KEYSTORE.JKS 存在失败 - 退出代码为 1 #662 - Confluence kafka

Question

我正在尝试将 ssl 配置为汇合的 kafka docker 平台，并在开始说时出现错误

日志：

命令 [/usr/local/bin/dub 路径 /etc/kafka/secrets/kafka.server.keystore.jks 存在] 失败！kafka_kafka-broker1_1_13d7835ad32d 退出，代码为 1

码头工人配置：

version:  '3'
services:
  zookeeper1:
    image: confluentinc/cp-zookeeper:5.1.0
    hostname: zookeeper1
    ports:
      - "2181:2181"
      - "2888:2888"
      - "3888:3888"
    environment:
      ZOOKEEPER_SERVER_ID: 1
      ZOOKEEPER_SERVERS:  0.0.0.0:2888:3888
      ZOOKEEPER_CLIENT_PORT: 2181
      ZOOKEEPER_TICK_TIME: 2000
    logging:  
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    volumes:
      - zookeeper-data:/var/lib/zookeeper/data
      - zookeeper-log:/var/lib/zookeeper/log
  kafka-broker1:
    image: confluentinc/cp-kafka:5.1.0
    hostname: kafka-broker1:
    ports:
      - "9092:9092"
      - "9093:9093"
    environment:
      KAFKA_LISTENERS: "PLAINTEXT://0.0.0.0:9092,SSL://0.0.0.0:9093"
      KAFKA_ADVERTISED_LISTENERS: "PLAINTEXT://kafkassl.com:9092,SSL://kafkassl.com:9093"
      KAFKA_ZOOKEEPER_CONNECT: zookeeper1:2181
      KAFKA_LOG4J_LOGGERS: "kafka.controller=INFO,kafka.producer.async.DefaultEventHandler=INFO,state.change.logger=INFO"
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 2
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "false"
      KAFKA_DELETE_TOPIC_ENABLE: "true"
      KAFKA_LOG_RETENTION_HOURS: 168
      KAFKA_OFFSETS_RETENTION_MINUTES: 43800
      KAFKA_SSL_KEYSTORE_FILENAME: kafka.server.keystore.jks
      KAFKA_SSL_TRUSTSTORE_LOCATION: /ssl/kafka.server.truststore.jks
      KAFKA_SSL_TRUSTSTORE_PASSWORD: pass
      KAFKA_SSL_KEYSTORE_LOCATION: /ssl/kafka.server.keystore.jks
      KAFKA_SSL_KEYSTORE_PASSWORD: pass
      KAFKA_SSL_KEY_PASSWORD: pass
    volumes:
      - kafka-data:/var/lib/kafka/data
      - /ssl:/etc/kafka/secrets

    logging:
      driver: "json-file"
      options:
        max-size: "10m"
        max-file: "3"
    depends_on:
      - zookeeper1
volumes:
  zookeeper-data:
  zookeeper-log:
  kafka-data: 

Answer 1

以下是启动具有 SSL 支持的 kafka docker-compose 的步骤（@Senthil 已经在他的评论中提供了一些指导）

• 在 docker-compose 目录中有一个所谓的 Secrets 目录，其中包含用于生成密钥库、信任库和 ssl 密码的 shell 脚本。进入 kafka 的 docker-compose 的根目录并运行此脚本，该脚本将生成所需的文件（例如./secrets/create-certs：）

• 将所有生成的文件复制到secrets目录中

• 将 Secrets 目录的卷从主机挂载到 dockerized 目录。将以下内容放在 docker-compose 文件的volumes部分

volumes:
  - ./secrets/:/etc/kafka/secrets

使用 docker-compose up 运行