kafka manager 管理开启kerberos的kafka集群安装教程

本文已参与「新人创作礼」活动，一起开启掘金创作之路。

1、前言

通过之前的博客我们已经把 Zookeeper、kafka、Kerberos 都已经安装验证完毕。接下来我们将继续围绕Kafka生态周围对Kafka Manager 开启kerberos的安装以及验证。

2、添加Kafka Manager 认证主体

通过命令行添加kafkaManager的认证主体，并导出Key.tab文件


[root@henghe-01 /]# kadmin.local
Authenticating as principal root/admin@HADOOP.COM with password.
kadmin.local:
kadmin.local:  list_principals
K/M@HADOOP.COM
admin/admin@HADOOP.COM
kadmin/admin@HADOOP.COM
kadmin/changepw@HADOOP.COM
kadmin/henghe-01@HADOOP.COM
kafka/henghe-01@HADOOP.COM
kafka/henghe-02@HADOOP.COM
kafka/henghe-03@HADOOP.COM
kiprop/henghe-01@HADOOP.COM
krbtgt/HADOOP.COM@HADOOP.COM
test/test@HADOOP.COM
zookeeper/henghe-01@HADOOP.COM
zookeeper/henghe-02@HADOOP.COM
zookeeper/henghe-03@HADOOP.COM
zookeeper@HADOOP.COM
kadmin.local:  addprinc -randkey kafkaManager@HADOOP.COM
WARNING: no policy specified for kafkaManager@HADOOP.COM; defaulting to no policy
Principal "kafkaManager@HADOOP.COM" created.
kadmin.local:  xst -k kafkaManager.keytab kafkaManager@HADOOP.COM
Entry for principal kafkaManager@HADOOP.COM with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:kafkaManager.keytab.
Entry for principal kafkaManager@HADOOP.COM with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:kafkaManager.keytab.
kadmin.local:  exit
# 通过命令行查看认证主体
[root@henghe-01 /]# klist -kt kafkaManager.keytab
Keytab name: FILE:kafkaManager.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   2 2021-02-09T13:57:56 kafkaManager@HADOOP.COM
   2 2021-02-09T13:57:56 kafkaManager@HADOOP.COM
# 通过命令行测试认证主体
[root@henghe-01 /]# kinit -kt kafkaManager.keytab kafkaManager@HADOOP.COM
# 查看当前认证的主体
[root@henghe-01 /]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: kafkaManager@HADOOP.COM

Valid starting       Expires              Service principal
2021-02-09T14:00:41  2021-02-10T14:00:41  krbtgt/HADOOP.COM@HADOOP.COM
# 销毁刚刚测试认证的主体
[root@henghe-01 /]# kdestroy

3、配置kafka Manager 的kerberos

通过scp命令的方式将刚刚导出的kafkaManager.keytab文件复制到kafka Manager的conf目录下。

scp kafkaManager.keytab root@henghe-02:/data/kafka-manager/conf

登录安装节点：

创建jaas.conf文件代表登录到zk时认证配置

Client {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="/data/kafka-manager/conf/kafkaManager.keytab"
storeKey=true
useTicketCache=false
principal="kafkaManager@HADOOP.COM";
};
KafkaClient {
com.sun.security.auth.module.Krb5LoginModule required
useKeyTab=true
keyTab="/data/kafka-manager/conf/kafkaManager.keytab"
storeKey=true
useTicketCache=false
principal="kafkaManager@HADOOP.COM";
};

修改文件consumer.properties内容为

security.protocol=SASL_PLAINTEXT
sasl.kerberos.service.name=kafka
sasl.mechanism=GSSAPI

修改application.conf加载consumer.properties文件内容

kafka-manager.zkhosts="henghe-01:2181"
kafka-manager.consumer.properties.file=/data/kafka-manager/conf/consumer.properties

启动

nohup bin/kafka-manager -Dconfig.file=conf/application.conf -Djava.security.auth.login.config=/data/kafka/config/kafka_server_jaas.conf &

5.查看日志

通过日志我们可以看到权限认证主体通过认证，并且可以看到我们配置的consumer的参数也已经生效。在这里插入图片描述

登录成功