Skip to content

Commit 152f652

Browse files
rrbadianirrbadiani
authored
Merge pull request #1848 from confluentinc/update-sample-inventory-files-78
Update sample inventory files 7.8 to have centralized MDS as well
2 parents 8b990a4 + 7773a37 commit 152f652

File tree

9 files changed

+136
-54
lines changed

9 files changed

+136
-54
lines changed

‎CHANGELOG.rst

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,18 @@ Ansible Playbooks for Confluent Platform - Release Notes
44

55
.. contents:: Topics
66

7+
v7.8.0
8+
======
9+
10+
New features
11+
-------------
12+
- Role-based access control (RBAC) with principal from mTLS certs is now supported
13+
- SASL/SCRAM authentication support for kraft controllers and broker communication
14+
15+
Notable enhancements
16+
-------------
17+
- Ubuntu 22, Alma Linux 8, and Alma Linux 9 Operating systems are now supported
18+
719
v7.7.0
820
======
921

‎docs/MOLECULE_SCENARIOS.md

Lines changed: 18 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -398,13 +398,11 @@ Validates that Control Center Can connect to each KSQL cluster
398398

399399
Installs Confluent Platform Cluster on ubi9.
400400

401-
RBAC enabled.
402-
403-
MTLS enabled.
401+
RBAC over mTLS enabled.
404402

405-
Kafka Broker Customer Listener.
403+
Centralized MDS.
406404

407-
SSO authentication using OIDC in Control center using Okta IdP
405+
File based login to C3 using overrides.
408406

409407
#### Scenario mini-setup-ext-mds-mtls verify test's the following:
410408

@@ -420,13 +418,11 @@ Validates ssl.client.authentication is set to REQUIRED.
420418

421419
Installs Confluent Platform Cluster on ubi9.
422420

423-
RBAC enabled.
421+
RBAC over mTLS+LDAP enabled.
424422

425-
MTLS enabled.
423+
MDS accepts LDAP credentials and mTLS certs.
426424

427-
Kafka Broker Customer Listener.
428-
429-
SSO authentication using OIDC in Control center using Okta IdP
425+
LDAP based login to C3.
430426

431427
#### Scenario mini-setup-ldap-mtls verify test's the following:
432428

@@ -442,13 +438,9 @@ Validates ssl.client.authentication is set to REQUIRED.
442438

443439
Installs Confluent Platform Cluster on ubi9.
444440

445-
RBAC enabled.
446-
447-
MTLS enabled.
448-
449-
Kafka Broker Customer Listener.
441+
RBAC over mTLS enabled.
450442

451-
SSO authentication using OIDC in Control center using Okta IdP
443+
File based login to C3 using overrides.
452444

453445
#### Scenario mini-setup-mtls verify test's the following:
454446

@@ -464,13 +456,9 @@ Validates ssl.client.authentication is set to REQUIRED.
464456

465457
Installs Confluent Platform Cluster on ubi9.
466458

467-
RBAC enabled.
468-
469-
MTLS enabled.
470-
471-
Kafka Broker Customer Listener.
459+
RBAC over mTLS+OAuth enabled.
472460

473-
SSO authentication using OIDC in Control center using Okta IdP
461+
SSO authentication using OIDC in Control center using Okta IdP.
474462

475463
#### Scenario mini-setup-oauth-mtls verify test's the following:
476464

@@ -486,13 +474,13 @@ Validates ssl.client.authentication is set to REQUIRED.
486474

487475
Installs Confluent Platform Cluster on ubi9.
488476

489-
RBAC enabled.
477+
RBAC over mTLS+LDAP enabled.
490478

491-
MTLS enabled.
479+
Outside CP to CP communication over LDAP.
492480

493-
Kafka Broker Customer Listener.
481+
Internal CP communication over mTLS.
494482

495-
SSO authentication using OIDC in Control center using Okta IdP
483+
LDAP based login to C3.
496484

497485
#### Scenario mini-setup-out-ldap-in-mtls verify test's the following:
498486

@@ -508,13 +496,13 @@ Validates ssl.client.authentication is set to REQUIRED.
508496

509497
Installs Confluent Platform Cluster on ubi9.
510498

511-
RBAC enabled.
499+
RBAC over mTLS+OAuth enabled.
512500

513-
MTLS enabled.
501+
Outside CP to CP communication over OAuth.
514502

515-
Kafka Broker Customer Listener.
503+
Internal CP communication over mTLS.
516504

517-
SSO authentication using OIDC in Control center using Okta IdP
505+
SSO authentication using OIDC in Control center using Okta IdP.
518506

519507
#### Scenario mini-setup-out-oauth-in-mtls verify test's the following:
520508

‎docs/sample_inventories/rbac-over-mtls-centralized-mds

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
---
2+
##
3+
## The following is an example inventory file of the configuration required for setting up Confluent Platform with RBAC over mTLS.
4+
## Sets RBAC on a cluster which talks to already running Centralized MDS server
5+
## Principals extracted from certs are given role bindings.
6+
7+
all:
8+
vars:
9+
ansible_connection: ssh
10+
ansible_user: ec2-user
11+
ansible_become: true
12+
ansible_ssh_private_key_file: /home/ec2-user/guest.pem
13+
ansible_python_interpreter: /usr/bin/python3
14+
15+
## TLS Configuration
16+
ssl_enabled: true
17+
# 3 ways to handle ssl
18+
# Self Signed Certs (Default) Not recommended for production clusters
19+
# Custom Certs
20+
# Set ssl_custom_certs, ssl_ca_cert_filepath, ssl_signed_cert_filepath, ssl_key_filepath, ssl_key_password & ssl_custom_certs_remote_src(optional)
21+
# Provided Keystore Truststore
22+
# Set ssl_provided_keystore_and_truststore, ssl_keystore_and_truststore_custom_password, ssl_keystore_filepath, ssl_keystore_key_password, ssl_keystore_store_password, ssl_keystore_alias, ssl_truststore_filepath, ssl_truststore_password, ssl_truststore_ca_cert_alias and ssl_provided_keystore_and_truststore_remote_src (optional)
23+
24+
rbac_enabled: true
25+
auth_mode: mtls # MDS server will use mTLS certs for authentication, no user store like ldap/oauth will be setup on server
26+
27+
# Centralized MDS server configuration
28+
external_mds_enabled: true # This is for cluster to talk to remote MDS server
29+
mds_broker_bootstrap_servers: mds-kafka-broker1:9093,mds-kafka-broker2:9093,mds-kafka-broker3:9093
30+
mds_bootstrap_server_urls: https://mds-kafka-broker1:8090,https://mds-kafka-broker2:8090
31+
mds_broker_listener:
32+
ssl_enabled: true
33+
ssl_mutual_auth_enabled: true
34+
sasl_protocol: none
35+
36+
# This should be a superuser cert. In cases of LDAP/OAuth based setup we only needed user names or client id of super user inside this cluster to give role bindings to all components like SR/RP/Connect. Here we need a certificate whose principal is super user in MDS.
37+
mds_super_user_external_cert_path: <cert path>
38+
mds_super_user_external_key_path: <key path>
39+
40+
create_mds_certs: false
41+
token_services_public_pem_file: /home/ec2-user/keys/public.pem
42+
token_services_private_pem_file: /home/ec2-user/keys/tokenKeypair.pem
43+
44+
# ssl_mutual_auth_enabled: true Deprecated in 7.8.x
45+
ssl_client_authentication: required # <required/requested/none>
46+
# Sets mTLS on kafka broker listeners
47+
48+
mds_ssl_client_authentication: requested # <required/requested/none>
49+
# This decides clients behaviour when talking to Centralized MDS server.
50+
# Must be defined in all section as all components need to know its value for assigning role bindings
51+
# Default value is none
52+
53+
# When set to required clients must send certs to server
54+
# When set to requested sending certs is optional given there is another mechanism like ldap/oauth which is sending principal
55+
# requested mode is used for upgrade scenarios where all clients might not be sending certs to server
56+
# Once all clients start sending certs to server this requested should be changed to required
57+
58+
principal_mapping_rules:
59+
- "RULE:.*CN=([a-zA-Z0-9.-_]*).*$/$1/"
60+
- "DEFAULT"
61+
62+
kafka_controller:
63+
hosts:
64+
ec2-34-219-110-48.us-west-2.compute.amazonaws.com:
65+
ec2-18-237-72-224.us-west-2.compute.amazonaws.com:
66+
ec2-35-161-39-212.us-west-2.compute.amazonaws.com:
67+
68+
kafka_broker:
69+
hosts:
70+
ec2-34-211-33-32.us-west-2.compute.amazonaws.com:
71+
ec2-35-89-77-112.us-west-2.compute.amazonaws.com:
72+
ec2-35-163-80-4.us-west-2.compute.amazonaws.com:
73+
74+
schema_registry:
75+
hosts:
76+
ec2-34-212-49-238.us-west-2.compute.amazonaws.com:
77+
78+
kafka_connect:
79+
hosts:
80+
ec2-35-93-21-143.us-west-2.compute.amazonaws.com:
81+
82+
kafka_rest:
83+
hosts:
84+
ec2-34-222-41-249.us-west-2.compute.amazonaws.com:
85+
86+
control_center:
87+
hosts:
88+
ec2-35-87-151-33.us-west-2.compute.amazonaws.com:

‎molecule/mini-setup-ext-mds-mtls/molecule.yml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
---
22
### Installs Confluent Platform Cluster on ubi9.
3-
### RBAC enabled.
4-
### MTLS enabled.
5-
### Kafka Broker Customer Listener.
6-
### SSO authentication using OIDC in Control center using Okta IdP
3+
### RBAC over mTLS enabled.
4+
### Centralized MDS.
5+
### File based login to C3 using overrides.
76

87
driver:
98
name: docker

‎molecule/mini-setup-ldap-mtls/molecule.yml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
11
---
22
### Installs Confluent Platform Cluster on ubi9.
3-
### RBAC enabled.
4-
### MTLS enabled.
5-
### Kafka Broker Customer Listener.
6-
### SSO authentication using OIDC in Control center using Okta IdP
3+
### RBAC over mTLS+LDAP enabled.
4+
### MDS accepts LDAP credentials and mTLS certs.
5+
### LDAP based login to C3.
76

87
driver:
98
name: docker

‎molecule/mini-setup-mtls/molecule.yml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
---
22
### Installs Confluent Platform Cluster on ubi9.
3-
### RBAC enabled.
4-
### MTLS enabled.
5-
### Kafka Broker Customer Listener.
6-
### SSO authentication using OIDC in Control center using Okta IdP
3+
### RBAC over mTLS enabled.
4+
### File based login to C3 using overrides.
75

86
driver:
97
name: docker

‎molecule/mini-setup-oauth-mtls/molecule.yml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
---
22
### Installs Confluent Platform Cluster on ubi9.
3-
### RBAC enabled.
4-
### MTLS enabled.
5-
### Kafka Broker Customer Listener.
6-
### SSO authentication using OIDC in Control center using Okta IdP
3+
### RBAC over mTLS+OAuth enabled.
4+
### SSO authentication using OIDC in Control center using Okta IdP.
75

86
driver:
97
name: docker

‎molecule/mini-setup-out-ldap-in-mtls/molecule.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
### Installs Confluent Platform Cluster on ubi9.
3-
### RBAC enabled.
4-
### MTLS enabled.
5-
### Kafka Broker Customer Listener.
6-
### SSO authentication using OIDC in Control center using Okta IdP
3+
### RBAC over mTLS+LDAP enabled.
4+
### Outside CP to CP communication over LDAP.
5+
### Internal CP communication over mTLS.
6+
### LDAP based login to C3.
77

88
driver:
99
name: docker

‎molecule/mini-setup-out-oauth-in-mtls/molecule.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
### Installs Confluent Platform Cluster on ubi9.
3-
### RBAC enabled.
4-
### MTLS enabled.
5-
### Kafka Broker Customer Listener.
6-
### SSO authentication using OIDC in Control center using Okta IdP
3+
### RBAC over mTLS+OAuth enabled.
4+
### Outside CP to CP communication over OAuth.
5+
### Internal CP communication over mTLS.
6+
### SSO authentication using OIDC in Control center using Okta IdP.
77

88
driver:
99
name: docker

0 commit comments

Comments
 (0)