kafka-messaging-e2ee/examples/docker-compose.yaml at main · otto-de/kafka-messaging-e2ee · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
services:
  kafka:
    container_name: "example-1-kafka"
    image: apache/kafka:4.1.1
    ports:
      - 9097:9097
    healthcheck:
      test: /opt/kafka/bin/kafka-topics.sh --list --bootstrap-server localhost:9097
      interval: 3s
      timeout: 10s
      retries: 20
    environment:
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: broker,controller
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT,CONTROLLER:PLAINTEXT
      KAFKA_LISTENERS: PLAINTEXT://:9097,CONTROLLER://localhost:9093
      KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://localhost:9097
      KAFKA_CLIENT_LISTENER_NAME: PLAINTEXT
      KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
      KAFKA_CONTROLLER_QUORUM_VOTERS: 1@localhost:9093
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      #KAFKA_LOG4J_LOGGERS: 'kafka=DEBUG'

  kafka-init:
    container_name: "example-1-kafka-init"
    image: apache/kafka:4.1.1
    network_mode: host
    entrypoint: /bin/sh -c
    command: >
      "
        ## Create Kafka Topics
        /opt/kafka/bin/kafka-topics.sh --create --bootstrap-server localhost:9097 --topic teamOneTopicOne   --partitions 3 --replication-factor 1
        /opt/kafka/bin/kafka-topics.sh --create --bootstrap-server localhost:9097 --topic teamOneTopicThree --partitions 3 --replication-factor 1
        /opt/kafka/bin/kafka-topics.sh --create --bootstrap-server localhost:9097 --topic teamTwoTopicTwo   --partitions 3 --replication-factor 1
      "
    depends_on:
      - kafka

  vault:
    container_name: "example-1-vault"
    image: vault:1.13.3
    ports:
      - 8200:8200
    healthcheck:
      test: wget --quiet http://vault:8200/v1/sys/health -O /dev/null
      interval: 3s
      timeout: 20s
      retries: 20
    environment:
      - VAULT_DEV_ROOT_TOKEN_ID=dev-only-token
      - VAULT_ADDR=http://vault:8200

  vault-init:
    container_name: "example-1-vault-init"
    image: vault:1.13.3
    entrypoint: /bin/sh -c
    command: >
      "
        ## Init Vault
        ## config galapagos secrets to use Version 2
        vault secrets enable -version=2 -path=galapagos kv
        cd /tmp

        ## configure app-role for teamOne
        vault auth enable -path=approle_teamOne approle

        echo 'path \"auth/approle_teamOne/role/galapagos/secret-id\" {  capabilities = [\"update\"] }' > pol.txt
        echo 'path \"galapagos/data/local/galapagos_teamOne/teamOneTopicOne\" {  capabilities = [\"read\", \"list\", \"create\", \"update\", \"delete\"] }' >> pol.txt
        echo 'path \"galapagos/data/local/galapagos_teamOne/teamOneTopicThree\" {  capabilities = [\"read\", \"list\", \"create\", \"update\", \"delete\"] }' >> pol.txt
        vault policy write teamOne pol.txt
        rm pol.txt
        vault write auth/approle_teamOne/role/galapagos token_policies=teamOne

        ## get app-role secrets
        echo \"##########################################\"
        echo \"#######  Credentials for Team One  #######\"
        echo \"##########################################\"
        vault read auth/approle_teamOne/role/galapagos/role-id
        vault write -force auth/approle_teamOne/role/galapagos/secret-id

        ## create encryption key for "teamOneTopicOne" topic
        vault kv put -mount=galapagos local/galapagos_teamOne/teamOneTopicOne encryption_key=fYpQkfYkdgLBpbMAqfoHxzFvB03Liy4XpvWznmCgmSg%3D%0A
        ## create encryption key for "teamOneTopicThree" topic
        vault kv put -mount=galapagos local/galapagos_teamOne/teamOneTopicThree encryption_key=fYpQkfYkdgLBpbMAqfoHxzFvB03Liy4XpvWznmCgmSg%3D%0A

        ## configure app-role for teamTwo
        vault auth enable -path=approle_teamTwo approle

        echo 'path \"auth/approle_teamTwo/role/galapagos/secret-id\" {  capabilities = [\"update\"] }' > pol.txt
        echo 'path \"galapagos/data/local/galapagos_teamTwo/teamTwoTopicTwo\" {  capabilities = [\"read\", \"list\", \"create\", \"update\", \"delete\"] }' >> pol.txt
        echo 'path \"galapagos/data/local/galapagos_teamOne/teamOneTopicOne\" {  capabilities = [\"read\", \"list\"] }' >> pol.txt
        vault policy write teamTwo pol.txt
        rm pol.txt
        vault write auth/approle_teamTwo/role/galapagos token_policies=teamTwo

        ## get app-role secrets
        echo \"##########################################\"
        echo \"#######  Credentials for Team Two  #######\"
        echo \"##########################################\"
        vault read auth/approle_teamTwo/role/galapagos/role-id
        vault write -force auth/approle_teamTwo/role/galapagos/secret-id

        ## create encryption key for "teamTwoTopicTwo" topic
        vault kv put -mount=galapagos local/galapagos_teamTwo/teamTwoTopicTwo encryption_key=dZs4osqQyFR2CyMk%2FNu5gGfLx5i2Rp9kFSMcc7quNQQ%3D%0A
      "
    environment:
      - VAULT_TOKEN=dev-only-token
      - VAULT_ADDR=http://vault:8200
    depends_on:
      vault:
        condition: service_healthy