SASL-Authorisierung von PLAIN auf SCRAM-SHA-512 umgestellt

[demos/kafka/training] / README.sh

diff --git a/README.sh b/README.sh
index 95aae0b..84a39a8 100755 (executable)
--- a/README.sh
+++ b/README.sh
@@ -1,33 +1,113 @@
 #!/bin/bash
 
+IMAGE_CRUISECONTROL=juplo/cruise-control
+IMAGE_KAFKA=juplo/kafka
+
 if [ "$1" = "cleanup" ]
 then
-  docker-compose down -v
-  mvn clean
+  docker-compose -f docker/docker-compose.yml down -t0 -v --remove-orphans
+  (cd cruise-control; ./gradlew clean)
   exit
 fi
 
-mvn package || exit 1
-if [ "$1" = "build" ]; then exit; fi
+if [[
+  $(docker image ls -q $IMAGE_CRUISECONTROL) == "" ||
+  "$1" = "build"
+]]
+then
+  DOCKER_BUILDKIT=0 docker build -t juplo/cruise-control cruise-control || exit 1
+else
+  echo "Using image existing images:"
+  docker image ls $IMAGE_CRUISECONTROL
+fi
+
+if [[
+  $(docker image ls -q $IMAGE_KAFKA) == "" ||
+  "$1" = "build"
+]]
+then
+  DOCKER_BUILDKIT=0 docker build -t juplo/kafka kafka || exit 1
+else
+  echo "Using image existing images:"
+  docker image ls $IMAGE_KAFKA
+fi
+
+docker-compose -f docker/docker-compose.yml up --remove-orphans setup || exit 1
+
+kafkacat -L -b :9092
+kafkacat -L -b :9092 -Xsecurity.protocol=sasl_plaintext -Xsasl.mechanisms=SCRAM-SHA-512 -Xsasl.username=client -Xsasl.password=client-secret
+
+docker-compose -f docker/docker-compose.yml exec cli kafka-configs \
+  --zookeeper zookeeper:2181 \
+  --alter \
+  --add-config 'SCRAM-SHA-512=[password=schemaregistry-secret]' \
+  --entity-type users \
+  --entity-name schemaregistry
+docker-compose -f docker/docker-compose.yml exec cli kafka-configs \
+  --zookeeper zookeeper:2181 \
+  --alter \
+  --add-config 'SCRAM-SHA-512=[password=connect-secret]' \
+  --entity-type users \
+  --entity-name connect
+docker-compose -f docker/docker-compose.yml exec cli kafka-configs \
+  --zookeeper zookeeper:2181 \
+  --alter \
+  --add-config 'SCRAM-SHA-512=[password=ui-secret]' \
+  --entity-type users \
+  --entity-name ui
+docker-compose -f docker/docker-compose.yml exec cli kafka-configs \
+  --zookeeper zookeeper:2181 \
+  --alter \
+  --add-config 'SCRAM-SHA-512=[password=client-secret]' \
+  --entity-type users \
+  --entity-name client
+
+kafkacat -L -b :9092 -Xsecurity.protocol=sasl_plaintext -Xsasl.mechanisms=SCRAM-SHA-512 -Xsasl.username=client -Xsasl.password=client-secret
 
-trap 'kill $(jobs -p) 2>/dev/null' EXIT
+# Nicht nötig, da `super.users=User:ANONYMOUS` gesetzt wurde
+# Ohne diesen Eintrag wären diverse ACLs nötig, bevor BROKER funktioniert!
+# docker-compose exec cli kafka-acls --authorizer-properties zookeeper.connect=zookeeper zookeeper:2181 --add --allow-principal User:ANONYMOUS --operation ALL --topic __CruiseControlMetrics --group=*
 
-docker-compose up -d
+# schema-registry
+docker-compose -f docker/docker-compose.yml exec cli kafka-acls \
+  --authorizer-properties zookeeper.connect=zookeeper \
+  --add \
+  --allow-principal User:schemaregistry \
+  --topic _schemas \
+  --consumer --group=schema-registry \
+  --producer
+docker-compose -f docker/docker-compose.yml exec cli kafka-acls \
+  --authorizer-properties zookeeper.connect=zookeeper \
+  --add \
+  --allow-principal User:schemaregistry \
+  --topic _schemas \
+  --operation=DescribeConfigs
 
-echo "Waiting for the Kafka-Cluster to become ready..."
-docker-compose exec kafka cub kafka-ready -b kafka:9092 1 60 > /dev/null 2>&1 || exit 1
+docker-compose -f docker/docker-compose.yml up -d schema-registry
+while [[ ! $(http :8085/subjects 2> /dev/null) ]]; do echo Waiting for schema-registry; sleep 1; done
+cat user-v1.schema|http POST http://localhost:8085/subjects/user/versions "Content-Type:application/vnd.schemaregistry.v1+json"
+http GET http://0:8085/subjects/user/versions/1/schema
 
-echo "Producing messages"
-mvn exec:java@producer
+# kafka-connect
+docker-compose -f docker/docker-compose.yml exec cli kafka-acls \
+  --authorizer-properties zookeeper.connect=zookeeper \
+  --add \
+  --allow-principal User:connect \
+  --topic __connect \
+  --resource-pattern-type prefixed \
+  --consumer --group=kafka-connect \
+  --producer
 
-echo "Reading messages"
-mvn exec:java@consumer &
-sleep 7
-kill $(jobs -p)
-sleep 2
+docker-compose -f docker/docker-compose.yml up -d connect
+while [[ ! $(http :8083/connectors 2> /dev/null) ]]; do echo Waiting for connect; sleep 1; done
 
-echo "Re-Reading messages"
-mvn exec:java@consumer &
-sleep 7
-kill $(jobs -p)
-sleep 2
+# BEACHTE: Der Wildcard * benötigt den Matching-Typ LITERAL
+# BEACHTE: Die * müssen vor der Bash geschützt werden
+docker-compose -f docker/docker-compose.yml exec cli kafka-acls \
+  --authorizer-properties zookeeper.connect=zookeeper \
+  --add \
+  --allow-principal User:ui \
+  --cluster '*' \
+  --topic '*' \
+  --group '*' \
+  --transactional-id '*'