如何为Docker中运行的Kafka配置SSL与SASL安全认证？

基于你现有配置，按以下步骤修改即可完成搭建：

1. 生成SSL自签证书 #

在项目根目录创建certs文件夹，执行以下命令生成证书和密钥库，过程中提示输入密码可统一设置为kafka123（可自行修改，后续配置要保持一致）：

# 生成服务端密钥库
keytool -keystore certs/kafka.server.keystore.jks -alias localhost -validity 365 -keyalg RSA -genkey
# 生成CA证书
openssl req -new -x509 -keyout certs/ca-key -out certs/ca-cert -days 365
# 导入CA证书到服务端信任库
keytool -keystore certs/kafka.server.truststore.jks -alias CARoot -import -file certs/ca-cert
# 导入CA证书到客户端信任库（用于后续客户端连接）
keytool -keystore certs/kafka.client.truststore.jks -alias CARoot -import -file certs/ca-cert
# 导出服务端证书
keytool -keystore certs/kafka.server.keystore.jks -alias localhost -certreq -file certs/cert-file
# 用CA签发服务端证书
openssl x509 -req -CA certs/ca-cert -CAkey certs/ca-key -in certs/cert-file -out certs/cert-signed -days 365 -CAcreateserial
# 导入CA证书和签发后的服务端证书到服务端密钥库
keytool -keystore certs/kafka.server.keystore.jks -alias CARoot -import -file certs/ca-cert
keytool -keystore certs/kafka.server.keystore.jks -alias localhost -import -file certs/cert-signed

2. 新增SASL认证配置 #

在./config/kafka-1/目录下创建kafka_server_jaas.conf文件，内容如下，可自行修改username和password字段：

KafkaServer {
    org.apache.kafka.common.security.plain.PlainLoginModule required
    username="admin"
    password="admin123"
    user_admin="admin123";
};

3. 修改server.properties配置 #

在你原有server.properties基础上新增以下配置：

# 配置监听器，内部容器通信用PLAINTEXT，外部访问用SASL_SSL
listeners=PLAINTEXT://0.0.0.0:9092,SASL_SSL://0.0.0.0:9093
advertised.listeners=PLAINTEXT://kafka-1:9092,SASL_SSL://localhost:9093
# 启用SASL明文机制
sasl.enabled.mechanisms=PLAIN
sasl.mechanism.inter.broker.protocol=PLAIN
# SSL配置
ssl.keystore.location=/kafka/certs/kafka.server.keystore.jks
ssl.keystore.password=kafka123
ssl.key.password=kafka123
ssl.truststore.location=/kafka/certs/kafka.server.truststore.jks
ssl.truststore.password=kafka123
ssl.client.auth=required
ssl.endpoint.identification.algorithm=

4. 修改start-kafka.sh启动脚本 #

在脚本启动Kafka的命令前新增JVM参数，指定SASL配置文件：

export KAFKA_OPTS="-Djava.security.auth.login.config=/kafka/config/kafka_server_jaas.conf"
# 原有启动命令保持不变，例如：
# /kafka/bin/kafka-server-start.sh /kafka/config/server.properties

5. 修改Dockerfile #

在原有Dockerfile基础上新增证书和配置复制逻辑：

FROM openjdk:11.0.10-jre-buster

RUN apt-get update && \
    apt-get install -y curl
         
ENV KAFKA_VERSION 2.7.0
ENV SCALA_VERSION 2.13 

RUN  mkdir /tmp/kafka && \
    curl "https://archive.apache.org/dist/kafka/${KAFKA_VERSION}/kafka_${SCALA_VERSION}-${KAFKA_VERSION}.tgz" \
    -o /tmp/kafka/kafka.tgz && \
    mkdir /kafka && cd /kafka && \
    tar -xvzf /tmp/kafka/kafka.tgz --strip 1

# 新增：复制证书和SASL配置
COPY certs/ /kafka/certs/
COPY config/kafka-1/kafka_server_jaas.conf /kafka/config/

COPY start-kafka.sh  /usr/bin
RUN chmod +x  /usr/bin/start-kafka.sh

CMD ["start-kafka.sh"]

6. 修改docker-compose.yaml配置 #

在kafka服务下新增9093端口映射，无需修改其他原有配置：

version: "3.8"
services:

  zookeeper-1:
    container_name: zookeeper-1
    image: aimvector/zookeeper:2.7.0
    build:
      context: ./zookeeper
    volumes:
    - ./config/zookeeper-1/zookeeper.properties:/kafka/config/zookeeper.properties
    - ./data/zookeeper-1/:/tmp/zookeeper/
    networks:
    - kafka
  
  kafka-1:
    container_name: kafka-1
    image: aimvector/kafka:2.7.0
    ports:
      - 9092:9092
      - 9093:9093 # 新增SASL_SSL端口映射
    build: 
      context: .
    volumes:
    - ./config/kafka-1/server.properties:/kafka/config/server.properties
    - ./data/kafka-1/:/tmp/kafka-logs/
    networks:
    - kafka

networks: 
  kafka:
    name: kafka

7. 服务启动与验证 #

执行docker-compose up -d --build启动服务，启动完成后可通过以下命令测试连接：

# 进入kafka容器
docker exec -it kafka-1 bash
# 创建测试topic
/kafka/bin/kafka-topics.sh --create --topic test-topic --bootstrap-server localhost:9092 --partitions 1 --replication-factor 1
# 测试SASL_SSL连接生产消息
/kafka/bin/kafka-console-producer.sh --broker-list localhost:9093 --topic test-topic \
--producer-property security.protocol=SASL_SSL \
--producer-property sasl.mechanism=PLAIN \
--producer-property ssl.truststore.location=/kafka/certs/kafka.client.truststore.jks \
--producer-property ssl.truststore.password=kafka123 \
--producer-property sasl.jaas.config='org.apache.kafka.common.security.plain.PlainLoginModule required username="admin" password="admin123";'

内容的提问来源于stack exchange，提问作者Juraj Zovinec