无法创建匹配Confluent Cloud安全配置的本地docker-compose Kafka环境

问题根源 #

1. 监听器安全协议配置错误：当前给HOST（9092端口）配置的安全协议是PLAINTEXT，但客户端使用SASL_SSL协议发起连接，握手直接失败
2. JAAS配置键不匹配：配置的JAAS规则绑定的是名为EXTERNAL的监听器，但实际对外暴露的监听器名为HOST，规则不生效
3. 缺少SSL证书相关配置：SASL_SSL协议需要配置SSL证书、密钥库等参数，当前配置完全缺失
4. 跨协议配置冲突：KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL参数需要填写SASL机制（PLAIN/SCRAM等），之前填写的SASL_SSL是安全协议不是机制，会导致内部通信异常

修复步骤 #

第一步：生成本地测试用自签SSL证书 #

在docker-compose.yml同级目录执行以下命令生成证书文件：

# 生成CA密钥和证书
openssl req -new -x509 -keyout ca.key -out ca.crt -days 365 -nodes -subj "/CN=kafka-ca"
# 生成服务端密钥库
keytool -genkey -keystore kafka.keystore.jks -keyalg RSA -keysize 2048 -validity 365 -dname "CN=localhost" -keypass changeit -storepass changeit
# 生成证书签名请求
keytool -keystore kafka.keystore.jks -certreq -file kafka.csr -storepass changeit -keypass changeit
# 用CA签名证书
openssl x509 -req -CA ca.crt -CAkey ca.key -in kafka.csr -out kafka.crt -days 365 -CAcreateserial -passin pass:changeit
# 导入CA证书到服务端信任库
keytool -keystore kafka.truststore.jks -alias CARoot -import -file ca.crt -storepass changeit -noprompt
# 导入CA证书和签名后的服务端证书到服务端密钥库
keytool -keystore kafka.keystore.jks -alias CARoot -import -file ca.crt -storepass changeit -noprompt
keytool -keystore kafka.keystore.jks -import -file kafka.crt -storepass changeit -keypass changeit -noprompt

第二步：修改docker-compose.yml配置 #

完整可用配置如下：

version: '3'
services:
  zookeeper:
    image: confluentinc/cp-zookeeper:6.2.0
    ports:
      - "2181:2181"
    environment:
      ZOOKEEPER_CLIENT_PORT: 2181

  kafka:
    image: confluentinc/cp-kafka:6.2.0
    depends_on:
      - zookeeper
    ports:
      - '9092:9092'
      - '19092:19092'
    expose:
      - '29092'
    volumes:
      # 挂载刚才生成的证书到容器内
      - ./kafka.keystore.jks:/etc/kafka/secrets/kafka.keystore.jks
      - ./kafka.truststore.jks:/etc/kafka/secrets/kafka.truststore.jks
    environment:
      KAFKA_ZOOKEEPER_CONNECT: 'zookeeper:2181'
      KAFKA_LISTENERS: INSIDE-DOCKER-NETWORK://0.0.0.0:29092,OTHER-DOCKER-NETWORK://0.0.0.0:19092,HOST://0.0.0.0:9092
      KAFKA_ADVERTISED_LISTENERS: INSIDE-DOCKER-NETWORK://kafka:29092,OTHER-DOCKER-NETWORK://host.docker.internal:19092,HOST://localhost:9092
      # 修改HOST监听器的安全协议为SASL_SSL
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: INSIDE-DOCKER-NETWORK:PLAINTEXT,OTHER-DOCKER-NETWORK:PLAINTEXT,HOST:SASL_SSL
      KAFKA_INTER_BROKER_LISTENER_NAME: INSIDE-DOCKER-NETWORK
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: 'true'
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_LOG_RETENTION_CHECK_INTERVAL_MS: 100
      # 安全配置
      ## 绑定HOST监听器的JAAS规则
      KAFKA_LISTENER_NAME_HOST_SASL_PLAIN_SASL_JAAS_CONFIG: |
        org.apache.kafka.common.security.plain.PlainLoginModule required \
        username="broker" \
        password="broker" \
        user_alice="alice-secret";
      KAFKA_SASL_ENABLED_MECHANISMS: PLAIN
      ## SSL相关配置
      KAFKA_SSL_KEYSTORE_LOCATION: /etc/kafka/secrets/kafka.keystore.jks
      KAFKA_SSL_KEYSTORE_PASSWORD: changeit
      KAFKA_SSL_KEY_PASSWORD: changeit
      KAFKA_SSL_TRUSTSTORE_LOCATION: /etc/kafka/secrets/kafka.truststore.jks
      KAFKA_SSL_TRUSTSTORE_PASSWORD: changeit
      # 本地测试关闭域名校验，生产环境删除该配置
      KAFKA_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM: ""

第三步：调整客户端连接配置 #

和Confluent Cloud连接逻辑保持一致的前提下，新增本地测试用的SSL校验参数即可：

c = Consumer(
    {
        "bootstrap.servers": "localhost:9092",
        "sasl.mechanism": "PLAIN",
        "security.protocol": "SASL_SSL",
        "sasl.username": "alice", # 和JAAS配置里的user_xxx对应，xxx为用户名
        "sasl.password": "alice-secret",
        "group.id": "consumer-name",
        # 本地测试关闭证书校验，生产环境替换为ssl.ca.location指向你生成的ca.crt
        "enable.ssl.certificate.verification": "false",
        "ssl.endpoint.identification.algorithm": "none",
    }
)

修改完成后执行docker-compose up -d启动服务，等待1分钟左右即可正常连接。

内容的提问来源于stack exchange，提问作者Nilan Saha