Added support for authenticating with SASL-SCRAM: (#5076)

* Added support for authenticating with SASL-SCRAM:
 - added secrets file for kafka and zookeeper auth
 - updated values.yaml with config for sasl-scram
 - add config-map for jaas file to use for java authentication
 - added KAFKA_OPTS environment variable for specifying location of jaas
 file
 - added init container to substitute secrets into jaas file before
 application startup
 - bumped minor version as this is adding a new feature

* modifications based on pull requesrt feedback:
- implemented allowing the user to specify their own k8s secret
- changed kafkaOpts to schemaRegistryOpts
- cleaned up whitespace
- removed redundant range loop

* bumping minor version as this is adding a new feature

incubator/schema-registry/Chart.yaml

@@ -1,6 +1,6 @@
 name: schema-registry
 home: https://docs.confluent.io/current/schema-registry/docs/index.html
-version: 0.2.0
+version: 0.3.0
 appVersion: 4.0.0
 keywords:
   - confluent

incubator/schema-registry/README.md

@@ -66,6 +66,16 @@ The following table lists the configurable parameters of the SchemaRegistry char
 | `imagePullPolicy` | Image Pull Policy | `IfNotPresent` |
 | `replicaCount` | The number of `SchemaRegistry` Pods in the Deployment | `1` |
 | `configurationOverrides` | `SchemaRegistry` [configuration setting](https://github.com/confluentinc/schema-registry/blob/master/docs/config.rst#configuration-options) overrides in the dictionary format `setting.name: value` | `{}` |
+| `kafkaOpts` | Additional Java arguments to pass to Kafka. | ` ` |
+| `sasl.configPath` | where to store config for sasl configurations | `/etc/kafka-config` |
+| `sasl.scram.enabled` | whether sasl-scam is enabled | `false` |
+| `sasl.scram.init.image` | which image to use for initializing sasl scram | `confluentinc/cp-schema-registry` |
+| `sasl.scram.init.imageTag` | which version/tag to use for sasl scram init | `4.0.0` |
+| `sasl.scram.init.imagePullPolicy` | the sasl scram init pull policy | `IfNotPresent` |
+| `sasl.scram.clientUser` | the sasl scram user to use to authenticate to kafka | `kafka-client` |
+| `sasl.scram.clientPassword` | the sasl scram password to use to authenticate to kafka | `kafka-password` |
+| `sasl.scram.zookeeperClientUser` | the sasl scram user to use to authenticate to zookeeper | `zookeper-client` |
+| `sasl.scram.zookeeperClientPassword` | the sasl scram password to use to authenticate to zookeeper | `zookeper-password` |
 | `resources` | CPU/Memory resource requests/limits | `{}` |
 | `servicePort` | The port on which the SchemaRegistry server will be exposed. | `8081` |
 | `overrideGroupId` | Group ID defaults to using Release Name so each release is its own Schema Registry worker group, it can be overridden | `{- .Release.Name -}}` |

incubator/schema-registry/templates/deployment.yaml

@@ -15,6 +15,48 @@ spec:
         app: {{ template "schema-registry.name" . }}
         release: {{ .Release.Name }}
     spec:
+    {{- if .Values.sasl.scram.enabled }}
+      initContainers:
+      ## ref: https://github.com/Yolean/kubernetes-kafka/blob/master/kafka/50kafka.yml
+      - name: init-sasl
+        image: "{{ .Values.sasl.scram.init.image }}:{{ .Values.sasl.scram.init.imageTag }}"
+        imagePullPolicy: "{{ .Values.sasl.scram.init.imagePullPolicy }}"
+        command:
+          - sh
+          - -euc
+          - |
+            sed "s/\$SCRAM_CLIENT_USER/${SCRAM_CLIENT_USER}/g; s/\$SCRAM_CLIENT_PASSWORD/${SCRAM_CLIENT_PASSWORD}/g; s/\$ZOOKEEPER_CLIENT_USER/${ZOOKEEPER_CLIENT_USER}/g; s/\$ZOOKEEPER_CLIENT_PASSWORD/${ZOOKEEPER_CLIENT_PASSWORD}/g;" /tmp/kafka-template/kafka_client_jaas.conf > /etc/kafka-config/kafka_client_jaas.conf
+        env:
+          - name: ZOOKEEPER_CLIENT_USER
+            value: {{ .Values.sasl.scram.zookeeperClientUser }}
+          - name: ZOOKEEPER_CLIENT_PASSWORD
+            {{- if (hasKey .Values.sasl.scram "useExistingSecret") }}
+            valueFrom:
+{{ toYaml .Values.sasl.scram.useExistingSecret.zookeeperClientPassword | indent 14 -}}
+            {{- else }}
+            valueFrom:
+              secretKeyRef:
+                name: {{ template "schema-registry.fullname" . }}-sasl-scram-secret
+                key: zookeeper-client-password
+            {{- end }}
+          - name: SCRAM_CLIENT_USER
+            value: {{ .Values.sasl.scram.clientUser }}
+          - name: SCRAM_CLIENT_PASSWORD
+            {{- if (hasKey .Values.sasl.scram "useExistingSecret") }}
+            valueFrom: 
+{{ toYaml .Values.sasl.scram.useExistingSecret.clientPassword | indent 14 -}}
+            {{- else }}
+            valueFrom:
+              secretKeyRef:
+                name: {{ template "schema-registry.fullname" . }}-sasl-scram-secret
+                key: scram-client-password
+            {{- end }}
+        volumeMounts:
+        - name: jaastemplate
+          mountPath: "/tmp/kafka-template"
+        - name: jaasconfig
+          mountPath: {{ .Values.sasl.configPath | quote }}
+    {{- end }}
       containers:
         - name: {{ .Chart.Name }}
           image: "{{ .Values.image }}:{{ .Values.imageTag }}"
@@ -48,5 +90,26 @@ spec:
           - name: SCHEMA_REGISTRY_{{ $configName | replace "." "_" | upper }}
             value: {{ $configValue }}
           {{ end }}
+          {{- if .Values.schemaRegistryOpts }}
+          # The pre-flight checks use KAFKA_OPTS instead of SCHEMA_REGISTRY_OPTS.
+          - name: KAFKA_OPTS
+            value: "{{ .Values.schemaRegistryOpts }}"
+          - name: SCHEMA_REGISTRY_OPTS
+            value: "{{ .Values.schemaRegistryOpts }}"
+          {{- end }}
           resources:
 {{ toYaml .Values.resources | indent 12 }}
+          volumeMounts:
+          {{- if .Values.sasl.scram.enabled }}
+          - name: jaasconfig
+            mountPath: {{ .Values.sasl.configPath | quote }}
+          {{- end }}
+      volumes:
+      {{- if .Values.sasl.scram.enabled }}
+      - name: jaasconfig
+        emptyDir: { medium: "Memory" }
+      - name: jaastemplate
+        configMap:
+          name: {{ template "schema-registry.fullname" . }}
+      {{- end }}
+          

incubator/schema-registry/templates/sasl-scram-config-map.yaml

@@ -0,0 +1,27 @@
+{{ if .Values.sasl.scram.enabled -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "schema-registry.fullname" . }}
+  labels:
+    app: {{ include "schema-registry.name" . | quote }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: {{ .Release.Name | quote }}
+    heritage: {{ .Release.Service | quote }}
+
+data:
+  kafka_client_jaas.conf: |-
+    // Info for Schema Registry to connect to Zookeeper
+    Client {
+        org.apache.zookeeper.server.auth.DigestLoginModule required
+        username="$ZOOKEEPER_CLIENT_USER"
+        password="$ZOOKEEPER_CLIENT_PASSWORD";
+    };
+
+    // Info for third-party clients to connect to Kafka
+    KafkaClient {
+        org.apache.kafka.common.security.scram.ScramLoginModule required
+        username="$SCRAM_CLIENT_USER"
+        password="$SCRAM_CLIENT_PASSWORD";
+    };
+{{- end }}

incubator/schema-registry/templates/sasl-scram-secret.yaml

@@ -0,0 +1,15 @@
+{{-  if and .Values.sasl.scram.enabled (not (hasKey .Values.sasl.scram "useExistingSecret")) -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ template "schema-registry.fullname" . }}-sasl-scram-secret
+  labels:
+    app: {{ template "schema-registry.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+type: Opaque
+data:
+  scram-client-password: {{ .Values.sasl.scram.clientPassword | b64enc }}
+  zookeeper-client-password: {{ .Values.sasl.scram.zookeeperClientPassword | b64enc }}
+{{- end -}}

incubator/schema-registry/values.yaml

@@ -44,6 +44,36 @@ servicePort: 8081
 ## Charts uses Kafka Coordinator Master Election: https://docs.confluent.io/current/schema-registry/docs/design.html#kafka-coordinator-master-election
 kafkaStore:
   overrideBootstrapServers: ""
+## Additional Java arguments to pass to Kafka.
+# schemaRegistryOpts: -Dfoo=bar
+
+# Options for connecting to SASL kafka brokers
+sasl:
+  configPath: "/etc/kafka-config"
+  scram:
+    enabled: false
+    init:
+      image: "confluentinc/cp-schema-registry"
+      imageTag: "4.0.0"
+      imagePullPolicy: "IfNotPresent"
+    clientUser: "kafka-client"
+    zookeeperClientUser: "zookeeper-client"
+    # Passwords can be either provided here or pulled from an existing k8s secret.
+    # If user wants to specify the password here:
+    clientPassword: "client-password"
+    zookeeperClientPassword: "zookeeper-client-password"
+    # If user has an existing k8s secret they would like to use instead of generating them:
+    # useExistingSecret:
+    #   # Where to find the schema registry user secret
+    #   clientPassword:
+    #     secretKeyRef:
+    #       name: "schema-reg-secret"
+    #       key: "client-password"
+    #   # Where to find the zookeeper user secret
+    #   zookeeperClientPassword:
+    #     secretKeyRef:
+    #       name: "zookeeper-secret"
+    #       key: "zokeeper-client-password"
 
 ## Kafka Settings
 kafka: