当前位置：首页 > news >正文

docker-compose方式启动Kafka Sasl加密认证(无zk)

news 来源：原创 2025/6/18 13:02:21

首先参考文档，思考过程可以进行参考https://juejin.cn/post/7294556533932884020#heading-3

用的镜像是Bitnami，对SASL配置进行了简化，需要按照特定格式去配置jass验证
完整配置如下
镜像版本参考：https://hub.docker.com/r/bitnami/kafka/tags

KAFKA_KRAFT_CLUSTER_ID这里需要固定一个uuid

# 使用Linux工具生成Kafka格式的集群ID
UUID=$(uuidgen | tr -d '-')
echo $UUID | xxd -r -p | base64

启动以后宿主机kafka的目录结构如下

tree kafka/
kafka/
└── kafka
    ├── config
    └── data

我最终选择一个固定版本，防止某天重启后发生异常错误

version: '3'
services:
  kafka:
    image: bitnami/kafka:3.5.1
    container_name: kafka
    ports:
      - "9092:9092"
    volumes:
      - /data/kafka:/bitnami
    environment:
      # KRaft 模式配置
      - KAFKA_CFG_NODE_ID=1
      - KAFKA_CFG_PROCESS_ROLES=broker,controller
      - KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=1@kafka:9093
      
      # 监听配置
      - KAFKA_CFG_LISTENERS=SASL_PLAINTEXT://:9092,CONTROLLER://:9093
      - KAFKA_CFG_ADVERTISED_LISTENERS=SASL_PLAINTEXT://localhost:9092
      - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,SASL_PLAINTEXT:SASL_PLAINTEXT
      - KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER
      
      # 集群ID
      - KAFKA_KRAFT_CLUSTER_ID=4Zndq6u1TWqoaPt1AwHAKg==
      
      # 客户端用户配置
      - KAFKA_CLIENT_USERS=admin,ttx
      - KAFKA_CLIENT_PASSWORDS=TC4xaEvCSGaMuCZT,iri17ttx
      
      # controller 用户配置
      - KAFKA_CFG_SASL_MECHANISM_CONTROLLER_PROTOCOL=PLAIN
      - KAFKA_CONTROLLER_USER=admin
      - KAFKA_CONTROLLER_PASSWORD=TC4xaEvCSGaMuCZT
      
      # broker间通信用户配置
      - KAFKA_CFG_INTER_BROKER_LISTENER_NAME=SASL_PLAINTEXT
      - KAFKA_CFG_SASL_MECHANISM_INTER_BROKER_PROTOCOL=PLAIN
      - KAFKA_INTER_BROKER_USER=admin
      - KAFKA_INTER_BROKER_PASSWORD=TC4xaEvCSGaMuCZT
      
      # 其他配置
      - KAFKA_CFG_AUTO_CREATE_TOPICS_ENABLE=true
      - ALLOW_PLAINTEXT_LISTENER=yes
    restart: unless-stopped

mkdir: cannot create directory '/bitnami/kafka/config': Permission denied`

对容器的kafka用户进行授权

chown 1001:1001 /data/kafka/
 docker-compose down && docker-compose up -d

测试用户名密码连接

docker exec -it kafka sh

cat > /tmp/client.properties << EOF
security.protocol=SASL_PLAINTEXT
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="ttx" password="iri17ttx";
EOF

kafka-topics.sh --create --topic test-topic --bootstrap-server localhost:9092 --command-config /tmp/client.properties --partitions 1 --replication-factor 1
kafka-topics.sh --list --bootstrap-server localhost:9092 --command-config /tmp/client.properties