docker - KEYSTORE.JKS 存在失败 - 退出代码 1 #662 - Confluent kafka

Question

我正在尝试配置 ssl 以融合 kafka docker 平台并在开始说时遇到错误

日志:

命令 [/usr/local/bin/dub 路径/etc/kafka/secrets/kafka.server.keystore.jks 存在] 失败! kafka_kafka-broker1_1_13d7835ad32d 以代码 1 退出

Docker 配置:

version:  '3'
services:
  zookeeper1:
    image: confluentinc/cp-zookeeper:5.1.0
    hostname: zookeeper1
    ports:
      - "2181:2181"
      - "2888:2888"
      - "3888:3888"
    environment:
      ZOOKEEPER_SERVER_ID: 1
      ZOOKEEPER_SERVERS:  0.0.0.0:2888:3888
      ZOOKEEPER_CLIENT_PORT: 2181
      ZOOKEEPER_TICK_TIME: 2000
    logging:  
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    volumes:
      - zookeeper-data:/var/lib/zookeeper/data
      - zookeeper-log:/var/lib/zookeeper/log
  kafka-broker1:
    image: confluentinc/cp-kafka:5.1.0
    hostname: kafka-broker1:
    ports:
      - "9092:9092"
      - "9093:9093"
    environment:
      KAFKA_LISTENERS: "PLAINTEXT://0.0.0.0:9092,SSL://0.0.0.0:9093"
      KAFKA_ADVERTISED_LISTENERS: "PLAINTEXT://kafkassl.com:9092,SSL://kafkassl.com:9093"
      KAFKA_ZOOKEEPER_CONNECT: zookeeper1:2181
      KAFKA_LOG4J_LOGGERS: "kafka.controller=INFO,kafka.producer.async.DefaultEventHandler=INFO,state.change.logger=INFO"
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 2
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "false"
      KAFKA_DELETE_TOPIC_ENABLE: "true"
      KAFKA_LOG_RETENTION_HOURS: 168
      KAFKA_OFFSETS_RETENTION_MINUTES: 43800
      KAFKA_SSL_KEYSTORE_FILENAME: kafka.server.keystore.jks
      KAFKA_SSL_TRUSTSTORE_LOCATION: /ssl/kafka.server.truststore.jks
      KAFKA_SSL_TRUSTSTORE_PASSWORD: pass
      KAFKA_SSL_KEYSTORE_LOCATION: /ssl/kafka.server.keystore.jks
      KAFKA_SSL_KEYSTORE_PASSWORD: pass
      KAFKA_SSL_KEY_PASSWORD: pass
    volumes:
      - kafka-data:/var/lib/kafka/data
      - /ssl:/etc/kafka/secrets

    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    depends_on:
      - zookeeper1
volumes:
  zookeeper-data:
  zookeeper-log:
  kafka-data: 

Answer 1

以下是启动支持 SSL 的 kafka docker-compose 的步骤(@Senthil 已经在他的评论中提供了一些指导)

• 在 docker-compose 目录中有一个所谓的 secrets 目录，其中包含用于生成 keystore 、信任库和 ssl 密码的 shell 脚本。进入 kafka 的 docker-compose 的根目录并运行将生成所需文件的脚本(例如:./secrets/create-certs)

• 将所有生成的文件复制到secrets目录

• 将 secrets 目录的卷从主机挂载到 dockerized 的主机。将以下内容放在卷部分的 docker-compose 文件中

volumes:
  - ./secrets/:/etc/kafka/secrets

使用 docker-compose up 运行