Kafka配置SSL信道加密

kafka配置SASL认证

Kafka单机配置SSL认证

使用脚本生成SSL证书 执行ssl.sh

# 配置SSL配置文件
cp server.properties ssl.properties

# 修改配置文件SSL内容
listeners=SSL://kafka-test:9092
advertised.listeners=SSL://kafka-test:9092
ssl.keystore.location=/root/config/certificates/kafka.keystore
ssl.keystore.password=123456
ssl.key.password=123456
ssl.truststore.location=/root/config/certificates/kafka.truststore
ssl.truststore.password=123456

ssl.client.auth=required
ssl.enabled.protocols=TLSv1.2,TLSv1.1,TLSv1
ssl.keystore.type=JKS
ssl.truststore.type=JKS
security.inter.broker.protocol=SSL

# 客户端访问信息，需要增加如下配置
security.protocol=SSL
ssl.truststore.location=/root/config/certificates/kafka.truststore
ssl.truststore.password=123456
ssl.keystore.password=123456
ssl.keystore.location=/root/config/certificates/kafka.keystore

# 测试
kafka-topics.sh --bootstrap-server nn1.hainiu.com:9092 --list --command-config client.conf 

Kafka集群配置SSL认证

这里默认还是两个集群

kafka-broker1 kafka-broker2

使用脚本生成SSL证书 执行ssl.sh

同步证书到其他broker

xsync kafka.keystore
xsync kafka.truststore

• 修改server.properties配置

listeners=SASL_SSL://0.0.0.0:9092
advertised.listeners=SASL_SSL://kafka-broker2:9092
security.inter.broker.protocol=SASL_SSL
sasl.mechanism.inter.broker.protocol=PLAIN
sasl.enabled.mechanisms=PLAIN

ssl.keystore.location=/root/config/certificates/kafka.keystore
ssl.keystore.password=kafka123456
ssl.key.password=kafka123456
ssl.truststore.location=/root/config/certificates/kafka.truststore
ssl.truststore.password=kafka123456

ssl.client.auth=required
ssl.enabled.protocols=TLSv1.2,TLSv1.1,TLSv1
ssl.keystore.type=JKS
ssl.truststore.type=JKS

• 集群启动produce和consumer的配置如下

  
  security.protocol=SASL_PLAINTEXT
  sasl.mechanism=PLAIN
  sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="kafka123456";
  
  security.protocol=SASL_SSL
  ssl.truststore.location=/root/config/certificates/kafka.truststore
  ssl.truststore.password=kafka123456
  
  

openSSL脚本如下

本作品采用知识共享署名-非商业性使用 4.0 国际许可协议进行许可。
本文链接：https://www.blog.ycisch.com/archives/749.html