From 654803c2af7683bf21588c677d6a95ebda124c30 Mon Sep 17 00:00:00 2001 From: ivan Date: Mon, 2 Nov 2026 15:11:03 +0500 Subject: [PATCH] =?UTF-8?q?uralkal:=20Job=20=D0=B7=D0=B0=D0=B2=D0=BE=D0=B4?= =?UTF-8?q?=D0=B8=D1=82=20SCRAM-=D0=BF=D0=BE=D0=BB=D1=8C=D0=B7=D0=BE=D0=B2?= =?UTF-8?q?=D0=B0=D1=82=D0=B5=D0=BB=D0=B5=D0=B9=20Kafka=20=D0=B8=D0=B7=20V?= =?UTF-8?q?ault=20kafka/apps/{pm,issues,flows}?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Логин и пароль берутся из тех же путей Vault, что читают pm/message-hub и issues/flows; пароль администратора — inter_broker_user из kafka/bootstrap (роль Vault kafka, SA kafka-kafka-contour). После создания проверяется вход каждого пользователя по SASL_SSL на 9092, пароли в лог не пишутся. --- .../kafka/uralkal/kafka-scram-users-job.yaml | 112 ++++++++++++++++++ .../kafka/uralkal/kustomization.yaml | 1 + 2 files changed, 113 insertions(+) create mode 100644 infrastructure/kafka/uralkal/kafka-scram-users-job.yaml diff --git a/infrastructure/kafka/uralkal/kafka-scram-users-job.yaml b/infrastructure/kafka/uralkal/kafka-scram-users-job.yaml new file mode 100644 index 0000000..59e6b98 --- /dev/null +++ b/infrastructure/kafka/uralkal/kafka-scram-users-job.yaml @@ -0,0 +1,112 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: kafka-scram-users + namespace: kafka + annotations: + kustomize.toolkit.fluxcd.io/force: enabled +spec: + backoffLimit: 2 + template: + metadata: + annotations: + sidecar.istio.io/inject: "false" + vault.hashicorp.com/agent-inject: "true" + vault.hashicorp.com/agent-pre-populate-only: "true" + vault.hashicorp.com/auth-path: auth/kubernetes + vault.hashicorp.com/role: kafka + vault.hashicorp.com/agent-inject-secret-admin: secrets/data/kafka/bootstrap + vault.hashicorp.com/agent-inject-template-admin: | + {{- with secret "secrets/data/kafka/bootstrap" -}}{{ index .Data.data "interBrokerPassword" }}{{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-user: secrets/data/kafka/apps/pm + vault.hashicorp.com/agent-inject-template-pm-user: | + {{- with secret "secrets/data/kafka/apps/pm" -}}{{ index .Data.data "username" }}{{- end -}} + vault.hashicorp.com/agent-inject-secret-pm-pass: secrets/data/kafka/apps/pm + vault.hashicorp.com/agent-inject-template-pm-pass: | + {{- with secret "secrets/data/kafka/apps/pm" -}}{{ index .Data.data "password" }}{{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-user: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-user: | + {{- with secret "secrets/data/kafka/apps/issues" -}}{{ index .Data.data "username" }}{{- end -}} + vault.hashicorp.com/agent-inject-secret-issues-pass: secrets/data/kafka/apps/issues + vault.hashicorp.com/agent-inject-template-issues-pass: | + {{- with secret "secrets/data/kafka/apps/issues" -}}{{ index .Data.data "password" }}{{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-user: secrets/data/kafka/apps/flows + vault.hashicorp.com/agent-inject-template-flows-user: | + {{- with secret "secrets/data/kafka/apps/flows" -}}{{ index .Data.data "username" }}{{- end -}} + vault.hashicorp.com/agent-inject-secret-flows-pass: secrets/data/kafka/apps/flows + vault.hashicorp.com/agent-inject-template-flows-pass: | + {{- with secret "secrets/data/kafka/apps/flows" -}}{{ index .Data.data "password" }}{{- end -}} + spec: + serviceAccountName: kafka-kafka-contour + restartPolicy: Never + imagePullSecrets: + - name: regcred + nodeSelector: + dedicated: generic + securityContext: + runAsUser: 1001 + runAsNonRoot: true + fsGroup: 1001 + containers: + - name: kafka-scram-users + image: cr.yandex/crp3ccidau046kdj8g9q/contour/kafka-nn/kafka:4.0.0-debian-12-r10 + imagePullPolicy: IfNotPresent + env: + - name: KAFKA_HEAP_OPTS + value: -Xmx256m + command: + - /bin/bash + - -ec + - | + K=/opt/bitnami/kafka/bin + ADMIN=kafka-kafka-contour-controller-0.kafka-kafka-contour-controller-headless.kafka.svc.cluster.local:9094 + CLIENT=kafka-kafka-contour.kafka.svc.cluster.local:9092 + S=/vault/secrets + rc=0 + printf 'security.protocol=SASL_PLAINTEXT\nsasl.mechanism=PLAIN\nsasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="inter_broker_user" password="%s";\n' "$(cat $S/admin)" > /tmp/admin.conf + for app in pm issues flows; do + u=$(cat $S/$app-user); p=$(cat $S/$app-pass) + if [ -z "$u" ] || [ -z "$p" ]; then + echo "$app: empty username or password in kafka/apps/$app"; rc=1; continue + fi + if [ -f "/tmp/pw-$u" ]; then + if [ "$(cat /tmp/pw-$u)" != "$p" ]; then + echo "$app: user $u already set from another app with a different password, skipped"; rc=1 + else + echo "$app: user $u already set, same password" + fi + continue + fi + printf '%s' "$p" > "/tmp/pw-$u" + $K/kafka-configs.sh --bootstrap-server $ADMIN --command-config /tmp/admin.conf --alter --add-config "SCRAM-SHA-512=[iterations=4096,password=$p]" --entity-type users --entity-name "$u" > /dev/null + echo "$app: SCRAM-SHA-512 set for user $u" + done + sleep 5 + for app in pm issues flows; do + u=$(cat $S/$app-user); p=$(cat $S/$app-pass) + printf 'security.protocol=SASL_SSL\nsasl.mechanism=SCRAM-SHA-512\nssl.truststore.type=PEM\nssl.truststore.location=/kafka-ca/ca.crt\nsasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="%s" password="%s";\n' "$u" "$p" > /tmp/$app.conf + if $K/kafka-topics.sh --bootstrap-server $CLIENT --command-config /tmp/$app.conf --list > /dev/null; then + echo "$app: login as $u over SASL_SSL ok" + else + echo "$app: login as $u over SASL_SSL FAILED"; rc=1 + fi + done + $K/kafka-configs.sh --bootstrap-server $ADMIN --command-config /tmp/admin.conf --describe --entity-type users + rm -f /tmp/*.conf /tmp/pw-* + exit $rc + resources: + requests: + cpu: 50m + memory: 384Mi + volumeMounts: + - name: kafka-ca + mountPath: /kafka-ca + readOnly: true + volumes: + - name: kafka-ca + secret: + secretName: kafka-kafka-contour-tls + items: + - key: ca.crt + path: ca.crt diff --git a/infrastructure/kafka/uralkal/kustomization.yaml b/infrastructure/kafka/uralkal/kustomization.yaml index f60b1c1..dc521fe 100644 --- a/infrastructure/kafka/uralkal/kustomization.yaml +++ b/infrastructure/kafka/uralkal/kustomization.yaml @@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base + - kafka-scram-users-job.yaml patches: - path: kafka.yaml