kafka 安装部署与安全认证

本文介绍了如何在 Kafka 中实现身份验证和授权功能,具体使用了 JAAS(Java Authentication and Authorization Service)机制。在安装部署方面,需要先安装 JDK,并准备好一个 Zookeeper 环境。接着,按照下载、解压、编辑配置文件、配置 JAAS、创建服务、启动 Kafka 等步骤进行操作。最后,通过创建、查看、生产、消费、删除 topic 和查看消费群组等测试,验证了集群的正常运行。

kafka 安装部署与安全认证

Kafka JAAS(Java Authentication and Authorization Service)是一种用于 Apache Kafka 的身份验证和授权机制。JAAS 是 Java 平台的标准身份验证和授权框架,它提供了一种可插拔的方式来实现身份验证和授权功能。

Kafka JAAS 可以用于保护 Kafka 集群和客户端之间的通信安全。它允许管理员配置不同的身份验证机制,例如用户名/密码、Kerberos 或 SSL/TLS 证书等。通过 JAAS,Kafka 可以验证客户端的身份,并根据配置的授权策略来决定客户端是否有权访问特定的主题或执行特定的操作。

要使用 Kafka JAAS,您需要在 Kafka 服务器和客户端的配置文件中进行相应的配置。在服务器端,您可以配置 JAAS 模块来指定身份验证和授权的方式。在客户端,您需要提供与服务器端相匹配的 JAAS 配置,并在连接到 Kafka 集群时使用该配置。

总之,Kafka JAAS 提供了一种灵活且可扩展的方式来实现 Kafka 的身份验证和授权,以增强 Kafka 集群的安全性。

1. 安装 jdk

如果未安装 java 环境,请先执行以下命令安装 openjdk-1.8.0

1
yum -y install java-1.8.0-openjdk java-1.8.0-openjdk-devel

2. 设备环境

Kafka 集群环境搭建,需要准备好一个 zookeeper 环境(集群)

Host IP Port OS Software
saas_kafka_01.com 10.128.170.21 9092 CentOS 7.9.2009 kafka 2.13-2.8.1
saas_kafka_02.com 10.128.170.22 9092 CentOS 7.9.2009 kafka 2.13-2.8.1
saas_kafka_03.com 10.128.170.23 9092 CentOS 7.9.2009 kafka 2.13-2.8.1

说明:kafka 名中的 2.13 是 Scala 语言版本,后面的 2.8.1 是 kafka 版本,端口默认为 9092。

3. 安装步骤

3.1 下载 kafka

官网下载太慢,推荐使用国内镜像进行下载,清华镜像下载地址:

https://mirrors.tuna.tsinghua.edu.cn/apache/kafka

1
wget -c https://mirrors.tuna.tsinghua.edu.cn/apache/kafka/2.8.1/kafka_2.13-2.8.1.tgz

3.2 解压安装

这里解压至 /virus 目录:

1
tar -zxvf kafka_2.13-2.8.1.tgz -C /virus

3.3 编辑配置文件

进入 config 目录:

1
cd /virus/kafka_2.13-2.8.1/config/

备份原配置文件:

1
cp server.properties server.properties.bak

编辑配置文件:

1
vim server.properties

修改配置如下:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# see kafka.server.KafkaConfig for additional details and defaults

############################# Server Basics #############################

# The id of the broker. This must be set to a unique integer for each broker.
broker.id=1

############################# Socket Server Settings #############################

# The address the socket server listens on. It will get the value returned from
# java.net.InetAddress.getCanonicalHostName() if not configured.
# FORMAT:
# listeners = listener_name://host_name:port
# EXAMPLE:
# listeners = PLAINTEXT://your.host.name:9092
#listeners=PLAINTEXT://:9092
listeners=SASL_PLAINTEXT://saas_kafka_01.com:9092
security.inter.broker.protocol=SASL_PLAINTEXT
sasl.enabled.mechanisms=PLAIN
sasl.mechanism.inter.broker.protocol=PLAIN
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer
super.users=User:admin

# Hostname and port the broker will advertise to producers and consumers. If not set,
# it uses the value for "listeners" if configured. Otherwise, it will use the value
# returned from java.net.InetAddress.getCanonicalHostName().
#advertised.listeners=PLAINTEXT://your.host.name:9092

# Maps listener names to security protocols, the default is for them to be the same. See the config documentation for more details
#listener.security.protocol.map=PLAINTEXT:PLAINTEXT,SSL:SSL,SASL_PLAINTEXT:SASL_PLAINTEXT,SASL_SSL:SASL_SSL

# The number of threads that the server uses for receiving requests from the network and sending responses to the network
num.network.threads=3

# The number of threads that the server uses for processing requests, which may include disk I/O
num.io.threads=8

# The send buffer (SO_SNDBUF) used by the socket server
socket.send.buffer.bytes=102400000

# The receive buffer (SO_RCVBUF) used by the socket server
socket.receive.buffer.bytes=102400000

# The maximum size of a request that the socket server will accept (protection against OOM)
socket.request.max.bytes=104857600

message.max.bytes=200000000
message.fetch.max.bytes=200000000
fetch.message.max.bytes=200000000

############################# Log Basics #############################

# A comma separated list of directories under which to store log files
log.dirs=/saasdata/kafka/data

# The default number of log partitions per topic. More partitions allow greater
# parallelism for consumption, but this will also result in more files across
# the brokers.
num.partitions=1

# The number of threads per data directory to be used for log recovery at startup and flushing at shutdown.
# This value is recommended to be increased for installations with data dirs located in RAID array.
num.recovery.threads.per.data.dir=1

############################# Internal Topic Settings #############################
# The replication factor for the group metadata internal topics "__consumer_offsets" and "__transaction_state"
# For anything other than development testing, a value greater than 1 is recommended to ensure availability such as 3.
offsets.topic.replication.factor=1
transaction.state.log.replication.factor=1
transaction.state.log.min.isr=1

############################# Log Flush Policy #############################

# Messages are immediately written to the filesystem but by default we only fsync() to sync
# the OS cache lazily. The following configurations control the flush of data to disk.
# There are a few important trade-offs here:
# 1. Durability: Unflushed data may be lost if you are not using replication.
# 2. Latency: Very large flush intervals may lead to latency spikes when the flush does occur as there will be a lot of data to flush.
# 3. Throughput: The flush is generally the most expensive operation, and a small flush interval may lead to excessive seeks.
# The settings below allow one to configure the flush policy to flush data after a period of time or
# every N messages (or both). This can be done globally and overridden on a per-topic basis.

# The number of messages to accept before forcing a flush of data to disk
#log.flush.interval.messages=10000

# The maximum amount of time a message can sit in a log before we force a flush
#log.flush.interval.ms=1000

############################# Log Retention Policy #############################

# The following configurations control the disposal of log segments. The policy can
# be set to delete segments after a period of time, or after a given size has accumulated.
# A segment will be deleted whenever *either* of these criteria are met. Deletion always happens
# from the end of the log.

# The minimum age of a log file to be eligible for deletion due to age
log.retention.hours=168

# A size-based retention policy for logs. Segments are pruned from the log unless the remaining
# segments drop below log.retention.bytes. Functions independently of log.retention.hours.
#log.retention.bytes=1073741824

# The maximum size of a log segment file. When this size is reached a new log segment will be created.
log.segment.bytes=1073741824

# The interval at which log segments are checked to see if they can be deleted according
# to the retention policies
log.retention.check.interval.ms=300000

############################# Zookeeper #############################

# Zookeeper connection string (see zookeeper docs for details).
# This is a comma separated host:port pairs, each corresponding to a zk
# server. e.g. "127.0.0.1:3000,127.0.0.1:3001,127.0.0.1:3002".
# You can also append an optional chroot string to the urls to specify the
# root directory for all kafka znodes.
zookeeper.connect=saas_kafka_01.com:2181,saas_kafka_02.com:2181,saas_kafka_03.com:2181

# Timeout in ms for connecting to zookeeper
zookeeper.connection.timeout.ms=18000


############################# Group Coordinator Settings #############################

# The following configuration specifies the time, in milliseconds, that the GroupCoordinator will delay the initial consumer rebalance.
# The rebalance will be further delayed by the value of group.initial.rebalance.delay.ms as new members join the group, up to a maximum of max.poll.interval.ms.
# The default value for this is 3 seconds.
# We override this to 0 here as it makes for a better out-of-the-box experience for development and testing.
# However, in production environments the default value of 3 seconds is more suitable as this will help to avoid unnecessary, and potentially expensive, rebalances during application startup.
group.initial.rebalance.delay.ms=0

replica.fetch.max.bytes=11240000

在 saas_kafka_02.com 和 saas_kafka_03.com 上进行同样的操作,不再赘述。

需要注意的是,broker.idlisteners 需要根据实际情况配置。

  • saas_kafka_01.com
    • broker.id=1
    • listeners=SASL_PLAINTEXT://saas_kafka_01.com:9092
  • saas_kafka_02.com
    • broker.id=2
    • listeners=SASL_PLAINTEXT://saas_kafka_02.com:9092
  • saas_kafka_03.com
    • broker.id=3
    • listeners=SASL_PLAINTEXT://saas_kafka_03.com:9092

3.4 配置 jaas

在 config 目录创建 kafka_jaas.conf 文件:

1
vim /virus/kafka_2.13-2.8.1/config/kafka_jaas.conf

添加如下内容:

1
2
3
4
5
6
7
8
9
10
11
12
KafkaServer {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="saas_kafka_root123"
user_admin="saas_kafka_root123";
};

KafkaClient {
org.apache.kafka.common.security.plain.PlainLoginModule required
username="admin"
password="saas_kafka_root123";
};

3.5 创建 system 服务

1
vim /usr/lib/systemd/system/kafka.service

添加如下内容:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
[Unit]
Description=kafka service
After=network.target

[Service]
Type=forking
User=root
Group=root
Environment="JMX_PORT=9999"
Environment="KAFKA_OPTS=-Djava.security.auth.login.config=/virus/kafka_2.13-2.8.1/config/kafka_jaas.conf"
ExecStart=/virus/kafka_2.13-2.8.1/bin/kafka-server-start.sh -daemon /virus/kafka_2.13-2.8.1/config/server.properties
ExecStop= /virus/kafka_2.13-2.8.1/bin/kafka-server-stop.sh
Restart=always
RestartSec=1
StartLimitIntervalSec=0

[Install]
WantedBy=multi-user.target

3.6 启动 kafka

启动节点 saas_kafka_01.com,同样地启动节点 saas_kafka_02.com,saas_kafka_03.com

1
systemctl start kafka.service

查看 9092 端口状态,确保服务已经启动:

1
netstat -anptl | grep 9092

3.7 查看集群状态

登录 zookeeper(切换到 zookeeper 的 bin 目录下):

1
2
3
4
5
6
7
8
9
[root@saas_kafka_01.com bin]# cd /virus/apache-zookeeper-3.6.3-bin/bin/
[root@saas_kafka_01.com bin]# ./zkCli.sh -server saas_kafka_02.com
...
[zk: saas_kafka_02.com(CONNECTED) 0] ls /
[admin, brokers, cluster, config, consumers, controller, controller_epoch, feature, isr_change_notification, latest_producer_id_block, log_dir_event_notification, zookeeper]
[zk: saas_kafka_02.com(CONNECTED) 1] ls /brokers
[ids, seqid, topics]
[zk: saas_kafka_02.com(CONNECTED) 2] ls /brokers/ids
[1, 2, 3]

4. 集群测试

4.1 创建 topic

1
/virus/kafka_2.13-2.8.1/bin/kafka-topics.sh --create --zookeeper saas_kafka_01.com:2181 --replication-factor 3 --partitions 3 --topic google

4.2 查看 topic

1
/virus/kafka_2.13-2.8.1/bin/kafka-topics.sh --describe google --zookeeper saas_kafka_01.com:2181

4.3 生产消息

在 /virus/kafka_2.13-2.8.1/config/producer.properties 添加如下配置:

1
2
security.protocol=SASL_PLAINTEXT
sasl.mechanism=PLAIN

生产消息:

1
2
3
4
5
6
[root@localhost ~]# export KAFKA_OPTS='-Djava.security.auth.login.config=/virus/kafka_2.13-2.8.1/config/kafka_jaas.conf'
[root@localhost ~]# /virus/kafka_2.13-2.8.1/bin/kafka-console-producer.sh --broker-list saas_kafka_01.com:9092 --topic google --producer.config /virus/kafka_2.13-2.8.1/config/producer.properties
>Apple
>Banana
>Cat
>Dog

4.4 消费消息

在 /virus/kafka_2.13-2.8.1/config/consumer.properties 添加如下配置:

1
2
security.protocol=SASL_PLAINTEXT
sasl.mechanism=PLAIN

消费消息:

1
2
3
4
5
6
[root@localhost ~]# export KAFKA_OPTS='-Djava.security.auth.login.config=/virus/kafka_2.13-2.8.1/config/kafka_jaas.conf'
[root@localhost ~]# /virus/kafka_2.13-2.8.1/bin/kafka-console-consumer.sh --bootstrap-server saas_kafka_02.com:9092 --topic google --from-beginning --consumer.config /virus/kafka_2.13-2.8.1/config/consumer.properties
Banana
Apple
Dog
Cat

4.5 删除 topic

1
2
3
[root@localhost ~]# /virus/kafka_2.13-2.8.1/bin/kafka-topics.sh --list --zookeeper saas_kafka_01.com:2181
__consumer_offsets
google
1
[root@localhost ~]# /virus/kafka_2.13-2.8.1/bin/kafka-topics.sh --delete --zookeeper saas_kafka_01.com:2181 --topic google

4.6 查看消费群组

1
2
3
4
5
6
[root@localhost ~]# export KAFKA_OPTS='-Djava.security.auth.login.config=/virus/kafka_2.13-2.8.1/config/kafka_jaas.conf'
[root@localhost ~]# /virus/kafka_2.13-2.8.1/bin/kafka-consumer-groups.sh --bootstrap-server saas_kafka_01.com:9092 --list --command-config /virus/kafka_2.13-2.8.1/config/consumer.properties
[2022-03-04 01:32:26,611] WARN The configuration 'group.id' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig)
saasdc_asset_neo4j_group
efak.system.group
saasdc_asset_mongo_group

查看消费组详情:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
[root@localhost ~]# /virus/kafka_2.13-2.8.1/bin/kafka-consumer-groups.sh --bootstrap-server saas_kafka_01.com:9092 --command-config /virus/kafka_2.13-2.8.1/config/consumer.properties --describe --group saasdc_asset_neo4j_group
[2022-03-04 01:45:41,039] WARN The configuration 'group.id' was supplied but isn't a known config. (org.apache.kafka.clients.admin.AdminClientConfig)

GROUP TOPIC PARTITION CURRENT-OFFSET LOG-END-OFFSET LAG CONSUMER-ID HOST CLIENT-ID
saasdc_asset_neo4j_group saasdc_asset_topic 1 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 8 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 19 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 7 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 14 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 17 1 1 0 rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 5 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 12 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 0 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 2 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 4 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 15 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 16 1 1 0 rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 11 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 9 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 18 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 13 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 6 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 3 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka
saasdc_asset_neo4j_group saasdc_asset_topic 10 - 0 - rdkafka-daeaa1cb-e784-42e2-85de-c4a8bece0fd2 /10.128.170.28 rdkafka

References

kafka安装配置SASL_PLAINTEXT

kafka集群中jmx端口设置