Skip to content

Commit 0e0486b

Browse files
MongeyMongey
committed
ok
1 parent 547bd81 commit 0e0486b

11 files changed

Lines changed: 139 additions & 17 deletions

File tree

‎bin/build-and-add-plugin‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
set -e
3+
4+
export VAULT_ADDR=http://localhost:8200
5+
PLUGIN_NAME="vault-plugin-secrets-kafka"
6+
MNT_PATH="kafka"
7+
8+
echo "---> Building"
9+
GOOS=linux GOARCH=amd64 go build -o "docker/plugins/$PLUGIN_NAME"
10+
SHASUM=$(shasum -a 256 "docker/plugins/$PLUGIN_NAME" | cut -d " " -f1)
11+
12+
echo "---->Registering plugin"
13+
vault write sys/plugins/catalog/$PLUGIN_NAME \
14+
sha_256="$SHASUM" \
15+
command="$PLUGIN_NAME"
16+
17+
echo " Mouting plugin"
18+
vault secrets enable -path=$MNT_PATH -plugin-name=$PLUGIN_NAME plugin

‎bin/dev‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/usr/bin/env bash
2-
set -e
2+
set -ex
33

44
MNT_PATH="kafka"
55
PLUGIN_NAME="vault-plugin-secrets-kafka"
@@ -45,8 +45,9 @@ function cleanup {
4545
}
4646
trap cleanup EXIT
4747

48+
echo "waaaaaaaaaaat"
4849
echo " Authing"
49-
vault auth root &>/dev/null
50+
#vault auth root
5051

5152
echo "--> Building"
5253
go build -o "$SCRATCH/plugins/$PLUGIN_NAME"

‎bin/quick-test‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ set -e
44
export VAULT_ADDR=http://localhost:8200
55

66
TTL=1000
7-
ADMINNAME="ConorAdmin"
7+
ADMINNAME="VaultKafkaPlugin"
88
DATA=$(vault write -format=json pki/issue/kafka-clients common_name="$ADMINNAME" ttl=$TTL | jq -r .data)
99

1010
echo "Hello $NAME"

‎docker-compose.yaml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
version: '2'
3+
services:
4+
vault:
5+
image: vault:1.3.0
6+
ports:
7+
- "8200:8200"
8+
command: vault server -dev -config="/vault/vault.hcl"
9+
volumes:
10+
- ./docker:/vault
11+
environment:
12+
VAULT_DEV_ROOT_TOKEN_ID: "root"
13+
VAULT_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
14+
15+
zookeeper:
16+
image: confluentinc/cp-zookeeper:latest
17+
ports:
18+
- "2181:2181"
19+
environment:
20+
ZOOKEEPER_CLIENT_PORT: 2181
21+
ZOOKEEPER_TICK_TIME: 2000
22+
extra_hosts:
23+
- "moby:127.0.0.1"
24+
25+
kafka:
26+
image: confluentinc/cp-kafka:5.0.1
27+
ports:
28+
- "9092:9092"
29+
depends_on:
30+
- zookeeper
31+
environment:
32+
KAFKA_BROKER_ID: 1
33+
KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
34+
KAFKA_ADVERTISED_LISTENERS: SSL://localhost:9092
35+
KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
36+
37+
KAFKA_SSL_KEYSTORE_FILENAME: kafka.broker0.keystore.jks
38+
KAFKA_SSL_TRUSTSTORE_FILENAME: kafka.broker0.truststore.jks
39+
40+
KAFKA_SSL_KEY_CREDENTIALS: broker0_sslkey_creds
41+
42+
KAFKA_SSL_KEYSTORE_CREDENTIALS: broker0_keystore_creds
43+
KAFKA_SSL_TRUSTSTORE_CREDENTIALS: broker0_truststore_creds
44+
45+
KAFKA_SECURITY_INTER_BROKER_PROTOCOL: SSL
46+
KAFKA_SSL_CLIENT_AUTH: required
47+
KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: ""
48+
KAFKA_LISTENER_NAME_INTERNAL_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM:
49+
KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND: "false"
50+
KAFKA_AUTHORIZER_CLASS_NAME: kafka.security.auth.SimpleAclAuthorizer
51+
volumes:
52+
- ./tmp/secrets:/etc/kafka/secrets
53+
extra_hosts:
54+
- "moby:127.0.0.1"

‎docker/vault.hcl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
plugin_directory = "/vault/plugins"

‎kafka-helper-scripts/broker0.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@ security.inter.broker.protocol=SSL
88
ssl.endpoint.identification.algorithm=
99
ssl.client.auth=required
1010
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
11-
super.users=User:CN=ConorAdmin;User:CN=broker0;
11+
super.users=User:CN=VaultKafkaPlugin;User:CN=broker0;

‎kafka-helper-scripts/enable-pki‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/bin/bash
2+
set -e
3+
4+
export VAULT_ADDR=http://localhost:8200
5+
6+
echo "PKI Enable"
7+
vault secrets enable pki
8+
vault write pki/root/generate/internal common_name=kafka-cluster
9+
echo "Kafka role"
10+
vault write pki/roles/kafka-clients allow_any_name=true
11+
echo "==> Ready!"

‎kafka-helper-scripts/generate-broker-keystore.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
1+
#!/bin/bash
12
set -e
3+
24
export VAULT_ADDR=http://localhost:8200
35

46
TTL=1000
@@ -48,4 +50,7 @@ keytool -importkeystore \
4850

4951
rm ca.crt server.key server.crt server.p12
5052

53+
echo $PASSWORD > tmp/secrets/broker0_keystore_creds
54+
mv $OUTPUT_FILE tmp/secrets/kafka.broker0.keystore.jks
55+
5156
echo "Done!"

‎kafka-helper-scripts/generate-client-certs.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ NAME=${PARAM:-"unknown client"}
77
DATA=$(vault write -format=json pki/issue/kafka-clients common_name="$NAME" ttl=$TTL | jq -r .data)
88

99
echo "Hello $NAME"
10-
printf "%s" "$DATA" | jq -r .private_key > private.key
11-
printf "%s" "$DATA" | jq -r .issuing_ca > ca.cert
12-
printf "%s" "$DATA" | jq -r .certificate > client.cert
10+
printf "%s" "$DATA" | jq -r .private_key > sample-app/private.key
11+
printf "%s" "$DATA" | jq -r .issuing_ca > sample-app/ca.cert
12+
printf "%s" "$DATA" | jq -r .certificate > sample-app/client.cert
1313
echo "Done!"

‎kafka-helper-scripts/generate-truststore.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,5 @@ echo "Cleaning up"
2323
set +e
2424
rm issuing_ca.cer
2525
set -e
26-
26+
echo $PASSWORD > tmp/secrets/broker0_truststore_creds
27+
mv $OUTPUT_FILE tmp/secrets/kafka.broker0.truststore.jks

0 commit comments

Comments
 (0)