diff --git a/charts/akto-protection/templates/deployment.yaml b/charts/akto-protection/templates/deployment.yaml index 8884e262..3fa91ffc 100644 --- a/charts/akto-protection/templates/deployment.yaml +++ b/charts/akto-protection/templates/deployment.yaml @@ -71,23 +71,7 @@ spec: imagePullPolicy: {{ .Values.runtime.aktoApiSecurityProtection.imagePullPolicy }} name: akto-api-security-runtime resources: {{- toYaml .Values.runtime.aktoApiSecurityProtection.resources | nindent 10 }} - - env: - - name: ZOOKEEPER_CLIENT_PORT - value: {{ quote .Values.runtime.zoo1.env.zookeeperClientPort }} - - name: ZOOKEEPER_SERVERS - value: {{ quote .Values.runtime.zoo1.env.zookeeperServers }} - - name: ZOOKEEPER_SERVER_ID - value: {{ quote .Values.runtime.zoo1.env.zookeeperServerId }} - - name: KAFKA_OPTS - value: {{ quote .Values.runtime.zoo1.env.kafkaOpts }} - - name: KUBERNETES_CLUSTER_DOMAIN - value: {{ quote .Values.kubernetesClusterDomain }} - image: {{ .Values.runtime.zoo1.image.repository }}:{{ .Values.runtime.zoo1.image.tag - | default .Chart.AppVersion }} - name: zoo1 - ports: - - containerPort: 2181 - resources: {{- toYaml .Values.runtime.zoo1.resources | nindent 10 }} + - env: - name: MY_POD_NAMESPACE valueFrom: @@ -105,6 +89,16 @@ spec: value: {{ quote .Values.runtime.kafka1.env.kafkaInterBrokerListenerName }} - name: KAFKA_LISTENER_SECURITY_PROTOCOL_MAP value: {{ quote .Values.runtime.kafka1.env.kafkaListenerSecurityProtocolMap }} + - name: KAFKA_PROCESS_ROLES + value: {{ quote .Values.runtime.kafka1.env.kafkaProcessRoles }} + - name: KAFKA_NODE_ID + value: {{ quote .Values.runtime.kafka1.env.kafkaNodeId }} + - name: KAFKA_CONTROLLER_QUORUM_VOTERS + value: {{ quote .Values.runtime.kafka1.env.kafkaControllerQuorumVoters }} + - name: KAFKA_CONTROLLER_LISTENER_NAMES + value: {{ quote .Values.runtime.kafka1.env.kafkaControllerListenerNames }} + - name: KAFKA_LISTENERS + value: {{ quote .Values.runtime.kafka1.env.kafkaListeners }} - name: KAFKA_LOG_CLEANER_ENABLE value: {{ quote .Values.runtime.kafka1.env.kafkaLogCleanerEnable }} - name: KAFKA_LOG_RETENTION_BYTES @@ -123,8 +117,8 @@ spec: - name: KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR value: {{ quote .Values.runtime.kafka1.env.kafkaTransactionStateLogReplicationFactor }} - - name: KAFKA_ZOOKEEPER_CONNECT - value: {{ quote .Values.runtime.kafka1.env.kafkaZookeeperConnect }} + - name: CLUSTER_ID + value: {{ quote .Values.runtime.kafka1.env.kafkaClusterId }} - name: KUBERNETES_CLUSTER_DOMAIN value: {{ quote .Values.kubernetesClusterDomain }} image: {{ .Values.runtime.kafka1.image.repository }}:{{ .Values.runtime.kafka1.image.tag @@ -134,6 +128,7 @@ spec: - containerPort: 9092 - containerPort: 19092 - containerPort: 29092 + - containerPort: 9093 - containerPort: 9999 resources: {{- toYaml .Values.runtime.kafka1.resources | nindent 10 }} restartPolicy: Always diff --git a/charts/akto-protection/values.yaml b/charts/akto-protection/values.yaml index 3b0ef734..555287a5 100644 --- a/charts/akto-protection/values.yaml +++ b/charts/akto-protection/values.yaml @@ -36,8 +36,12 @@ runtime: kafkaCleanupPolicy: delete kafkaCreateTopics: akto.api.protection:3:3 kafkaInterBrokerListenerName: LISTENER_DOCKER_EXTERNAL_LOCALHOST - kafkaListenerSecurityProtocolMap: LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT, - LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT + kafkaListenerSecurityProtocolMap: CONTROLLER:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT + kafkaProcessRoles: "broker,controller" + kafkaNodeId: "1" + kafkaControllerQuorumVoters: "1@localhost:9093" + kafkaControllerListenerNames: "CONTROLLER" + kafkaListeners: "CONTROLLER://0.0.0.0:9093,LISTENER_DOCKER_EXTERNAL_LOCALHOST://0.0.0.0:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST://0.0.0.0:9092" kafkaLogCleanerEnable: "true" kafkaLogRetentionBytes: "10737418240" kafkaLogRetentionCheckIntervalMs: "60000" @@ -46,10 +50,10 @@ runtime: kafkaOffsetsTopicReplicationFactor: "1" kafkaTransactionStateLogMinIsr: "1" kafkaTransactionStateLogReplicationFactor: "1" - kafkaZookeeperConnect: 127.0.0.1:2181 + kafkaClusterId: "c6a1b8e2-4f2a-4b2a-9c3f-1a2b3c4d5e6f" image: repository: confluentinc/cp-kafka - tag: 6.2.11-1-ubi8 + tag: 8.1.0 resources: requests: cpu: "50m" @@ -62,22 +66,7 @@ runtime: targetPort: 9092 replicas: 1 type: ClusterIP - zoo1: - env: - kafkaOpts: -Dzookeeper.admin.enableServer=false - zookeeperClientPort: "2181" - zookeeperServerId: "1" - zookeeperServers: zoo1:2888:3888 - image: - repository: confluentinc/cp-zookeeper - tag: 6.2.11-1-ubi8 - resources: - requests: - cpu: "5m" - memory: "500Mi" - limits: - cpu: 2 - memory: "4Gi" + keel: diff --git a/charts/akto-runtime/templates/deployment.yaml b/charts/akto-runtime/templates/deployment.yaml index 34ca52f2..bbcc5539 100644 --- a/charts/akto-runtime/templates/deployment.yaml +++ b/charts/akto-runtime/templates/deployment.yaml @@ -71,23 +71,7 @@ spec: imagePullPolicy: {{ .Values.runtime.aktoApiSecurityRuntime.imagePullPolicy }} name: akto-api-security-runtime resources: {{- toYaml .Values.runtime.aktoApiSecurityRuntime.resources | nindent 10 }} - - env: - - name: ZOOKEEPER_CLIENT_PORT - value: {{ quote .Values.runtime.zoo1.env.zookeeperClientPort }} - - name: ZOOKEEPER_SERVERS - value: {{ quote .Values.runtime.zoo1.env.zookeeperServers }} - - name: ZOOKEEPER_SERVER_ID - value: {{ quote .Values.runtime.zoo1.env.zookeeperServerId }} - - name: KAFKA_OPTS - value: {{ quote .Values.runtime.zoo1.env.kafkaOpts }} - - name: KUBERNETES_CLUSTER_DOMAIN - value: {{ quote .Values.kubernetesClusterDomain }} - image: {{ .Values.runtime.zoo1.image.repository }}:{{ .Values.runtime.zoo1.image.tag - | default .Chart.AppVersion }} - name: zoo1 - ports: - - containerPort: 2181 - resources: {{- toYaml .Values.runtime.zoo1.resources | nindent 10 }} + - env: - name: MY_POD_NAMESPACE valueFrom: @@ -105,6 +89,16 @@ spec: value: {{ quote .Values.runtime.kafka1.env.kafkaInterBrokerListenerName }} - name: KAFKA_LISTENER_SECURITY_PROTOCOL_MAP value: {{ quote .Values.runtime.kafka1.env.kafkaListenerSecurityProtocolMap }} + - name: KAFKA_PROCESS_ROLES + value: {{ quote .Values.runtime.kafka1.env.kafkaProcessRoles }} + - name: KAFKA_NODE_ID + value: {{ quote .Values.runtime.kafka1.env.kafkaNodeId }} + - name: KAFKA_CONTROLLER_QUORUM_VOTERS + value: {{ quote .Values.runtime.kafka1.env.kafkaControllerQuorumVoters }} + - name: KAFKA_CONTROLLER_LISTENER_NAMES + value: {{ quote .Values.runtime.kafka1.env.kafkaControllerListenerNames }} + - name: KAFKA_LISTENERS + value: {{ quote .Values.runtime.kafka1.env.kafkaListeners }} - name: KAFKA_LOG_CLEANER_ENABLE value: {{ quote .Values.runtime.kafka1.env.kafkaLogCleanerEnable }} - name: KAFKA_LOG_RETENTION_BYTES @@ -123,8 +117,8 @@ spec: - name: KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR value: {{ quote .Values.runtime.kafka1.env.kafkaTransactionStateLogReplicationFactor }} - - name: KAFKA_ZOOKEEPER_CONNECT - value: {{ quote .Values.runtime.kafka1.env.kafkaZookeeperConnect }} + - name: CLUSTER_ID + value: {{ quote .Values.runtime.kafka1.env.kafkaClusterId }} - name: KUBERNETES_CLUSTER_DOMAIN value: {{ quote .Values.kubernetesClusterDomain }} image: {{ .Values.runtime.kafka1.image.repository }}:{{ .Values.runtime.kafka1.image.tag @@ -134,6 +128,7 @@ spec: - containerPort: 9092 - containerPort: 19092 - containerPort: 29092 + - containerPort: 9093 - containerPort: 9999 resources: {{- toYaml .Values.runtime.kafka1.resources | nindent 10 }} restartPolicy: Always @@ -291,6 +286,6 @@ spec: name: akto-api-security-threat-backend ports: - containerPort: 9090 - resources: {{- toYaml .Values.runtime.zoo1.resources | nindent 10 }} + resources: {{- toYaml .Values.threat_client.aktoApiSecurityThreatBackend.resources | nindent 10 }} restartPolicy: Always {{ end }} \ No newline at end of file diff --git a/charts/akto-runtime/values.yaml b/charts/akto-runtime/values.yaml index c23f545a..0d4d2aa9 100644 --- a/charts/akto-runtime/values.yaml +++ b/charts/akto-runtime/values.yaml @@ -40,8 +40,12 @@ runtime: kafkaCleanupPolicy: delete kafkaCreateTopics: akto.api.logs:3:3 kafkaInterBrokerListenerName: LISTENER_DOCKER_EXTERNAL_LOCALHOST - kafkaListenerSecurityProtocolMap: LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT, - LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT + kafkaListenerSecurityProtocolMap: CONTROLLER:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT + kafkaProcessRoles: "broker,controller" + kafkaNodeId: "1" + kafkaControllerQuorumVoters: "1@localhost:9093" + kafkaControllerListenerNames: "CONTROLLER" + kafkaListeners: "CONTROLLER://0.0.0.0:9093,LISTENER_DOCKER_EXTERNAL_LOCALHOST://0.0.0.0:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST://0.0.0.0:9092" kafkaLogCleanerEnable: "true" kafkaLogRetentionBytes: "10737418240" kafkaLogRetentionCheckIntervalMs: "60000" @@ -50,10 +54,10 @@ runtime: kafkaOffsetsTopicReplicationFactor: "1" kafkaTransactionStateLogMinIsr: "1" kafkaTransactionStateLogReplicationFactor: "1" - kafkaZookeeperConnect: 127.0.0.1:2181 + kafkaClusterId: "c6a1b8e2-4f2a-4b2a-9c3f-1a2b3c4d5e6f" image: repository: confluentinc/cp-kafka - tag: 6.2.11-1-ubi8 + tag: 8.1.0 resources: requests: cpu: 1 @@ -66,22 +70,6 @@ runtime: targetPort: 9092 replicas: 1 type: ClusterIP - zoo1: - env: - kafkaOpts: -Dzookeeper.admin.enableServer=false - zookeeperClientPort: "2181" - zookeeperServerId: "1" - zookeeperServers: zoo1:2888:3888 - image: - repository: confluentinc/cp-zookeeper - tag: 6.2.11-1-ubi8 - resources: - requests: - cpu: 1 - memory: "2Gi" - limits: - cpu: 2 - memory: "4Gi" keel: keel: diff --git a/charts/akto-setup/templates/deployment.yaml b/charts/akto-setup/templates/deployment.yaml index d693dd20..8a7fabea 100644 --- a/charts/akto-setup/templates/deployment.yaml +++ b/charts/akto-setup/templates/deployment.yaml @@ -225,23 +225,7 @@ spec: imagePullPolicy: {{ .Values.runtime.aktoApiSecurityRuntime.imagePullPolicy }} name: akto-api-security-runtime resources: {{- toYaml .Values.runtime.aktoApiSecurityRuntime.resources | nindent 10 }} - - env: - - name: ZOOKEEPER_CLIENT_PORT - value: {{ quote .Values.runtime.zoo1.env.zookeeperClientPort }} - - name: ZOOKEEPER_SERVERS - value: {{ quote .Values.runtime.zoo1.env.zookeeperServers }} - - name: ZOOKEEPER_SERVER_ID - value: {{ quote .Values.runtime.zoo1.env.zookeeperServerId }} - - name: KAFKA_OPTS - value: {{ quote .Values.runtime.zoo1.env.kafkaOpts }} - - name: KUBERNETES_CLUSTER_DOMAIN - value: {{ quote .Values.kubernetesClusterDomain }} - image: {{ .Values.runtime.zoo1.image.repository }}:{{ .Values.runtime.zoo1.image.tag - | default .Chart.AppVersion }} - name: zoo1 - ports: - - containerPort: 2181 - resources: {{- toYaml .Values.runtime.zoo1.resources | nindent 10 }} + - env: - name: MY_POD_NAMESPACE valueFrom: @@ -259,6 +243,16 @@ spec: value: {{ quote .Values.runtime.kafka1.env.kafkaInterBrokerListenerName }} - name: KAFKA_LISTENER_SECURITY_PROTOCOL_MAP value: {{ quote .Values.runtime.kafka1.env.kafkaListenerSecurityProtocolMap }} + - name: KAFKA_PROCESS_ROLES + value: {{ quote .Values.runtime.kafka1.env.kafkaProcessRoles }} + - name: KAFKA_NODE_ID + value: {{ quote .Values.runtime.kafka1.env.kafkaNodeId }} + - name: KAFKA_CONTROLLER_QUORUM_VOTERS + value: {{ quote .Values.runtime.kafka1.env.kafkaControllerQuorumVoters }} + - name: KAFKA_CONTROLLER_LISTENER_NAMES + value: {{ quote .Values.runtime.kafka1.env.kafkaControllerListenerNames }} + - name: KAFKA_LISTENERS + value: {{ quote .Values.runtime.kafka1.env.kafkaListeners }} - name: KAFKA_LOG_CLEANER_ENABLE value: {{ quote .Values.runtime.kafka1.env.kafkaLogCleanerEnable }} - name: KAFKA_LOG_RETENTION_BYTES @@ -277,8 +271,8 @@ spec: - name: KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR value: {{ quote .Values.runtime.kafka1.env.kafkaTransactionStateLogReplicationFactor }} - - name: KAFKA_ZOOKEEPER_CONNECT - value: {{ quote .Values.runtime.kafka1.env.kafkaZookeeperConnect }} + - name: CLUSTER_ID + value: {{ quote .Values.runtime.kafka1.env.kafkaClusterId }} - name: KUBERNETES_CLUSTER_DOMAIN value: {{ quote .Values.kubernetesClusterDomain }} image: {{ .Values.runtime.kafka1.image.repository }}:{{ .Values.runtime.kafka1.image.tag @@ -288,6 +282,7 @@ spec: - containerPort: 9092 - containerPort: 19092 - containerPort: 29092 + - containerPort: 9093 - containerPort: 9999 resources: {{- toYaml .Values.runtime.kafka1.resources | nindent 10 }} restartPolicy: Always diff --git a/charts/akto-setup/values.yaml b/charts/akto-setup/values.yaml index 5555ecda..65821fed 100644 --- a/charts/akto-setup/values.yaml +++ b/charts/akto-setup/values.yaml @@ -80,8 +80,12 @@ runtime: kafkaCleanupPolicy: delete kafkaCreateTopics: akto.api.logs:3:3 kafkaInterBrokerListenerName: LISTENER_DOCKER_EXTERNAL_LOCALHOST - kafkaListenerSecurityProtocolMap: LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT, - LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT + kafkaListenerSecurityProtocolMap: CONTROLLER:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT + kafkaProcessRoles: "broker,controller" + kafkaNodeId: "1" + kafkaControllerQuorumVoters: "1@localhost:9093" + kafkaControllerListenerNames: "CONTROLLER" + kafkaListeners: "CONTROLLER://0.0.0.0:9093,LISTENER_DOCKER_EXTERNAL_LOCALHOST://0.0.0.0:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST://0.0.0.0:9092" kafkaLogCleanerEnable: "true" kafkaLogRetentionBytes: "10737418240" kafkaLogRetentionCheckIntervalMs: "60000" @@ -90,10 +94,10 @@ runtime: kafkaOffsetsTopicReplicationFactor: "1" kafkaTransactionStateLogMinIsr: "1" kafkaTransactionStateLogReplicationFactor: "1" - kafkaZookeeperConnect: 127.0.0.1:2181 + kafkaClusterId: "c6a1b8e2-4f2a-4b2a-9c3f-1a2b3c4d5e6f" image: repository: confluentinc/cp-kafka - tag: 6.2.11-1-ubi8 + tag: 8.1.0 resources: requests: cpu: 1 @@ -106,22 +110,7 @@ runtime: targetPort: 9092 replicas: 1 type: ClusterIP - zoo1: - env: - kafkaOpts: -Dzookeeper.admin.enableServer=false - zookeeperClientPort: "2181" - zookeeperServerId: "1" - zookeeperServers: zoo1:2888:3888 - image: - repository: confluentinc/cp-zookeeper - tag: 6.2.11-1-ubi8 - resources: - requests: - cpu: 1 - memory: "2Gi" - limits: - cpu: 2 - memory: "4Gi" + testing: aktoApiSecurityTesting: env: diff --git a/charts/hybrid-redact/templates/deployment.yaml b/charts/hybrid-redact/templates/deployment.yaml index af2abaca..6c35babe 100644 --- a/charts/hybrid-redact/templates/deployment.yaml +++ b/charts/hybrid-redact/templates/deployment.yaml @@ -87,23 +87,7 @@ spec: name: akto-api-security-runtime resources: {{- toYaml .Values.mini_runtime.aktoApiSecurityRuntime.resources | nindent 10 }} {{ end }} - - env: - - name: ZOOKEEPER_CLIENT_PORT - value: {{ quote .Values.mini_runtime.zoo1.env.zookeeperClientPort }} - - name: ZOOKEEPER_SERVERS - value: {{ quote .Values.mini_runtime.zoo1.env.zookeeperServers }} - - name: ZOOKEEPER_SERVER_ID - value: {{ quote .Values.mini_runtime.zoo1.env.zookeeperServerId }} - - name: KAFKA_OPTS - value: {{ quote .Values.mini_runtime.zoo1.env.kafkaOpts }} - - name: KUBERNETES_CLUSTER_DOMAIN - value: {{ quote .Values.kubernetesClusterDomain }} - image: {{ .Values.mini_runtime.zoo1.image.repository }}:{{ .Values.mini_runtime.zoo1.image.tag - | default .Chart.AppVersion }} - name: zoo1 - ports: - - containerPort: 2181 - resources: {{- toYaml .Values.mini_runtime.zoo1.resources | nindent 10 }} + - env: - name: MY_POD_NAMESPACE valueFrom: @@ -121,6 +105,16 @@ spec: value: {{ quote .Values.mini_runtime.kafka1.env.kafkaInterBrokerListenerName }} - name: KAFKA_LISTENER_SECURITY_PROTOCOL_MAP value: {{ quote .Values.mini_runtime.kafka1.env.kafkaListenerSecurityProtocolMap }} + - name: KAFKA_PROCESS_ROLES + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaProcessRoles }} + - name: KAFKA_NODE_ID + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaNodeId }} + - name: KAFKA_CONTROLLER_QUORUM_VOTERS + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaControllerQuorumVoters }} + - name: KAFKA_CONTROLLER_LISTENER_NAMES + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaControllerListenerNames }} + - name: KAFKA_LISTENERS + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaListeners }} - name: KAFKA_LOG_CLEANER_ENABLE value: {{ quote .Values.mini_runtime.kafka1.env.kafkaLogCleanerEnable }} - name: KAFKA_LOG_RETENTION_BYTES @@ -139,8 +133,8 @@ spec: - name: KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR value: {{ quote .Values.mini_runtime.kafka1.env.kafkaTransactionStateLogReplicationFactor }} - - name: KAFKA_ZOOKEEPER_CONNECT - value: {{ quote .Values.mini_runtime.kafka1.env.kafkaZookeeperConnect }} + - name: CLUSTER_ID + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaClusterId }} - name: KUBERNETES_CLUSTER_DOMAIN value: {{ quote .Values.kubernetesClusterDomain }} image: {{ .Values.mini_runtime.kafka1.image.repository }}:{{ .Values.mini_runtime.kafka1.image.tag @@ -150,6 +144,7 @@ spec: - containerPort: 9092 - containerPort: 19092 - containerPort: 29092 + - containerPort: 9093 - containerPort: 9999 resources: {{- toYaml .Values.mini_runtime.kafka1.resources | nindent 10 }} restartPolicy: Always diff --git a/charts/hybrid-redact/values.yaml b/charts/hybrid-redact/values.yaml index 00425e6f..fa3ec3b6 100644 --- a/charts/hybrid-redact/values.yaml +++ b/charts/hybrid-redact/values.yaml @@ -44,8 +44,12 @@ mini_runtime: kafkaCleanupPolicy: delete kafkaCreateTopics: akto.api.logs:3:3 kafkaInterBrokerListenerName: LISTENER_DOCKER_EXTERNAL_LOCALHOST - kafkaListenerSecurityProtocolMap: LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT, - LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT + kafkaListenerSecurityProtocolMap: CONTROLLER:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT + kafkaProcessRoles: "broker,controller" + kafkaNodeId: "1" + kafkaControllerQuorumVoters: "1@localhost:9093" + kafkaControllerListenerNames: "CONTROLLER" + kafkaListeners: "CONTROLLER://0.0.0.0:9093,LISTENER_DOCKER_EXTERNAL_LOCALHOST://0.0.0.0:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST://0.0.0.0:9092" kafkaLogCleanerEnable: "true" kafkaLogRetentionBytes: "10737418240" kafkaLogRetentionCheckIntervalMs: "60000" @@ -54,10 +58,10 @@ mini_runtime: kafkaOffsetsTopicReplicationFactor: "1" kafkaTransactionStateLogMinIsr: "1" kafkaTransactionStateLogReplicationFactor: "1" - kafkaZookeeperConnect: 127.0.0.1:2181 + kafkaClusterId: "c6a1b8e2-4f2a-4b2a-9c3f-1a2b3c4d5e6f" image: repository: confluentinc/cp-kafka - tag: 6.2.11-1-ubi8 + tag: 8.1.0 resources: requests: cpu: "50m" @@ -70,22 +74,6 @@ mini_runtime: targetPort: 9092 replicas: 1 type: ClusterIP - zoo1: - env: - kafkaOpts: -Dzookeeper.admin.enableServer=false - zookeeperClientPort: "2181" - zookeeperServerId: "1" - zookeeperServers: zoo1:2888:3888 - image: - repository: confluentinc/cp-zookeeper - tag: 6.2.11-1-ubi8 - resources: - requests: - cpu: "5m" - memory: "500Mi" - limits: - cpu: 2 - memory: "4Gi" testing: aktoApiSecurityTesting: diff --git a/charts/mini-runtime/templates/deployment.yaml b/charts/mini-runtime/templates/deployment.yaml index f1544f9d..4de79e90 100644 --- a/charts/mini-runtime/templates/deployment.yaml +++ b/charts/mini-runtime/templates/deployment.yaml @@ -94,40 +94,7 @@ spec: imagePullPolicy: {{ .Values.mini_runtime.aktoApiSecurityRuntime.imagePullPolicy }} name: akto-api-security-runtime resources: {{- toYaml .Values.mini_runtime.aktoApiSecurityRuntime.resources | nindent 10 }} - - env: - - name: ZOOKEEPER_CLIENT_PORT - value: {{ quote .Values.mini_runtime.zoo1.env.zookeeperClientPort }} - - name: ZOOKEEPER_SERVERS - value: {{ quote .Values.mini_runtime.zoo1.env.zookeeperServers }} - - name: ZOOKEEPER_SERVER_ID - value: {{ quote .Values.mini_runtime.zoo1.env.zookeeperServerId }} - {{- if .Values.mini_runtime.kafka1.useSasl }} - - name: KAFKA_OPTS - value: "{{ .Values.mini_runtime.zoo1.env.kafkaOpts }} -Djava.security.auth.login.config=/etc/zookeeper/secrets/zookeeper_jaas.conf" - - name: ZOOKEEPER_SASL_ENABLED - value: "true" - - name: ZOOKEEPER_SASL_PROVIDER - value: "org.apache.zookeeper.server.auth.SASLAuthenticationProvider" - - name: ZOOKEEPER_SASL_PROVIDER_CLASS - value: "org.apache.zookeeper.server.auth.SASLAuthenticationProvider" - {{- else }} - - name: KAFKA_OPTS - value: {{ quote .Values.mini_runtime.zoo1.env.kafkaOpts }} - {{- end }} - - name: KUBERNETES_CLUSTER_DOMAIN - value: {{ quote .Values.kubernetesClusterDomain }} - image: {{ .Values.mini_runtime.zoo1.image.repository }}:{{ .Values.mini_runtime.zoo1.image.tag - | default .Chart.AppVersion }} - {{- if .Values.mini_runtime.kafka1.useSasl }} - volumeMounts: - - name: zookeeper-jaas-config - mountPath: /etc/zookeeper/secrets - readOnly: true - {{- end }} - name: zoo1 - ports: - - containerPort: 2181 - resources: {{- toYaml .Values.mini_runtime.zoo1.resources | nindent 10 }} + - env: - name: MY_POD_NAMESPACE valueFrom: @@ -174,6 +141,16 @@ spec: {{- else }} {{ .Values.mini_runtime.kafka1.env.kafkaListenerSecurityProtocolMap }} {{- end }} + - name: KAFKA_PROCESS_ROLES + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaProcessRoles }} + - name: KAFKA_NODE_ID + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaNodeId }} + - name: KAFKA_CONTROLLER_QUORUM_VOTERS + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaControllerQuorumVoters }} + - name: KAFKA_CONTROLLER_LISTENER_NAMES + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaControllerListenerNames }} + - name: KAFKA_LISTENERS + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaListeners }} - name: KAFKA_LOG_CLEANER_ENABLE value: {{ quote .Values.mini_runtime.kafka1.env.kafkaLogCleanerEnable }} - name: KAFKA_LOG_RETENTION_BYTES @@ -192,8 +169,8 @@ spec: - name: KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR value: {{ quote .Values.mini_runtime.kafka1.env.kafkaTransactionStateLogReplicationFactor }} - - name: KAFKA_ZOOKEEPER_CONNECT - value: {{ quote .Values.mini_runtime.kafka1.env.kafkaZookeeperConnect }} + - name: CLUSTER_ID + value: {{ quote .Values.mini_runtime.kafka1.env.kafkaClusterId }} {{- if .Values.mini_runtime.kafka1.useTls }} - name: KAFKA_SSL_KEYSTORE_LOCATION @@ -255,9 +232,6 @@ spec: - name: kafka-jaas-config configMap: name: {{ include "akto.fullname" . }}-kafka-jaas-config - - name: zookeeper-jaas-config - configMap: - name: {{ include "akto.fullname" . }}-zookeeper-jaas-config {{- end }} {{- end }} diff --git a/charts/mini-runtime/templates/kafka-jaas-configmap.yaml b/charts/mini-runtime/templates/kafka-jaas-configmap.yaml index 44a59519..c1cc58f9 100644 --- a/charts/mini-runtime/templates/kafka-jaas-configmap.yaml +++ b/charts/mini-runtime/templates/kafka-jaas-configmap.yaml @@ -13,9 +13,4 @@ data: password="{{ if .Values.mini_runtime.kafka1.env.useSecretsForSaslCredentials }}{{ .Values.mini_runtime.kafka1.env.saslCredentialsSecrets.password }}{{ else }}{{ .Values.mini_runtime.kafka1.env.saslPassword }}{{ end }}" user_{{ if .Values.mini_runtime.kafka1.env.useSecretsForSaslCredentials }}{{ .Values.mini_runtime.kafka1.env.saslCredentialsSecrets.username }}{{ else }}{{ .Values.mini_runtime.kafka1.env.saslUsername }}{{ end }}="{{ if .Values.mini_runtime.kafka1.env.useSecretsForSaslCredentials }}{{ .Values.mini_runtime.kafka1.env.saslCredentialsSecrets.password }}{{ else }}{{ .Values.mini_runtime.kafka1.env.saslPassword }}{{ end }}"; }; - Client { - org.apache.kafka.common.security.plain.PlainLoginModule required - username="{{ .Values.mini_runtime.zoo1.env.saslUsername }}" - password="{{ .Values.mini_runtime.zoo1.env.saslPassword }}"; - }; {{- end }} diff --git a/charts/mini-runtime/templates/zookeeper-jaas-configmap.yaml b/charts/mini-runtime/templates/zookeeper-jaas-configmap.yaml deleted file mode 100644 index da95ce8b..00000000 --- a/charts/mini-runtime/templates/zookeeper-jaas-configmap.yaml +++ /dev/null @@ -1,16 +0,0 @@ -{{- if .Values.mini_runtime.kafka1.useSasl }} -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "akto.fullname" . }}-zookeeper-jaas-config - labels: - {{- include "akto.labels" . | nindent 4 }} -data: - zookeeper_jaas.conf: | - Server { - org.apache.kafka.common.security.plain.PlainLoginModule required - username="{{ .Values.mini_runtime.zoo1.env.saslUsername }}" - password="{{ .Values.mini_runtime.zoo1.env.saslPassword }}" - user_{{ .Values.mini_runtime.zoo1.env.saslUsername }}="{{ .Values.mini_runtime.zoo1.env.saslPassword }}"; - }; -{{- end }} diff --git a/charts/mini-runtime/values.yaml b/charts/mini-runtime/values.yaml index 56e635d2..39430971 100644 --- a/charts/mini-runtime/values.yaml +++ b/charts/mini-runtime/values.yaml @@ -48,10 +48,15 @@ mini_runtime: kafkaCleanupPolicy: delete kafkaCreateTopics: akto.api.logs:3:3 kafkaInterBrokerListenerName: LISTENER_DOCKER_EXTERNAL_LOCALHOST - kafkaListenerSecurityProtocolMap: LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT, LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT - kafkaListenerSecurityProtocolMapSsl: LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT, LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT, LISTENER_DOCKER_EXTERNAL_DIFFHOST_ENCRYPTED:SSL - kafkaListenerSecurityProtocolMapSasl: LISTENER_DOCKER_EXTERNAL_DIFFHOST_SASL:SASL_PLAINTEXT, LISTENER_DOCKER_EXTERNAL_LOCALHOST_SASL:SASL_PLAINTEXT, LISTENER_DOCKER_EXTERNAL_LOCALHOST:SASL_PLAINTEXT, LISTENER_DOCKER_EXTERNAL_DIFFHOST:SASL_PLAINTEXT - kafkaListenerSecurityProtocolMapSaslTls: LISTENER_DOCKER_EXTERNAL_DIFFHOST_SASL:SASL_SSL, LISTENER_DOCKER_EXTERNAL_LOCALHOST_SASL:SASL_PLAINTEXT + kafkaListenerSecurityProtocolMap: CONTROLLER:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT + kafkaListenerSecurityProtocolMapSsl: CONTROLLER:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_DIFFHOST_ENCRYPTED:SSL + kafkaListenerSecurityProtocolMapSasl: CONTROLLER:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_DIFFHOST_SASL:SASL_PLAINTEXT,LISTENER_DOCKER_EXTERNAL_LOCALHOST_SASL:SASL_PLAINTEXT,LISTENER_DOCKER_EXTERNAL_LOCALHOST:SASL_PLAINTEXT,LISTENER_DOCKER_EXTERNAL_DIFFHOST:SASL_PLAINTEXT + kafkaListenerSecurityProtocolMapSaslTls: CONTROLLER:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_DIFFHOST_SASL:SASL_SSL,LISTENER_DOCKER_EXTERNAL_LOCALHOST_SASL:SASL_PLAINTEXT + kafkaProcessRoles: "broker,controller" + kafkaNodeId: "1" + kafkaControllerQuorumVoters: "1@localhost:9093" + kafkaControllerListenerNames: "CONTROLLER" + kafkaListeners: "CONTROLLER://0.0.0.0:9093,LISTENER_DOCKER_EXTERNAL_LOCALHOST://0.0.0.0:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST://0.0.0.0:9092" kafkaLogCleanerEnable: "true" kafkaLogRetentionBytes: "10737418240" kafkaLogRetentionCheckIntervalMs: "60000" @@ -60,7 +65,7 @@ mini_runtime: kafkaOffsetsTopicReplicationFactor: "1" kafkaTransactionStateLogMinIsr: "1" kafkaTransactionStateLogReplicationFactor: "1" - kafkaZookeeperConnect: 127.0.0.1:2181 + kafkaClusterId: "c6a1b8e2-4f2a-4b2a-9c3f-1a2b3c4d5e6f" sslKeystoreLocation: "/etc/kafka/ssl/secrets/server.keystore.jks" sslKeystorePassword: "password" sslKeyPassword: "password" @@ -75,7 +80,7 @@ mini_runtime: useSasl: false image: repository: public.ecr.aws/aktosecurity/confluentinc-cp-kafka - tag: 7.9.4-1-ubi8 + tag: 8.1.0 resources: requests: cpu: 1.5 @@ -108,25 +113,6 @@ mini_runtime: type: ClusterIP annotations: service.beta.kubernetes.io/aws-load-balancer-internal: "true" - zoo1: - env: - kafkaOpts: -Dzookeeper.admin.enableServer=false - zookeeperClientPort: "2181" - zookeeperServerId: "1" - zookeeperServers: zoo1:2888:3888 - # SASL configuration for zookeeper - saslUsername: "zookeeper" - saslPassword: "" - image: - repository: public.ecr.aws/aktosecurity/confluentinc-cp-zookeeper - tag: 7.9.4-1-ubi8 - resources: - requests: - cpu: 1 - memory: "1Gi" - limits: - cpu: 1 - memory: "2Gi" keel: keel: diff --git a/charts/mini-testing/templates/deployment.yaml b/charts/mini-testing/templates/deployment.yaml index 58bc3a69..8213351a 100644 --- a/charts/mini-testing/templates/deployment.yaml +++ b/charts/mini-testing/templates/deployment.yaml @@ -156,23 +156,6 @@ spec: - containerPort: 3000 resources: {{- toYaml .Values.testing.aktoApiSecurityPuppeteerReplay.resources | nindent 10 }} {{ if eq .Values.testing.aktoApiSecurityTesting.env.newTestingEnabled "true" }} - - env: - - name: ZOOKEEPER_CLIENT_PORT - value: {{ quote .Values.testing.zoo1.env.zookeeperClientPort }} - - name: ZOOKEEPER_SERVERS - value: {{ quote .Values.testing.zoo1.env.zookeeperServers }} - - name: ZOOKEEPER_SERVER_ID - value: {{ quote .Values.testing.zoo1.env.zookeeperServerId }} - - name: KAFKA_OPTS - value: {{ quote .Values.testing.zoo1.env.kafkaOpts }} - - name: KUBERNETES_CLUSTER_DOMAIN - value: {{ quote .Values.kubernetesClusterDomain }} - image: {{ .Values.testing.zoo1.image.repository }}:{{ .Values.testing.zoo1.image.tag - | default .Chart.AppVersion }} - name: zoo1 - ports: - - containerPort: 2181 - resources: {{- toYaml .Values.testing.zoo1.resources | nindent 10 }} - env: - name: MY_POD_NAMESPACE valueFrom: @@ -190,6 +173,16 @@ spec: value: {{ quote .Values.testing.kafka1.env.kafkaInterBrokerListenerName }} - name: KAFKA_LISTENER_SECURITY_PROTOCOL_MAP value: {{ quote .Values.testing.kafka1.env.kafkaListenerSecurityProtocolMap }} + - name: KAFKA_PROCESS_ROLES + value: {{ quote .Values.testing.kafka1.env.kafkaProcessRoles }} + - name: KAFKA_NODE_ID + value: {{ quote .Values.testing.kafka1.env.kafkaNodeId }} + - name: KAFKA_CONTROLLER_QUORUM_VOTERS + value: {{ quote .Values.testing.kafka1.env.kafkaControllerQuorumVoters }} + - name: KAFKA_CONTROLLER_LISTENER_NAMES + value: {{ quote .Values.testing.kafka1.env.kafkaControllerListenerNames }} + - name: KAFKA_LISTENERS + value: {{ quote .Values.testing.kafka1.env.kafkaListeners }} - name: KAFKA_LOG_CLEANER_ENABLE value: {{ quote .Values.testing.kafka1.env.kafkaLogCleanerEnable }} - name: KAFKA_LOG_RETENTION_BYTES @@ -208,8 +201,8 @@ spec: - name: KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR value: {{ quote .Values.testing.kafka1.env.kafkaTransactionStateLogReplicationFactor }} - - name: KAFKA_ZOOKEEPER_CONNECT - value: {{ quote .Values.testing.kafka1.env.kafkaZookeeperConnect }} + - name: CLUSTER_ID + value: {{ quote .Values.testing.kafka1.env.kafkaClusterId }} - name: KUBERNETES_CLUSTER_DOMAIN value: {{ quote .Values.kubernetesClusterDomain }} image: {{ .Values.testing.kafka1.image.repository }}:{{ .Values.testing.kafka1.image.tag @@ -219,6 +212,7 @@ spec: - containerPort: 9092 - containerPort: 19092 - containerPort: 29092 + - containerPort: 9093 - containerPort: 9999 resources: {{- toYaml .Values.testing.kafka1.resources | nindent 10 }} {{end}} diff --git a/charts/mini-testing/values.yaml b/charts/mini-testing/values.yaml index 7557d697..52c78018 100644 --- a/charts/mini-testing/values.yaml +++ b/charts/mini-testing/values.yaml @@ -78,8 +78,12 @@ testing: kafkaCleanupPolicy: delete kafkaCreateTopics: akto.test.messages:1:1 kafkaInterBrokerListenerName: LISTENER_DOCKER_EXTERNAL_LOCALHOST - kafkaListenerSecurityProtocolMap: LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT, - LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT + kafkaListenerSecurityProtocolMap: CONTROLLER:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_LOCALHOST:PLAINTEXT,LISTENER_DOCKER_EXTERNAL_DIFFHOST:PLAINTEXT + kafkaProcessRoles: "broker,controller" + kafkaNodeId: "1" + kafkaControllerQuorumVoters: "1@localhost:9093" + kafkaControllerListenerNames: "CONTROLLER" + kafkaListeners: "CONTROLLER://0.0.0.0:9093,LISTENER_DOCKER_EXTERNAL_LOCALHOST://0.0.0.0:29092,LISTENER_DOCKER_EXTERNAL_DIFFHOST://0.0.0.0:9092" kafkaLogCleanerEnable: "true" kafkaLogRetentionBytes: "10737418240" kafkaLogRetentionCheckIntervalMs: "60000" @@ -88,10 +92,10 @@ testing: kafkaOffsetsTopicReplicationFactor: "1" kafkaTransactionStateLogMinIsr: "1" kafkaTransactionStateLogReplicationFactor: "1" - kafkaZookeeperConnect: 127.0.0.1:2181 + kafkaClusterId: "c6a1b8e2-4f2a-4b2a-9c3f-1a2b3c4d5e6f" image: repository: public.ecr.aws/aktosecurity/confluentinc-cp-kafka - tag: 7.8.0-3-ubi8 + tag: 8.1.0 resources: requests: cpu: 1 @@ -103,22 +107,6 @@ testing: - port: 9092 targetPort: 9092 type: ClusterIP - zoo1: - env: - kafkaOpts: -Dzookeeper.admin.enableServer=false - zookeeperClientPort: "2181" - zookeeperServerId: "1" - zookeeperServers: zoo1:2888:3888 - image: - repository: public.ecr.aws/aktosecurity/confluentinc-cp-zookeeper - tag: 7.8.0-3-ubi8 - resources: - requests: - cpu: 1 - memory: "2Gi" - limits: - cpu: 1 - memory: "2Gi" keel: keel: