NotificationsYou must be signed in to change notification settings
Fork889
Star6.1k

Enable support for aws eks rbac and aws iam msk#287

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Open

creed123 wants to merge12 commits intoobsidiandynamics:master

base:master

Choose a base branch

fromcreed123:master

Open

Enable support for aws eks rbac and aws iam msk#287

creed123 wants to merge12 commits intoobsidiandynamics:masterfromcreed123:master

Conversation

Copy link

creed123 commentedJun 15, 2021•
edited
Loading

This pull request aims to:

Enable kafkadrop ui running as a pod in an aws eks cluster to connect to iam authenicated aws msk. It makes use of iam roles scoped to a service-account to generate temporary credentials to connect to an iam authenticated msk. More on this can be found here:
https://docs.amazonaws.cn/en_us/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html
https://aws.amazon.com/blogs/big-data/securing-apache-kafka-is-easy-and-familiar-with-iam-access-control-for-amazon-msk/

Additional environment variables need to be specified:
--KAFKA_IAM_ENABLED=true
--KAFKA_SASL_MECHANISM=AWS_MSK_IAM
--KAFKA_SECURITY_PROTOCOL=SASL_SSL
--KAFKA_JAAS_CONFIG='software.amazon.msk.auth.iam.IAMLoginModule;'
--KAFKA_IS_SECURED=true

Harshil Noriand others added11 commits

June 15, 2021 11:49

Added support for iam enabled msk using custom role attached to k8s pod

e4496fc

Dockerfile added

24d2a53

Renamed Dockerfile

ed63e4c

Removed unwanted client.properties. Additional formatting changes

2a979d7

Additional formatting changes

98f2206

Pom changes

a018aa0

Updated dockerfile

93bd4a9

Updated pom properties.

041a47d

Updated yml with is secured

1360e6b

Updated yml with is secured

e0788a6

Updated yml with updated properties file

bc78e82

creed123 changed the title~~Added support for aws msk iam using oidc identity provider authentication~~Enable kafkadrop ui running within aws eks cluster to connect to iam authenticated msk

Jun 15, 2021

creed123 changed the title~~Enable kafkadrop ui running within aws eks cluster to connect to iam authenticated msk~~Enable support for aws eks rbac and aws iam msk

Jun 15, 2021

creed123 mentioned this pull request

Jun 15, 2021

Kafdrop UI has issue using IAM access control to address encryption,authentication and authorisation#283

Closed

Added warn log

77e97a2

Copy link

fabioformosa commentedJun 16, 2021

What are the differences respect to this other PR to address the same target?#275

Have you pushed the docker image of your forked project in dockerhub?

Copy link

fabioformosa commentedJun 16, 2021

Using your PR, I get

Caused by: java.lang.IllegalArgumentException: Login module control flag not specified in JAAS config at org.apache.kafka.common.security.JaasConfig.parseAppConfigurationEntry(JaasConfig.java:110)at org.apache.kafka.common.security.JaasConfig.<init>(JaasConfig.java:63)at org.apache.kafka.common.security.JaasContext.load(JaasContext.java:90)at org.apache.kafka.common.security.JaasContext.loadClientContext(JaasContext.java:84)at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:134) at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:73)at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:105)at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:740)

any idea?

Copy link

Author

creed123 commentedJun 17, 2021

Using your PR, I get

Caused by: java.lang.IllegalArgumentException: Login module control flag not specified in JAAS config at org.apache.kafka.common.security.JaasConfig.parseAppConfigurationEntry(JaasConfig.java:110)at org.apache.kafka.common.security.JaasConfig.<init>(JaasConfig.java:63)at org.apache.kafka.common.security.JaasContext.load(JaasContext.java:90)at org.apache.kafka.common.security.JaasContext.loadClientContext(JaasContext.java:84)at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:134) at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:73)at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:105)at org.apache.kafka.clients.consumer.KafkaConsumer.<init>(KafkaConsumer.java:740)

any idea?

@fabioformosa We need to specify a semi colon at the end of the
--KAFKA_JAAS_CONFIG='software.amazon.msk.auth.iam.IAMLoginModule;'
Can check after making the change?

Copy link

Author

creed123 commentedJun 17, 2021

What are the differences respect to this other PR to address the same target?#275
Have you pushed the docker image of your forked project in dockerhub?

This MR aims to use the role scoped to a service account for a pod in an eks cluster if such a role exists.#275 by default would use the role assigned to an ec2 instance.

Copy link

fabioformosa commentedJun 18, 2021

@fabioformosa We need to specify a semi colon at the end of the
--KAFKA_JAAS_CONFIG='software.amazon.msk.auth.iam.IAMLoginModule;'
Can check after making the change?

@creed123 Do you mean maybesoftware.amazon.msk.auth.iam.IAMLoginModule required; ?

Yes, I've tried. It solves but now I get:

ERROR 1 [| kafdrop-admin] o.a.k.c.NetworkClient: [AdminClient clientId=kafdrop-admin] Connection to node (b-2.xxx.eu-south-1.amazonaws.com/xxxx:9098) failed authentication due to: Access deniedWARN 1 [| kafdrop-admin] o.a.k.c.a.i.AdminMetadataManager : [AdminClient clientId=kafdrop-admin] Metadata update failed due to authentication error org.apache.kafka.common.errors.SaslAuthenticationException: Access denied

My eks automatically created a IAM Role, I gave fullAdminAccess to this Role to try to solve. Same error.

In your view, what can it be the cause?

Copy link

Author

creed123 commentedJun 25, 2021

@fabioformosa We need to specify a semi colon at the end of the
--KAFKA_JAAS_CONFIG='software.amazon.msk.auth.iam.IAMLoginModule;'
Can check after making the change?
@creed123 Do you mean maybesoftware.amazon.msk.auth.iam.IAMLoginModule required; ?
Yes, I've tried. It solves but now I get:
ERROR 1 [| kafdrop-admin] o.a.k.c.NetworkClient: [AdminClient clientId=kafdrop-admin] Connection to node (b-2.xxx.eu-south-1.amazonaws.com/xxxx:9098) failed authentication due to: Access deniedWARN 1 [| kafdrop-admin] o.a.k.c.a.i.AdminMetadataManager : [AdminClient clientId=kafdrop-admin] Metadata update failed due to authentication error org.apache.kafka.common.errors.SaslAuthenticationException: Access denied
My eks automatically created a IAM Role, I gave fullAdminAccess to this Role to try to solve. Same error.
In your view, what can it be the cause?

@fabioformosa Can you check if the role attached to your ec2 instance has the correct permissions?

Copy link

yortch commentedJul 28, 2021

In case it helps, I verified this works from OpenShift (Kubernetes) cluster using IRSA (https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html). The only additional change I had to make was to provideAWS_REGION as an environment variable for AWS STS (Security Token Service) to work. I do believe this could work just with thepom.xml changes added to this pull request. For convenience I published my image to quay.io:https://quay.io/yortch/kafdrop and this is how I built it:

git clone https://github.com/creed123/kafdrop.gitcd kafdropmvn clean packagemvn assembly:single docker:builddocker run -d --rm obsidiandynamics/kafdrop:3.28.0-SNAPSHOTdocker login quay.io#provide quay.io credentialsdocker ps -l #get container ID and replace it belowdocker commit <container_id> quay.io/yortch/kafdrop:3.28.0-SNAPSHOTdocker push quay.io/yortch/kafdrop:3.28.0-SNAPSHOT#subsequently made quay.io repository public

Copy link

tooptoop4 commentedOct 27, 2021

gentle ping

Copy link

mfinger-incontact commentedMay 24, 2022

Gentle ping X2

Copy link

kirkokada commentedMay 31, 2022

gentle ping x3

Copy link

Collaborator

davideicardi commentedJun 1, 2022

I will be happy to merge this PR, but someone need to resolve the conflicts and review it.

Copy link

mfinger-incontact commentedJun 30, 2022

I will be happy to merge this PR, but someone need to resolve the conflicts and review it. <

I'm happy to help out with the conflicts, but I guess I need to become a contributor over here.

Copy link

Collaborator

davideicardi commentedJun 30, 2022

I will be happy to merge this PR, but someone need to resolve the conflicts and review it. <
I'm happy to help out with the conflicts, but I guess I need to become a contributor over here.

@mfinger-incontact
I think it is better to just fork the repository (or this branch) and apply the same changes, resolve conflicts then create a new PullRequest