Add DELEGATED_SASL_SSL with tls to all connections

driver-gateway/README.md

@@ -15,13 +15,15 @@ Pre-requisites:
 4. Initialize terraform with `terraform init`
 5. Create the infrastructure with `terraform apply`
    1. You can change the value of num_instances using -var='num_instances={"client"=5, "gateway"=4, "kafka"=2}'
-   2. You might also need to change the AWS profile with -var='aws_profile=your_profile'
+   2. You might also need to change the AWS profile with -var='profile=your_profile'
    3. With SSO the session does expire so you might need to run `aws sso login --profile your_profile` before running terraform
 6. Export your harbor creds https://harbor.cdkt.dev/
    1. Click your name in the top right corner and select User Profile then take your username and CLI secret
    2. export REGISTRY_USERNAME=<registry login>
    3. export REGISTRY_PASSWORD=<registry api token>
+   4. export GATEWAY_IMAGE=harbor.cdkt.dev/conduktor/conduktor-gateway:latest
 7. Setup nodes with `ansible-playbook --user ec2-user --inventory-file inventory.ini deploy.yaml`
+   1. If you want to set tls and use delegated_sasl_ssl run `ansible-playbook --user ec2-user --inventory-file inventory.ini deploy.yaml -e "use_tls_and_ssl=true"`
 8. Connect to one benchmark worker node with `ssh -i ~/.ssh/kafka_aws ec2-user@$(terraform output client_ssh_host | tr -d '"')`
 9.  Go to benchmark directory with `cd /opt/benchmark`
 10. Run the benchmark with `sudo bin/benchmark --drivers driver-gateway/gateway-latency.yaml workloads/100-topic-4-partitions-1kb-4p-4c-500k.yaml;`

driver-gateway/deploy/ssd-deployment/ansible-vars.yml

@@ -0,0 +1,11 @@
+# vars.yml
+use_tls_and_ssl: false
+kafka_truststore_password: "admin123"
+kafka_keystore_password:  "admin123"
+kafka_key_password: "admin123"
+gateway_truststore_password: "admin123"
+gateway_keystore_password: "admin123"
+gateway_key_password: "admin123"
+client_truststore_password: "admin123"
+client_keystore_password: "admin123"
+client_key_password: "admin123"

driver-gateway/deploy/ssd-deployment/deploy.yaml

@@ -1,4 +1,4 @@
-#
+---
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
@@ -16,6 +16,8 @@
   hosts: all
   gather_facts: no # important
   tags: [always]
+  vars_files:
+    - ./tf_ansible_vars_file.yml
   tasks:
     - name: Wait for all instances to become reachable
       wait_for_connection:
@@ -99,6 +101,8 @@
   hosts: all
   connection: ssh
   become: true
+  vars_files:
+    - ./ansible-vars.yml
   tasks:
     - name: Install RPM packages
       yum: pkg={{ item }} state=installed
@@ -118,7 +122,7 @@
         gatewayServers: "{{ groups['gateway'] | map('extract', hostvars, ['private_ip']) | map('regex_replace', '^(.*)$', '\\1:6969') | join(',') }}"
         privateIp: "{{ hostvars[inventory_hostname]['ansible_default_ipv4']['address'] }}"
         kafkaVersion: "3.6.1"
-      tags: [ always, client-code ]
+      tags: [always, client-code]
     - debug:
         msg: "zookeeper servers: {{ zookeeperServers }}\nbootstrap servers: {{ bootstrapServers }}\ngateway servers: {{ gatewayServers }}"
     - name: Change locale to en_US.utf-8
@@ -131,6 +135,8 @@
   connection: ssh
   become: true
   tags: [kafka]
+  vars_files:
+    - ./ansible-vars.yml
   tasks:
     - file: path=/opt/kafka state=absent
     - file: path=/opt/kafka state=directory
@@ -141,7 +147,6 @@
         dest: /opt/kafka
         extra_opts: ["--strip-components=1"]
 
-
 - name: Setup ZooKeeper
   hosts: zookeeper
   connection: ssh
@@ -172,18 +177,129 @@
         daemon_reload: yes
         name: "zookeeper"
 
+# Set up TLS for Client, Gateway, and Kafka
+- name: Generate CA and certificates
+  hosts: [kafka, gateway, client]
+  become: true
+  vars_files:
+    - ./ansible-vars.yml
+  tasks:
+  - name: Generate CA private key and certificate if not exist
+    command: >
+      openssl req -new -x509 -keyout /tmp/ca-key.pem -out /tmp/ca-cert.pem -days 365 -nodes
+      -subj "/CN=MyKafkaCA/O=Conduktor/C=UK"
+    args:
+      creates: /tmp/ca-cert.pem
+  # Gateway Certificate and Truststore Setup
+  - name: Generate certificates for Gateway
+    when: "'gateway' in group_names and use_tls_and_ssl"
+    block:
+      - name: Create SSL directory for Gateway
+        file:
+          path: /opt/conduktor-gateway/ssl
+          state: directory
+          mode: '0755'
+      - name: Generate Gateway private key and CSR if not exist
+        command: >
+          openssl req -new -newkey rsa:2048 -nodes -keyout /opt/conduktor-gateway/ssl/gateway-key.pem
+          -out /opt/conduktor-gateway/ssl/gateway.csr -subj "/CN=gateway-server/O=Conduktor/C=UK"
+        args:
+          creates: /opt/conduktor-gateway/ssl/gateway-key.pem
+      - name: Sign Gateway CSR with CA certificate
+        command: >
+          openssl x509 -req -in /opt/conduktor-gateway/ssl/gateway.csr -CA /tmp/ca-cert.pem
+          -CAkey /tmp/ca-key.pem -CAcreateserial -out /opt/conduktor-gateway/ssl/gateway-cert.pem -days 365
+        args:
+          creates: /opt/conduktor-gateway/ssl/gateway-cert.pem
+      - name: Import CA certificate to Gateway truststore
+        command: >
+          keytool -keystore /opt/conduktor-gateway/ssl/gateway_truststore.jks -alias CARoot
+          -import -file /tmp/ca-cert.pem -storepass "{{ gateway_truststore_password }}" -noprompt
+        args:
+          creates: /opt/conduktor-gateway/ssl/gateway_truststore.jks
+      - name: Import Gateway certificate and key to Gateway keystore
+        command: >
+          keytool -importkeystore -srckeystore /opt/conduktor-gateway/ssl/gateway-cert.pem
+          -destkeystore /opt/conduktor-gateway/ssl/gateway_keystore.jks
+          -srcalias gateway-server -destalias gateway-server -srcstorepass "{{ gateway_keystore_password }}"
+        args:
+          creates: /opt/conduktor-gateway/ssl/gateway_keystore.jks
+  # Kafka Certificate and Truststore Setup
+  - name: Generate certificates for Kafka
+    when: "'kafka' in group_names and use_tls_and_ssl"
+    block:
+      - name: Create SSL directory for Kafka
+        file:
+          path: /opt/kafka/config
+          state: directory
+          mode: '0755'
+      - name: Generate Kafka private key and CSR if not exist
+        command: >
+          openssl req -new -newkey rsa:2048 -nodes -keyout /opt/kafka/config/kafka-key.pem
+          -out /opt/kafka/config/kafka.csr -subj "/CN=kafka-server/O=Conduktor/C=UK"
+        args:
+          creates: /opt/kafka/config/kafka-key.pem
+      - name: Sign Kafka CSR with CA certificate
+        command: >
+          openssl x509 -req -in /opt/kafka/config/kafka.csr -CA /tmp/ca-cert.pem
+          -CAkey /tmp/ca-key.pem -CAcreateserial -out /opt/kafka/config/kafka-cert.pem -days 365
+        args:
+          creates: /opt/kafka/config/kafka-cert.pem
+      - name: Import CA certificate to Kafka truststore
+        command: >
+          keytool -keystore /opt/kafka/config/kafka-server.truststore.jks -alias CARoot
+          -import -file /tmp/ca-cert.pem -storepass "{{ kafka_truststore_password }}" -noprompt
+        args:
+          creates: /opt/kafka/config/kafka-server.truststore.jks
+      - name: Import Kafka certificate and key to Kafka keystore
+        command: >
+          keytool -importkeystore -srckeystore /opt/kafka/config/kafka-cert.pem
+          -destkeystore /opt/kafka/config/kafka-server.keystore.jks
+          -srcalias kafka-server -destalias kafka-server -srcstorepass "{{ kafka_keystore_password }}"
+        args:
+          creates: /opt/kafka/config/kafka-server.keystore.jks
+  # Client Certificate and Truststore Setup
+  - name: Configure Client for TLS
+    when: "'client' in group_names and use_tls_and_ssl"
+    block:
+      - name: Create SSL directory for Client
+        file:
+          path: /opt/client/ssl
+          state: directory
+          mode: '0755'
+      - name: Import Gateway CA certificate to Client truststore
+        command: >
+          keytool -keystore /opt/client/ssl/client-truststore.jks -alias CARoot
+          -import -file /tmp/ca-cert.pem -storepass "{{ client_truststore_password }}" -noprompt
+        args:
+          creates: /opt/client/ssl/client-truststore.jks
+
 - name: Setup Kafka
   hosts: kafka
   connection: ssh
   become: true
   tags: [kafka]
+  vars_files:
+    - ./ansible-vars.yml
   tasks:
     - set_fact:
         brokerId: "{{ groups['kafka'].index(inventory_hostname) }}"
     - name: Set up broker
       template:
         src: "templates/server.properties"
         dest: "/opt/kafka/config/server.properties"
+      when: not use_tls_and_ssl
+    - name: Configure Kafka SSL with SASL
+      template:
+        src: templates/server_ssl.properties.j2
+        dest: /opt/kafka/config/server_ssl.properties
+      vars:
+        template_kafka_truststore_path: /opt/kafka/config/kafka-server.truststore.jks
+        template_kafka_truststore_password: "{{ kafka_truststore_password }}"
+        template_kafka_keystore_path: /opt/kafka/config/kafka-server.keystore.jks
+        template_kafka_keystore_password: "{{ kafka_keystore_password }}"
+        template_kafka_key_password: "{{ kafka_key_password }}"
+      when: use_tls_and_ssl
     - template:
         src: "templates/kafka.service"
         dest: "/etc/systemd/system/kafka.service"
@@ -200,6 +316,7 @@
   tags: [gateway]
   vars_files:
     - ./tf_ansible_vars_file.yml
+    - ./ansible-vars.yml
   tasks:
     - name: Check mandatory variables imported from Terraform
       assert:
@@ -246,15 +363,24 @@
         registry_url: "{{ lookup('ansible.builtin.env', 'REGISTRY_URL', default='harbor.cdkt.dev') }}"
         username:  "{{ lookup('ansible.builtin.env', 'REGISTRY_USERNAME') }}"
         password: "{{ lookup('ansible.builtin.env', 'REGISTRY_PASSWORD') }}"
-    - name: "Gateway container"
-      community.docker.docker_container:
-        name: gateway
-        state: started
-        image: "{{ lookup('ansible.builtin.env', 'GATEWAY_IMAGE', default='conduktor/conduktor-gateway:3.0.4') }}"
-        restart_policy: on-failure
-        volumes:
+
+    - name: Set base volume mounts for Gateway
+      when: not use_tls_and_ssl
+      set_fact:
+        gateway_volumes:
+          - "/opt/gateway-interceptors.json:/opt/interceptors.json"
+
+    - name: Set base volume mounts for Gateway with TLS
+      when: use_tls_and_ssl
+      set_fact:
+        gateway_volumes:
           - "/opt/gateway-interceptors.json:/opt/interceptors.json"
-        env:
+          - "/opt/conduktor-gateway/ssl/gateway_keystore.jks:/etc/conduktor-gateway/keystore.jks"
+          - "/opt/conduktor-gateway/ssl/gateway_truststore.jks:/etc/conduktor-gateway/truststore.jks"
+
+    - name: Set base environment variables for Gateway
+      set_fact:
+        gateway_env:
           LOG4J2_IO_CONDUKTOR_PROXY_SERVICE_LEVEL: "DEBUG"
           LOG4J2_IO_CONDUKTOR_PROXY_NETWORK_LEVEL: "DEBUG"
           LOG4J2_IO_NETTY_LEVEL: "INFO"
@@ -267,6 +393,20 @@
           ENCRYPT_SECRET_KEY: "{{ lookup('ansible.builtin.env', 'ENCRYPT_SECRET_KEY') }}"
           GATEWAY_INTERCEPTOR_CONFIG_LOCATION: "/opt/interceptors.json"
           GATEWAY_ADMIN_API_USERS: "[{username: admin, password: conduktor, admin: true}]"
+
+    - name: Add TLS environment variables to Gateway if enabled
+      set_fact:
+        gateway_env: "{{ gateway_env | combine(lookup('template', 'gateway_env.j2') | from_yaml) }}"
+      when: use_tls_and_ssl
+
+    - name: "Gateway container"
+      community.docker.docker_container:
+        name: gateway
+        state: started
+        image: "{{ lookup('ansible.builtin.env', 'GATEWAY_IMAGE', default='conduktor/conduktor-gateway:latest') }}"
+        restart_policy: on-failure
+        volumes: "{{ gateway_volumes }}"
+        env: "{{ gateway_env }}"
         published_ports:
           - "8888:8888"
           - "6969:6969"
@@ -306,6 +446,8 @@
   hosts: client
   connection: ssh
   become: true
+  vars_files:
+    - ./ansible-vars.yml
   tasks:
     - file: path=/opt/benchmark state=absent
       tags: [client-code]
@@ -331,6 +473,20 @@
       with_items: '{{ drivers_list.stdout_lines }}'
       tags: [client-code]
 
+    - name: Configure SSL/SASL settings in client driver configuration
+      blockinfile:
+        path: "{{ item }}"
+        marker: "# {mark} SSL and SASL Configurations"
+        content: |
+          security.protocol=SASL_SSL
+          ssl.truststore.location=/opt/client/ssl/client-truststore.jks
+          ssl.truststore.password={{ client_truststore_password }}
+          sasl.mechanism=PLAIN
+          sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin";
+      with_items: "{{ drivers_list.stdout_lines }}"
+      when: use_tls_and_ssl
+      tags: [client-code]
+
     - name: Get list of gateway driver config files
       raw: ls -1 /opt/benchmark/driver-gateway/gateway-*.yaml
       register: gateway_drivers_list
@@ -342,7 +498,7 @@
         regexp: '^  bootstrap.servers='
         line: '  bootstrap.servers={{ gatewayServers }}'
       with_items: '{{ gateway_drivers_list.stdout_lines }}'
-      tags: [ client-code ]
+      tags: [client-code]
 
     - name: Get list of jms driver config files
       raw: ls -1 /opt/benchmark/driver-jms/kafka*.yaml
@@ -389,7 +545,7 @@
         name: "benchmark-worker"
       tags: [client-code]
 
-- name:  Hosts addresses
+- name: Hosts addresses
   hosts: localhost
   become: false
   tasks:

driver-gateway/deploy/ssd-deployment/provision-kafka-aws.tf

@@ -130,6 +130,7 @@ resource "aws_security_group" "benchmark_security_group" {
     cidr_blocks = ["0.0.0.0/0"]
   }
 
+  # ICMP access from anywhere
   ingress {
     from_port = -1
     to_port = -1

driver-gateway/deploy/ssd-deployment/templates/gateway_env.j2

@@ -0,0 +1,8 @@
+GATEWAY_SECURITY_PROTOCOL: DELEGATED_SASL_SSL
+KAFKA_SASL_MECHANISM: "SCRAM-SHA-256"
+KAFKA_SECURITY_PROTOCOL: SSL
+KAFKA_SSL_TRUSTSTORE_LOCATION: "/etc/conduktor-gateway/truststore.jks"
+KAFKA_SSL_TRUSTSTORE_PASSWORD: "{{ gateway_truststore_password }}"
+KAFKA_SSL_KEYSTORE_LOCATION: "/etc/conduktor-gateway/keystore.jks"
+KAFKA_SSL_KEYSTORE_PASSWORD: "{{ gateway_keystore_password }}"
+KAFKA_SSL_KEY_PASSWORD: "{{ gateway_key_password }}"

driver-gateway/deploy/ssd-deployment/templates/server_ssl.properties.j2

@@ -0,0 +1,43 @@
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# SSL Settings
+ssl.keystore.location={{ template_kafka_keystore_path }}
+ssl.keystore.password={{ template_kafka_keystore_password }}
+ssl.key.password={{ template_kafka_key_password }}
+ssl.truststore.location={{ template_kafka_truststore_path }}
+ssl.truststore.password={{ template_kafka_truststore_password }}
+
+# SASL Authentication
+security.protocol=SASL_SSL
+sasl.enabled.mechanisms=PLAIN
+sasl.mechanism.inter.broker.protocol=PLAIN
+advertised.listeners=SASL_SSL://{{ privateIp }}:9094
+security.inter.broker.protocol=ASL_SSL
+sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin";
+
+# Kafka Broker Config
+broker.id={{ brokerId }}
+
+log.dirs=/mnt/data-1,/mnt/data-2
+
+zookeeper.connect={{ zookeeperServers }}
+
+num.replica.fetchers=8
+
+message.max.bytes=10485760
+
+replica.fetch.max.bytes=10485760
+
+num.network.threads=8

driver-gateway/deploy/ssd-deployment/terraform.tfvars

@@ -3,8 +3,8 @@ region          = "us-west-2"
 az              = "us-west-2a"
 profile         = "cdk-dev"
 ami             = "ami-04a616933df665b44" // RHEL-9.0.0_HVM-20220513-x86_64-0-Hourly2-GP2	
-#ami             = "ami-08970fb2e5767e3b8" // RHEL-8.6.0_HVM-20220503-x86_64-2-Hourly2-GP2
-#ami             = "ami-0b0b4a49742d64899" // RHEL-8.6.0_HVM-20240521-x86_64-58-Hourly2-GP3
+#ami            = "ami-08970fb2e5767e3b8" // RHEL-8.6.0_HVM-20220503-x86_64-2-Hourly2-GP2
+#ami            = "ami-0b0b4a49742d64899" // RHEL-8.6.0_HVM-20240521-x86_64-58-Hourly2-GP3
 
 instance_types = {
   "gateway"   = "m5n.xlarge" # 16.0 GiB	4 vCPUs	EBS only Up to 25 Gigabit

pom.xml

@@ -474,4 +474,4 @@
             </build>
         </profile>
     </profiles>
-</project>
+</project>