ssl - 保护 Kafka 客户端和 Zookeeper 服务器之间的通信

Question

我已将 Kafka 服务器和 Zookeeper 服务器配置为使用 JKS 使用 SSL/TLS。我已经使用 openssl 确认了这一点。我正在使用 Kafka 和 Zookeeper 的 Bitnami Helm 图表。下面是 Kafka 的日志输出。我很确定 Kafka 客户端不会因为 Zookeeper 日志而安全地向 Zookeeper 服务器发送请求。如何确保 Kafka 客户端使用 SSL/TLS。我认为 kafka 客户端在使用 args 执行配置命令时需要使用 client.properties 文件。但我不知道如何在配置过程中传递这个文件。日志显示 Kafka 客户端正在尝试将名为 zookeeperUser 的用户添加到 Zookeeper。这种通信是不安全的。

卡夫卡日志

 09:56:31.43
 09:56:31.43 Welcome to the Bitnami kafka container
 09:56:31.44 Subscribe to project updates by watching https://github.com/bitnami/bitnami-docker-kafka
 09:56:31.44 Submit issues and feature requests at https://github.com/bitnami/bitnami-docker-kafka/issues
 09:56:31.44
 09:56:31.44 INFO  ==> ** Starting Kafka setup **
 09:56:31.56 DEBUG ==> Validating settings in KAFKA_* env vars...
 09:56:31.65 INFO  ==> Initializing Kafka...
 09:56:31.66 INFO  ==> No injected configuration files found, creating default config files
 09:56:32.96 INFO  ==> Configuring Kafka for inter-broker communications with SASL_SSL authentication.
 09:56:33.13 INFO  ==> Configuring Kafka for client communications with SASL_SSL authentication.
 09:56:33.43 INFO  ==> Custom JAAS authentication file detected. Skipping generation.
 09:56:33.43 WARN  ==> The following environment variables will be ignored: KAFKA_CLIENT_USERS, KAFKA_CLIENT_PASSWORDS, KAFKA_INTER_BROKER_USER, KAFKA_INTER_BROKER_PASSWORD, KAFKA_ZOOKEEPER_USER and KAFKA_ZOOKEEPER_PASSWORD
 09:56:33.44 INFO  ==> Creating users in Zookeeper
 09:56:33.44 DEBUG ==> Creating user zookeeperUser in zookeeper
Warning: --zookeeper is deprecated and will be removed in a future version of Kafka.
Use --bootstrap-server instead to specify a broker to connect to.
Error while executing config command with args '--zookeeper zookeeper.default.svc.cluster.local:3181 --alter --add-config SCRAM-SHA-256=[iterations=8192,password=zookeeperPassword],SCRAM-SHA-512=[password=zookeeperPassword] --entity-type users --entity-name zookeeperUser'
kafka.zookeeper.ZooKeeperClientTimeoutException: Timed out waiting for connection while in state: CONNECTING
        at kafka.zookeeper.ZooKeeperClient.$anonfun$waitUntilConnected$3(ZooKeeperClient.scala:262)
        at kafka.zookeeper.ZooKeeperClient.waitUntilConnected(ZooKeeperClient.scala:258)
        at kafka.zookeeper.ZooKeeperClient.<init>(ZooKeeperClient.scala:119)
        at kafka.zk.KafkaZkClient$.apply(KafkaZkClient.scala:1881)
        at kafka.admin.ConfigCommand$.processCommandWithZk(ConfigCommand.scala:116)
        at kafka.admin.ConfigCommand$.main(ConfigCommand.scala:94)
        at kafka.admin.ConfigCommand.main(ConfigCommand.scala)

客户端属性

cat > client.properties <<EOF
security.protocol=SASL_SSL
sasl.mechanism=SCRAM-SHA-256
ssl.truststore.location=/tmp/kafka.truststore.jks
ssl.truststore.password=******
EOF

动物园管理员日志

2021-02-11 09:56:43,055 [myid:1] - ERROR [nioEventLoopGroup-7-1:NettyServerCnxnFactory$CertificateVerifier@434] - Unsuccessful handshake with session 0x0
2021-02-11 09:56:43,055 [myid:1] - WARN  [nioEventLoopGroup-7-1:NettyServerCnxnFactory$CnxnChannelHandler@273] - Exception caught
io.netty.handler.codec.DecoderException: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 0000002d000000000000000000000000000075300000000000000000000000100000000000000000000000000000000000
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:471)
        at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
        at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
        at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
        at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
        at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
        at io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)
        at io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:714)
        at io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:650)
        at io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:576)
        at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:493)
        at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989)
        at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: 0000002d000000000000000000000000000075300000000000000000000000100000000000000000000000000000000000
        at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1246)
        at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1314)
        at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:501)
        at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:440)
        ... 17 more

标签： sslapache-kafkaapache-zookeepertls1.2bitnami