Skip to content

Commit 0697b8a

Browse files
AsmodayAsmoday
committed
feat(ZOOKEEPER-3824): allow SASL allowlist expansion during reconfig
1 parent 8363131 commit 0697b8a

22 files changed

Lines changed: 1266 additions & 31 deletions

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,3 +101,6 @@ zookeeper-client/zookeeper-client-c/generated/
101101

102102
# Python
103103
*.py[cod]
104+
105+
# docker
106+
/docker/kerberos-reconfig/zookeeper.tgz

‎docker/kerberos-reconfig/Dockerfile.kdc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
FROM debian:bookworm-slim
2+
3+
RUN apt-get update \
4+
&& DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
5+
krb5-kdc krb5-admin-server krb5-user \
6+
&& rm -rf /var/lib/apt/lists/*
7+
8+
COPY docker/kerberos-reconfig/kdc/krb5.conf /etc/krb5.conf
9+
COPY docker/kerberos-reconfig/kdc/kdc.conf /etc/krb5kdc/kdc.conf
10+
COPY docker/kerberos-reconfig/kdc/kadm5.acl /etc/krb5kdc/kadm5.acl
11+
COPY docker/kerberos-reconfig/kdc/init-kdc.sh /usr/local/bin/init-kdc.sh
12+
13+
RUN chmod +x /usr/local/bin/init-kdc.sh
14+
15+
EXPOSE 88/udp 88/tcp 749/tcp
16+
17+
ENTRYPOINT ["/usr/local/bin/init-kdc.sh"]

‎docker/kerberos-reconfig/Dockerfile.zk‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
FROM eclipse-temurin:11-jre
2+
3+
WORKDIR /opt
4+
5+
COPY docker/kerberos-reconfig/zookeeper.tgz /tmp/zookeeper.tgz
6+
RUN mkdir -p /opt/zookeeper \
7+
&& tar -xzf /tmp/zookeeper.tgz -C /opt \
8+
&& rm /tmp/zookeeper.tgz \
9+
&& ZK_DIR=$(find /opt -maxdepth 1 -type d -name "apache-zookeeper-*") \
10+
&& mv "$ZK_DIR" /opt/zookeeper
11+
12+
COPY docker/kerberos-reconfig/zk/jaas.conf.template /conf/jaas.conf.template
13+
COPY docker/kerberos-reconfig/zk/zk-entrypoint.sh /usr/local/bin/zk-entrypoint.sh
14+
15+
RUN chmod +x /usr/local/bin/zk-entrypoint.sh
16+
17+
ENV ZOO_CONF_DIR=/conf
18+
19+
EXPOSE 2181 2888 3888
20+
21+
ENTRYPOINT ["/usr/local/bin/zk-entrypoint.sh"]

‎docker/kerberos-reconfig/README.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Kerberos quorum SASL reconfig (Docker)
2+
3+
## Prereqs
4+
5+
Build a ZooKeeper binary tarball from this repo, then copy it to:
6+
7+
`docker/kerberos-reconfig/zookeeper.tgz`
8+
9+
Example build:
10+
11+
```bash
12+
mvn clean package -DskipTests
13+
cp zookeeper-assembly/target/apache-zookeeper-3.8.4-bin.tar.gz \
14+
docker/kerberos-reconfig/zookeeper.tgz
15+
```
16+
17+
## Build images
18+
19+
```bash
20+
docker compose -f docker/kerberos-reconfig/docker-compose.yml build
21+
```
22+
23+
## One-shot scripts
24+
25+
3 → 5 → 3 (authz allowlist refresh checks):
26+
27+
```bash
28+
bash docker/kerberos-reconfig/oneshot-3-5-3.sh
29+
```
30+
31+
3 → 1 → 3 (allowlist stress):
32+
33+
```bash
34+
bash docker/kerberos-reconfig/oneshot-3-1-3.sh
35+
```
36+
37+
Each script tears down the compose stack at the end (`docker compose down -v`).

‎docker/kerberos-reconfig/docker-compose.yml‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
services:
2+
kdc:
3+
build:
4+
context: ../..
5+
dockerfile: docker/kerberos-reconfig/Dockerfile.kdc
6+
hostname: kdc
7+
environment:
8+
REALM: EXAMPLE.COM
9+
ADMIN_PASS: adminpass
10+
HOSTS: "host1 host2 host3 host4 host5"
11+
volumes:
12+
- keytabs:/keytabs
13+
- kdc-data:/var/lib/krb5kdc
14+
- ./kdc/krb5.conf:/etc/krb5.conf:ro
15+
- ./kdc/kdc.conf:/etc/krb5kdc/kdc.conf:ro
16+
- ./kdc/kadm5.acl:/etc/krb5kdc/kadm5.acl:ro
17+
networks:
18+
zknet:
19+
aliases:
20+
- kdc
21+
ipv4_address: 172.28.0.10
22+
23+
zk1:
24+
build:
25+
context: ../..
26+
dockerfile: docker/kerberos-reconfig/Dockerfile.zk
27+
hostname: host1
28+
environment:
29+
MYID: "1"
30+
CLIENT_PORT: "2181"
31+
SUPER_DIGEST: "super:D/InIHSb7yEEbrWz8b9l71RjZJU="
32+
SERVER_LIST: |
33+
server.1=host1:2888:3888:participant
34+
server.2=host2:2888:3888:participant
35+
server.3=host3:2888:3888:participant
36+
volumes:
37+
- keytabs:/keytabs
38+
- ./kdc/krb5.conf:/etc/krb5.conf:ro
39+
- ./zk/jaas.conf.template:/conf/jaas.conf.template:ro
40+
- ./zk/logback.xml:/opt/zookeeper/apache-zookeeper-3.8.4-bin/conf/logback.xml:ro
41+
depends_on:
42+
- kdc
43+
extra_hosts:
44+
- "kdc:172.28.0.10"
45+
- "host1:172.28.0.11"
46+
- "host2:172.28.0.12"
47+
- "host3:172.28.0.13"
48+
- "host4:172.28.0.14"
49+
- "host5:172.28.0.15"
50+
networks:
51+
zknet:
52+
aliases:
53+
- host1
54+
ipv4_address: 172.28.0.11
55+
56+
zk2:
57+
build:
58+
context: ../..
59+
dockerfile: docker/kerberos-reconfig/Dockerfile.zk
60+
hostname: host2
61+
environment:
62+
MYID: "2"
63+
CLIENT_PORT: "2181"
64+
SUPER_DIGEST: "super:D/InIHSb7yEEbrWz8b9l71RjZJU="
65+
SERVER_LIST: |
66+
server.1=host1:2888:3888:participant
67+
server.2=host2:2888:3888:participant
68+
server.3=host3:2888:3888:participant
69+
volumes:
70+
- keytabs:/keytabs
71+
- ./kdc/krb5.conf:/etc/krb5.conf:ro
72+
- ./zk/jaas.conf.template:/conf/jaas.conf.template:ro
73+
- ./zk/logback.xml:/opt/zookeeper/apache-zookeeper-3.8.4-bin/conf/logback.xml:ro
74+
depends_on:
75+
- kdc
76+
extra_hosts:
77+
- "kdc:172.28.0.10"
78+
- "host1:172.28.0.11"
79+
- "host2:172.28.0.12"
80+
- "host3:172.28.0.13"
81+
- "host4:172.28.0.14"
82+
- "host5:172.28.0.15"
83+
networks:
84+
zknet:
85+
aliases:
86+
- host2
87+
ipv4_address: 172.28.0.12
88+
89+
zk3:
90+
build:
91+
context: ../..
92+
dockerfile: docker/kerberos-reconfig/Dockerfile.zk
93+
hostname: host3
94+
environment:
95+
MYID: "3"
96+
CLIENT_PORT: "2181"
97+
SUPER_DIGEST: "super:D/InIHSb7yEEbrWz8b9l71RjZJU="
98+
SERVER_LIST: |
99+
server.1=host1:2888:3888:participant
100+
server.2=host2:2888:3888:participant
101+
server.3=host3:2888:3888:participant
102+
volumes:
103+
- keytabs:/keytabs
104+
- ./kdc/krb5.conf:/etc/krb5.conf:ro
105+
- ./zk/jaas.conf.template:/conf/jaas.conf.template:ro
106+
- ./zk/logback.xml:/opt/zookeeper/apache-zookeeper-3.8.4-bin/conf/logback.xml:ro
107+
depends_on:
108+
- kdc
109+
extra_hosts:
110+
- "kdc:172.28.0.10"
111+
- "host1:172.28.0.11"
112+
- "host2:172.28.0.12"
113+
- "host3:172.28.0.13"
114+
- "host4:172.28.0.14"
115+
- "host5:172.28.0.15"
116+
networks:
117+
zknet:
118+
aliases:
119+
- host3
120+
ipv4_address: 172.28.0.13
121+
122+
zk4:
123+
build:
124+
context: ../..
125+
dockerfile: docker/kerberos-reconfig/Dockerfile.zk
126+
hostname: host4
127+
profiles: ["joiners"]
128+
environment:
129+
MYID: "4"
130+
CLIENT_PORT: "2181"
131+
SUPER_DIGEST: "super:D/InIHSb7yEEbrWz8b9l71RjZJU="
132+
SERVER_LIST: |
133+
server.1=host1:2888:3888:participant
134+
server.2=host2:2888:3888:participant
135+
server.3=host3:2888:3888:participant
136+
server.4=host4:2888:3888:participant
137+
server.5=host5:2888:3888:participant
138+
volumes:
139+
- keytabs:/keytabs
140+
- ./kdc/krb5.conf:/etc/krb5.conf:ro
141+
- ./zk/jaas.conf.template:/conf/jaas.conf.template:ro
142+
- ./zk/logback.xml:/opt/zookeeper/apache-zookeeper-3.8.4-bin/conf/logback.xml:ro
143+
depends_on:
144+
- kdc
145+
extra_hosts:
146+
- "kdc:172.28.0.10"
147+
- "host1:172.28.0.11"
148+
- "host2:172.28.0.12"
149+
- "host3:172.28.0.13"
150+
- "host4:172.28.0.14"
151+
- "host5:172.28.0.15"
152+
networks:
153+
zknet:
154+
aliases:
155+
- host4
156+
ipv4_address: 172.28.0.14
157+
158+
zk5:
159+
build:
160+
context: ../..
161+
dockerfile: docker/kerberos-reconfig/Dockerfile.zk
162+
hostname: host5
163+
profiles: ["joiners"]
164+
environment:
165+
MYID: "5"
166+
CLIENT_PORT: "2181"
167+
SUPER_DIGEST: "super:D/InIHSb7yEEbrWz8b9l71RjZJU="
168+
SERVER_LIST: |
169+
server.1=host1:2888:3888:participant
170+
server.2=host2:2888:3888:participant
171+
server.3=host3:2888:3888:participant
172+
server.4=host4:2888:3888:participant
173+
server.5=host5:2888:3888:participant
174+
volumes:
175+
- keytabs:/keytabs
176+
- ./kdc/krb5.conf:/etc/krb5.conf:ro
177+
- ./zk/jaas.conf.template:/conf/jaas.conf.template:ro
178+
- ./zk/logback.xml:/opt/zookeeper/apache-zookeeper-3.8.4-bin/conf/logback.xml:ro
179+
depends_on:
180+
- kdc
181+
extra_hosts:
182+
- "kdc:172.28.0.10"
183+
- "host1:172.28.0.11"
184+
- "host2:172.28.0.12"
185+
- "host3:172.28.0.13"
186+
- "host4:172.28.0.14"
187+
- "host5:172.28.0.15"
188+
networks:
189+
zknet:
190+
aliases:
191+
- host5
192+
ipv4_address: 172.28.0.15
193+
194+
volumes:
195+
keytabs: {}
196+
kdc-data: {}
197+
198+
networks:
199+
zknet:
200+
ipam:
201+
config:
202+
- subnet: 172.28.0.0/16

‎docker/kerberos-reconfig/kdc/init-kdc.sh‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
REALM="${REALM:-EXAMPLE.COM}"
5+
ADMIN_PASS="${ADMIN_PASS:-adminpass}"
6+
HOSTS="${HOSTS:-host1 host2 host3 host4 host5}"
7+
READY_FILE="/keytabs/READY"
8+
9+
if [ ! -f /var/lib/krb5kdc/principal ]; then
10+
echo -e "${ADMIN_PASS}\n${ADMIN_PASS}" | krb5_newrealm
11+
kadmin.local -q "addprinc -pw ${ADMIN_PASS} admin/admin@${REALM}"
12+
for h in ${HOSTS}; do
13+
kadmin.local -q "addprinc -randkey zkquorum/${h}@${REALM}"
14+
kadmin.local -q "addprinc -randkey learner/${h}@${REALM}"
15+
kadmin.local -q "ktadd -k /keytabs/${h}.keytab zkquorum/${h}@${REALM} learner/${h}@${REALM}"
16+
done
17+
chmod 600 /keytabs/*.keytab || true
18+
fi
19+
20+
touch "${READY_FILE}"
21+
22+
krb5kdc -n

‎docker/kerberos-reconfig/kdc/kadm5.acl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
*/admin@EXAMPLE.COM *

‎docker/kerberos-reconfig/kdc/kdc.conf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[kdcdefaults]
2+
kdc_ports = 88
3+
kdc_tcp_ports = 88
4+
5+
[realms]
6+
EXAMPLE.COM = {
7+
database_name = /var/lib/krb5kdc/principal
8+
admin_keytab = /etc/krb5kdc/kadm5.keytab
9+
acl_file = /etc/krb5kdc/kadm5.acl
10+
key_stash_file = /etc/krb5kdc/stash
11+
max_life = 24h
12+
max_renewable_life = 7d
13+
default_principal_flags = +preauth
14+
}

‎docker/kerberos-reconfig/kdc/krb5.conf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
[libdefaults]
2+
default_realm = EXAMPLE.COM
3+
dns_lookup_kdc = false
4+
dns_lookup_realm = false
5+
ticket_lifetime = 24h
6+
renew_lifetime = 7d
7+
forwardable = true
8+
udp_preference_limit = 1
9+
10+
[realms]
11+
EXAMPLE.COM = {
12+
kdc = kdc
13+
admin_server = kdc
14+
}
15+
16+
[domain_realm]
17+
.example.com = EXAMPLE.COM
18+
example.com = EXAMPLE.COM

0 commit comments

Comments
 (0)