Migrate mini-runtime to Strimzi-managed Kafka

.github/workflows/test.yaml

@@ -0,0 +1,78 @@
+name: test
+
+on:
+  push:
+    branches-ignore:
+      - master
+    paths:
+      - 'charts/mini-runtime/**'
+  pull_request:
+    branches:
+      - master
+    paths:
+      - 'charts/mini-runtime/**'
+
+jobs:
+  lint-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - name: Install Helm
+        uses: azure/setup-helm@v3
+
+      - name: Add Strimzi Helm repo
+        run: helm repo add strimzi https://strimzi.io/charts/ && helm repo update
+
+      - name: Update chart dependencies
+        run: helm dependency update charts/mini-runtime
+
+      - name: Install helm-unittest plugin
+        run: helm plugin install https://github.com/helm-unittest/helm-unittest --version 1.0.3
+
+      - name: Lint (default values)
+        run: helm lint charts/mini-runtime
+
+      - name: Lint (SASL enabled)
+        run: |
+          helm lint charts/mini-runtime \
+            --set kafkaCluster.sasl.enabled=true \
+            --set kafkaCluster.sasl.password=secret
+
+      - name: Lint (TLS enabled)
+        run: helm lint charts/mini-runtime --set kafkaCluster.tls=true
+
+      - name: Lint (SASL + TLS)
+        run: |
+          helm lint charts/mini-runtime \
+            --set kafkaCluster.sasl.enabled=true \
+            --set kafkaCluster.sasl.password=secret \
+            --set kafkaCluster.tls=true
+
+      - name: Lint (external Kafka)
+        run: |
+          helm lint charts/mini-runtime \
+            --set kafkaCluster.enabled=false \
+            --set mini_runtime.useExternalKafka=true \
+            --set mini_runtime.externalKafka.brokerUrl=kafka1:9092
+
+      - name: Lint (external Kafka with SASL_SSL)
+        run: |
+          helm lint charts/mini-runtime \
+            --set kafkaCluster.enabled=false \
+            --set mini_runtime.useExternalKafka=true \
+            --set mini_runtime.externalKafka.brokerUrl=kafka1:9092 \
+            --set mini_runtime.externalKafka.username=user \
+            --set mini_runtime.externalKafka.password=pass \
+            --set mini_runtime.externalKafka.saslMechanism=SCRAM-SHA-256 \
+            --set mini_runtime.externalKafka.useSsl=true \
+            --set mini_runtime.externalKafka.securityProtocol=SASL_SSL
+
+      - name: Lint (port override)
+        run: helm lint charts/mini-runtime --set kafkaCluster.ports.plain=9094
+
+      - name: Run unit tests
+        run: helm unittest charts/mini-runtime

charts/akto-k8s-agent/templates/daemonset.yaml

@@ -1,4 +1,20 @@
 {{- if .Values.env.DEPLOY_DAEMONSET }}
+{{- $caSecretName := "" }}
+{{- if .Values.tls.enabled }}
+{{- if .Values.tls.autoDiscover }}
+{{- $caSecretName = printf "%s-cluster-ca-cert" .Values.tls.kafkaClusterName }}
+{{- else }}
+{{- $caSecretName = .Values.tls.caSecretName }}
+{{- end }}
+{{- end }}
+{{- $saslSecretName := "" }}
+{{- if .Values.sasl.enabled }}
+{{- if .Values.sasl.existingSecret }}
+{{- $saslSecretName = .Values.sasl.existingSecret }}
+{{- else if .Values.sasl.autoDiscover }}
+{{- $saslSecretName = printf "%s-sasl-credentials" .Values.sasl.kafkaClusterName }}
+{{- end }}
+{{- end }}
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -47,18 +63,63 @@ spec:
             - name: AKTO_INFRA_MIRRORING_MODE
               value: {{ .Values.env.AKTO_INFRA_MIRRORING_MODE | quote }}
             - name: AKTO_KAFKA_BROKER_MAL
-              value: {{ (.Values.env.AKTO_KAFKA_BROKER_MAL | default (printf "%s.%s.svc.cluster.local:9092" (default (printf "%s-mini-runtime" .Values.miniRuntimeReleaseName) .Values.miniRuntimeServiceName) .Release.Namespace)) | quote }}
+              {{- if and .Values.tls.enabled .Values.tls.autoDiscover }}
+              value: {{ printf "%s-kafka-bootstrap.%s.svc.cluster.local:%v" .Values.tls.kafkaClusterName .Release.Namespace .Values.tls.kafkaPort | quote }}
+              {{- else if and .Values.sasl.enabled .Values.sasl.autoDiscover }}
+              value: {{ printf "%s-kafka-bootstrap.%s.svc.cluster.local:%v" .Values.sasl.kafkaClusterName .Release.Namespace .Values.sasl.kafkaPort | quote }}
+              {{- else if .Values.env.AKTO_KAFKA_BROKER_MAL }}
+              value: {{ .Values.env.AKTO_KAFKA_BROKER_MAL | quote }}
+              {{- else }}
+              value: {{ printf "%s.%s.svc.cluster.local:9092" (default (printf "%s-mini-runtime" .Values.miniRuntimeReleaseName) .Values.miniRuntimeServiceName) .Release.Namespace | quote }}
+              {{- end }}
             - name: AKTO_MONGO_CONN
               value: {{ .Values.env.AKTO_MONGO_CONN | quote }}
             - name: IS_AUTH_IMPLEMENTED
-              value: {{ .Values.env.IS_AUTH_IMPLEMENTED | quote }}
+              value: {{ .Values.sasl.enabled | quote }}
+            {{- if .Values.sasl.enabled }}
+            {{- if $saslSecretName }}
             - name: KAFKA_USERNAME
-              value: {{ .Values.env.KAFKA_USERNAME | quote }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $saslSecretName | quote }}
+                  key: {{ .Values.sasl.usernameKey | quote }}
             - name: KAFKA_PASSWORD
-              value: {{ .Values.env.KAFKA_PASSWORD | quote }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $saslSecretName | quote }}
+                  key: {{ .Values.sasl.passwordKey | quote }}
+            {{- else if .Values.sasl.username }}
+            - name: KAFKA_USERNAME
+              value: {{ .Values.sasl.username | quote }}
+            - name: KAFKA_PASSWORD
+              value: {{ .Values.sasl.password | quote }}
+            {{- end }}
+            - name: AKTO_KAFKA_SASL_MECHANISM
+              value: {{ .Values.sasl.saslMechanism | quote }}
+            {{- end }}
             - name: AKTO_THREAT_ENABLED
               value: {{ .Values.env.AKTO_THREAT_ENABLED | quote }}
+            {{- if .Values.tls.enabled }}
+            - name: USE_TLS
+              value: "true"
+            - name: TLS_CA_CERT_PATH
+              value: {{ printf "%s/%s" .Values.tls.mountPath .Values.tls.caCertKey | quote }}
+            - name: INSECURE_SKIP_VERIFY
+              value: {{ .Values.tls.insecureSkipVerify | quote }}
+            {{- end }}
+          {{- if .Values.tls.enabled }}
+          volumeMounts:
+            - name: kafka-tls-ca
+              mountPath: {{ .Values.tls.mountPath | quote }}
+              readOnly: true
+          {{- end }}
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+      {{- if .Values.tls.enabled }}
+      volumes:
+        - name: kafka-tls-ca
+          secret:
+            secretName: {{ $caSecretName | quote }}
+      {{- end }}
 {{- end }}
 

charts/akto-k8s-agent/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: aktosecurity/mirror-api-logging
-  tag: k8s_agent
+  tag: strimzi-kafka-tcp
   pullPolicy: Always
 
 podAnnotations: {}
@@ -30,3 +30,32 @@ affinity: {}
 miniRuntimeServiceName: ""
 miniRuntimeReleaseName: "akto-mini-runtime"
 
+# SASL credentials — set existingSecret to reference a pre-existing Secret
+# (e.g. the "<clusterName>-sasl-credentials" Secret created by the mini-runtime chart)
+sasl:
+  enabled: true
+  autoDiscover: false              # derive secret from kafkaClusterName: "<kafkaClusterName>-sasl-credentials"
+  saslMechanism: ""  # don't change if using akto-kafka, it only supports 512.
+  kafkaClusterName: "akto-kafka"  # matches kafkaCluster.clusterName in mini-runtime chart
+  kafkaPort: 9092                 # Kafka port for SASL (plain listener port)
+  existingSecret: ""              # option 1: explicit secret name (overrides autoDiscover)
+  usernameKey: "username"         # key inside the Secret for the Kafka username
+  passwordKey: "password"         # key inside the Secret for the Kafka password
+  username: "test"                    # option 2: inline credentials
+  password: "test"
+
+# TLS configuration for Kafka connection
+# Mode 1 (default): auto-discover Strimzi CA cert secret
+#   Set tls.enabled=true — secret name derived as "<kafkaClusterName>-cluster-ca-cert"
+# Mode 2: bring your own secret
+#   Set tls.enabled=true, tls.autoDiscover=false, tls.caSecretName=<your-secret>
+tls:
+  enabled: false
+  autoDiscover: true              # derive CA secret from kafkaClusterName (Strimzi default)
+  kafkaClusterName: "akto-kafka"  # matches kafkaCluster.clusterName in mini-runtime chart
+  kafkaPort: 9093                 # TLS listener port — used when autoDiscover=true and AKTO_KAFKA_BROKER_MAL is not overridden
+  caSecretName: ""                # used when autoDiscover=false
+  caCertKey: "ca.crt"             # key inside the secret containing the CA cert
+  mountPath: "/etc/kafka/tls"
+  insecureSkipVerify: false
+