docker-compose方式启动Kafka Sasl加密认证(无zk)

首先参考文档，思考过程可以进行参考https://juejin.cn/post/7294556533932884020#heading-3

用的镜像是Bitnami，对SASL配置进行了简化，需要按照特定格式去配置jass验证
完整配置如下
镜像版本参考：https://hub.docker.com/r/bitnami/kafka/tags

KAFKA_KRAFT_CLUSTER_ID这里需要固定一个uuid

# 使用Linux工具生成Kafka格式的集群ID
UUID=$(uuidgen | tr -d '-')
echo $UUID | xxd -r -p | base64

启动以后宿主机kafka的目录结构如下

tree kafka/
kafka/
└── kafka├── config└── data

我最终选择一个固定版本，防止某天重启后发生异常错误

version: '3'
services:kafka:image: bitnami/kafka:3.5.1container_name: kafkaports:- "9092:9092"volumes:- /data/kafka:/bitnamienvironment:# KRaft 模式配置- KAFKA_CFG_NODE_ID=1- KAFKA_CFG_PROCESS_ROLES=broker,controller- KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=1@kafka:9093# 监听配置- KAFKA_CFG_LISTENERS=SASL_PLAINTEXT://:9092,CONTROLLER://:9093- KAFKA_CFG_ADVERTISED_LISTENERS=SASL_PLAINTEXT://localhost:9092- KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,SASL_PLAINTEXT:SASL_PLAINTEXT- KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER# 集群ID- KAFKA_KRAFT_CLUSTER_ID=4Zndq6u1TWqoaPt1AwHAKg==# 客户端用户配置,密码自定义- KAFKA_CLIENT_USERS=admin,tx- KAFKA_CLIENT_PASSWORDS=TC4xaEvCMuCZT,iri17tx# controller 用户配置- KAFKA_CFG_SASL_MECHANISM_CONTROLLER_PROTOCOL=PLAIN- KAFKA_CONTROLLER_USER=admin- KAFKA_CONTROLLER_PASSWORD=TC4xaEGaMuCZT# broker间通信用户配置- KAFKA_CFG_INTER_BROKER_LISTENER_NAME=SASL_PLAINTEXT- KAFKA_CFG_SASL_MECHANISM_INTER_BROKER_PROTOCOL=PLAIN- KAFKA_INTER_BROKER_USER=admin- KAFKA_INTER_BROKER_PASSWORD=TC4xaEGaMuCZT# 其他配置- KAFKA_CFG_AUTO_CREATE_TOPICS_ENABLE=true- ALLOW_PLAINTEXT_LISTENER=yesrestart: unless-stopped

mkdir: cannot create directory '/bitnami/kafka/config': Permission denied`

对容器的kafka用户进行授权

chown 1001:1001 /data/kafka/docker-compose down && docker-compose up -d

测试用户名密码连接

docker exec -it kafka shcat > /tmp/client.properties << EOF
security.protocol=SASL_PLAINTEXT
sasl.mechanism=PLAIN
sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required username="ttx" password="iri17ttx";
EOFkafka-topics.sh --create --topic test-topic --bootstrap-server localhost:9092 --command-config /tmp/client.properties --partitions 1 --replication-factor 1
kafka-topics.sh --list --bootstrap-server localhost:9092 --command-config /tmp/client.properties

如果客户端需要配置代理访问kafka，那么就修改这行为代理的地址

- KAFKA_CFG_ADVERTISED_LISTENERS=SASL_PLAINTEXT://Proxy_IP:9092