.19.0
14+
15+
Install Strimzi 0.19.0 and make sure it is watching the `myproject` namespace.
16+
You can use any of the available methods.
17+
18+
## Deploy OPA
19+
20+
The OPA policies used for both examples mentioned int he blog post are deployed using a ConfigMap [`opa-policies.yaml`](./opa-policies.yaml).
21+
You can create them using `kubectl`:
22+
23+
```
24+
kubectl apply -f opa-policies.yaml
25+
```
26+
27+
The [`opa-deployment.yaml`](./opa-deployment.yaml) contains the deployment of the OPA server.
28+
This is just example deployment which is not production ready.
29+
You can install it using `kubectl`:
30+
31+
```
32+
kubectl apply -f opa-deployment.yaml
33+
```
34+
35+
## Basic example
36+
37+
### Deploy Kafka cluster
38+
39+
Deploy the Kafka cluster from the [`basic-example-kafka.yaml`](./basic-example-kafka.yaml) file.
40+
This example is also configured to use the basic example policy.
41+
42+
```
43+
kubectl apply -f basic-example-kafka.yaml
44+
```
45+
46+
### Deploy allowed clients
47+
48+
In the file [`basic-example-clients-allowed.yaml`](./basic-example-clients-allowed.yaml) you can find example consumer and producer which are using users allowed to produce and consumer messages.
49+
50+
```
51+
kubectl apply -f ./basic-example-clients-allowed.yaml
52+
```
53+
54+
When you deploy them, you should see that the are allowed to run.
55+
56+
### Deploy not allowed clients
57+
58+
In the file [`basic-example-clients-denied.yaml`](./basic-example-clients-denied.yaml) you can find example consumer and producer which are using users not allowed to produce and consumer messages.
59+
60+
```
61+
kubectl apply -f ./basic-example-clients-denied.yaml
62+
```
63+
64+
When you deploy them, you should see that the are allowed to use the Kafka cluster.

‎basic-example-clients-allowed.yaml

+121
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
apiVersion: kafka.strimzi.io/v1alpha1
2+
kind: KafkaTopic
3+
metadata:
4+
name: my-topic
5+
labels:
6+
strimzi.io/cluster: my-cluster
7+
spec:
8+
replicas: 3
9+
partitions: 12
10+
---
11+
apiVersion: kafka.strimzi.io/v1beta1
12+
kind: KafkaUser
13+
metadata:
14+
name: john
15+
labels:
16+
strimzi.io/cluster: my-cluster
17+
spec:
18+
authentication:
19+
type: tls
20+
---
21+
apiVersion: apps/v1
22+
kind: Deployment
23+
metadata:
24+
labels:
25+
app: johns-producer
26+
name: johns-producer
27+
spec:
28+
replicas: 1
29+
selector:
30+
matchLabels:
31+
app: johns-producer
32+
template:
33+
metadata:
34+
labels:
35+
app: johns-producer
36+
spec:
37+
containers:
38+
- name: johns-producer
39+
image: strimzi/hello-world-producer:latest
40+
env:
41+
- name: CA_CRT
42+
valueFrom:
43+
secretKeyRef:
44+
name: my-cluster-cluster-ca-cert
45+
key: ca.crt
46+
- name: USER_CRT
47+
valueFrom:
48+
secretKeyRef:
49+
name: john
50+
key: user.crt
51+
- name: USER_KEY
52+
valueFrom:
53+
secretKeyRef:
54+
name: john
55+
key: user.key
56+
- name: BOOTSTRAP_SERVERS
57+
value: my-cluster-kafka-bootstrap:9093
58+
- name: TOPIC
59+
value: my-topic
60+
- name: DELAY_MS
61+
value: "1000"
62+
- name: LOG_LEVEL
63+
value: "INFO"
64+
- name: MESSAGE_COUNT
65+
value: "1000000"
66+
---
67+
apiVersion: kafka.strimzi.io/v1beta1
68+
kind: KafkaUser
69+
metadata:
70+
name: matt
71+
labels:
72+
strimzi.io/cluster: my-cluster
73+
spec:
74+
authentication:
75+
type: tls
76+
---
77+
apiVersion: apps/v1
78+
kind: Deployment
79+
metadata:
80+
labels:
81+
app: matts-consumer
82+
name: matts-consumer
83+
spec:
84+
replicas: 1
85+
selector:
86+
matchLabels:
87+
app: matts-consumer
88+
template:
89+
metadata:
90+
labels:
91+
app: matts-consumer
92+
spec:
93+
containers:
94+
- name: matts-consumer
95+
image: strimzi/hello-world-consumer:latest
96+
env:
97+
- name: CA_CRT
98+
valueFrom:
99+
secretKeyRef:
100+
name: my-cluster-cluster-ca-cert
101+
key: ca.crt
102+
- name: USER_CRT
103+
valueFrom:
104+
secretKeyRef:
105+
name: matt
106+
key: user.crt
107+
- name: USER_KEY
108+
valueFrom:
109+
secretKeyRef:
110+
name: matt
111+
key: user.key
112+
- name: BOOTSTRAP_SERVERS
113+
value: my-cluster-kafka-bootstrap:9093
114+
- name: TOPIC
115+
value: my-topic
116+
- name: GROUP_ID
117+
value: matts-group
118+
- name: LOG_LEVEL
119+
value: "INFO"
120+
- name: MESSAGE_COUNT
121+
value: "1000000"

‎basic-example-clients-denied.yaml

+121
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
apiVersion: kafka.strimzi.io/v1alpha1
2+
kind: KafkaTopic
3+
metadata:
4+
name: my-topic
5+
labels:
6+
strimzi.io/cluster: my-cluster
7+
spec:
8+
replicas: 3
9+
partitions: 12
10+
---
11+
apiVersion: kafka.strimzi.io/v1beta1
12+
kind: KafkaUser
13+
metadata:
14+
name: joe
15+
labels:
16+
strimzi.io/cluster: my-cluster
17+
spec:
18+
authentication:
19+
type: tls
20+
---
21+
apiVersion: apps/v1
22+
kind: Deployment
23+
metadata:
24+
labels:
25+
app: joes-producer
26+
name: joes-producer
27+
spec:
28+
replicas: 1
29+
selector:
30+
matchLabels:
31+
app: joes-producer
32+
template:
33+
metadata:
34+
labels:
35+
app: joes-producer
36+
spec:
37+
containers:
38+
- name: joes-producer
39+
image: strimzi/hello-world-producer:latest
40+
env:
41+
- name: CA_CRT
42+
valueFrom:
43+
secretKeyRef:
44+
name: my-cluster-cluster-ca-cert
45+
key: ca.crt
46+
- name: USER_CRT
47+
valueFrom:
48+
secretKeyRef:
49+
name: joe
50+
key: user.crt
51+
- name: USER_KEY
52+
valueFrom:
53+
secretKeyRef:
54+
name: joe
55+
key: user.key
56+
- name: BOOTSTRAP_SERVERS
57+
value: my-cluster-kafka-bootstrap:9093
58+
- name: TOPIC
59+
value: my-topic
60+
- name: DELAY_MS
61+
value: "1000"
62+
- name: LOG_LEVEL
63+
value: "INFO"
64+
- name: MESSAGE_COUNT
65+
value: "1000000"
66+
---
67+
apiVersion: kafka.strimzi.io/v1beta1
68+
kind: KafkaUser
69+
metadata:
70+
name: conor
71+
labels:
72+
strimzi.io/cluster: my-cluster
73+
spec:
74+
authentication:
75+
type: tls
76+
---
77+
apiVersion: apps/v1
78+
kind: Deployment
79+
metadata:
80+
labels:
81+
app: conors-consumer
82+
name: conors-consumer
83+
spec:
84+
replicas: 1
85+
selector:
86+
matchLabels:
87+
app: conors-consumer
88+
template:
89+
metadata:
90+
labels:
91+
app: conors-consumer
92+
spec:
93+
containers:
94+
- name: conors-consumer
95+
image: strimzi/hello-world-consumer:latest
96+
env:
97+
- name: CA_CRT
98+
valueFrom:
99+
secretKeyRef:
100+
name: my-cluster-cluster-ca-cert
101+
key: ca.crt
102+
- name: USER_CRT
103+
valueFrom:
104+
secretKeyRef:
105+
name: conor
106+
key: user.crt
107+
- name: USER_KEY
108+
valueFrom:
109+
secretKeyRef:
110+
name: conor
111+
key: user.key
112+
- name: BOOTSTRAP_SERVERS
113+
value: my-cluster-kafka-bootstrap:9093
114+
- name: TOPIC
115+
value: my-topic
116+
- name: GROUP_ID
117+
value: conors-group
118+
- name: LOG_LEVEL
119+
value: "INFO"
120+
- name: MESSAGE_COUNT
121+
value: "1000000"

‎basic-example-kafka.yaml

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
apiVersion: kafka.strimzi.io/v1beta1
2+
kind: Kafka
3+
metadata:
4+
name: my-cluster
5+
labels:
6+
app: my-cluster
7+
spec:
8+
kafka:
9+
replicas: 3
10+
resources:
11+
requests:
12+
memory: 2Gi
13+
cpu: 500m
14+
limits:
15+
memory: 2Gi
16+
cpu: "1"
17+
jvmOptions:
18+
-Xms: 1024m
19+
-Xmx: 1024m
20+
listeners:
21+
tls:
22+
authentication:
23+
type: tls
24+
authorization:
25+
type: opa
26+
url: http://opa:8181/v1/data/kafka/authz/example/basic/allow
27+
expireAfterMs: 60000
28+
config:
29+
offsets.topic.replication.factor: 3
30+
transaction.state.log.replication.factor: 3
31+
transaction.state.log.min.isr: 2
32+
storage:
33+
type: jbod
34+
volumes:
35+
- id: 0
36+
type: persistent-claim
37+
size: 100Gi
38+
deleteClaim: false
39+
zookeeper:
40+
replicas: 3
41+
resources:
42+
requests:
43+
memory: 1Gi
44+
cpu: "0.3"
45+
limits:
46+
memory: 1Gi
47+
cpu: "0.5"
48+
storage:
49+
type: persistent-claim
50+
size: 100Gi
51+
deleteClaim: false
52+
entityOperator:
53+
topicOperator:
54+
resources:
55+
requests:
56+
memory: 256Mi
57+
cpu: "0.1"
58+
limits:
59+
memory: 256Mi
60+
cpu: "0.5"
61+
userOperator:
62+
resources:
63+
requests:
64+
memory: 256Mi
65+
cpu: "0.1"
66+
limits:
67+
memory: 256Mi
68+
cpu: "0.5"

0 commit comments

Comments
 (0)