Examples with OpenSslCertManager io.strimzi.certs.OpenSslCertManager used on opensource projects

Example 6 with OpenSslCertManager

use of io.strimzi.certs.OpenSslCertManager in project strimzi-kafka-operator by strimzi.

the class Main method run.

static Future<String> run(Vertx vertx, KubernetesClient client, AdminClientProvider adminClientProvider, UserOperatorConfig config) {
    Util.printEnvInfo();
    String dnsCacheTtl = System.getenv("STRIMZI_DNS_CACHE_TTL") == null ? "30" : System.getenv("STRIMZI_DNS_CACHE_TTL");
    Security.setProperty("networkaddress.cache.ttl", dnsCacheTtl);
    OpenSslCertManager certManager = new OpenSslCertManager();
    SecretOperator secretOperations = new SecretOperator(vertx, client);
    CrdOperator<KubernetesClient, KafkaUser, KafkaUserList> crdOperations = new CrdOperator<>(vertx, client, KafkaUser.class, KafkaUserList.class, KafkaUser.RESOURCE_KIND);
    return createAdminClient(adminClientProvider, config, secretOperations).compose(adminClient -> {
        SimpleAclOperator aclOperations = new SimpleAclOperator(vertx, adminClient);
        ScramCredentialsOperator scramCredentialsOperator = new ScramCredentialsOperator(vertx, adminClient);
        QuotasOperator quotasOperator = new QuotasOperator(vertx, adminClient);
        KafkaUserOperator kafkaUserOperations = new KafkaUserOperator(vertx, certManager, crdOperations, secretOperations, scramCredentialsOperator, quotasOperator, aclOperations, config);
        Promise<String> promise = Promise.promise();
        UserOperator operator = new UserOperator(config.getNamespace(), config, client, kafkaUserOperations);
        vertx.deployVerticle(operator, res -> {
            if (res.succeeded()) {
                LOGGER.info("User Operator verticle started in namespace {}", config.getNamespace());
            } else {
                LOGGER.error("User Operator verticle in namespace {} failed to start", config.getNamespace(), res.cause());
                System.exit(1);
            }
            promise.handle(res);
        });
        return promise.future();
    });
}

Example 7 with OpenSslCertManager

use of io.strimzi.certs.OpenSslCertManager in project strimzi-kafka-operator by strimzi.

the class Main method run.

static CompositeFuture run(Vertx vertx, KubernetesClient client, PlatformFeaturesAvailability pfa, ClusterOperatorConfig config) {
    Util.printEnvInfo();
    ResourceOperatorSupplier resourceOperatorSupplier = new ResourceOperatorSupplier(vertx, client, pfa, config.getOperationTimeoutMs());
    KafkaAssemblyOperator kafkaClusterOperations = null;
    KafkaConnectAssemblyOperator kafkaConnectClusterOperations = null;
    KafkaMirrorMaker2AssemblyOperator kafkaMirrorMaker2AssemblyOperator = null;
    KafkaMirrorMakerAssemblyOperator kafkaMirrorMakerAssemblyOperator = null;
    KafkaBridgeAssemblyOperator kafkaBridgeAssemblyOperator = null;
    KafkaRebalanceAssemblyOperator kafkaRebalanceAssemblyOperator = null;
    if (!config.isPodSetReconciliationOnly()) {
        OpenSslCertManager certManager = new OpenSslCertManager();
        PasswordGenerator passwordGenerator = new PasswordGenerator(12, "abcdefghijklmnopqrstuvwxyz" + "ABCDEFGHIJKLMNOPQRSTUVWXYZ", "abcdefghijklmnopqrstuvwxyz" + "ABCDEFGHIJKLMNOPQRSTUVWXYZ" + "0123456789");
        kafkaClusterOperations = new KafkaAssemblyOperator(vertx, pfa, certManager, passwordGenerator, resourceOperatorSupplier, config);
        kafkaConnectClusterOperations = new KafkaConnectAssemblyOperator(vertx, pfa, resourceOperatorSupplier, config);
        kafkaMirrorMaker2AssemblyOperator = new KafkaMirrorMaker2AssemblyOperator(vertx, pfa, resourceOperatorSupplier, config);
        kafkaMirrorMakerAssemblyOperator = new KafkaMirrorMakerAssemblyOperator(vertx, pfa, certManager, passwordGenerator, resourceOperatorSupplier, config);
        kafkaBridgeAssemblyOperator = new KafkaBridgeAssemblyOperator(vertx, pfa, certManager, passwordGenerator, resourceOperatorSupplier, config);
        kafkaRebalanceAssemblyOperator = new KafkaRebalanceAssemblyOperator(vertx, resourceOperatorSupplier, config);
    }
    @SuppressWarnings({ "rawtypes" }) List<Future> futures = new ArrayList<>(config.getNamespaces().size());
    for (String namespace : config.getNamespaces()) {
        Promise<String> prom = Promise.promise();
        futures.add(prom.future());
        ClusterOperator operator = new ClusterOperator(namespace, config, client, kafkaClusterOperations, kafkaConnectClusterOperations, kafkaMirrorMakerAssemblyOperator, kafkaMirrorMaker2AssemblyOperator, kafkaBridgeAssemblyOperator, kafkaRebalanceAssemblyOperator, resourceOperatorSupplier);
        vertx.deployVerticle(operator, res -> {
            if (res.succeeded()) {
                if (config.getCustomResourceSelector() != null) {
                    LOGGER.info("Cluster Operator verticle started in namespace {} with label selector {}", namespace, config.getCustomResourceSelector());
                } else {
                    LOGGER.info("Cluster Operator verticle started in namespace {} without label selector", namespace);
                }
            } else {
                LOGGER.error("Cluster Operator verticle in namespace {} failed to start", namespace, res.cause());
                System.exit(1);
            }
            prom.handle(res);
        });
    }
    return CompositeFuture.join(futures);
}

Example 8 with OpenSslCertManager

use of io.strimzi.certs.OpenSslCertManager in project strimzi-kafka-operator by strimzi.

the class KafkaClusterTest method generateBrokerSecret.

private Secret generateBrokerSecret(Set<String> externalBootstrapAddress, Map<Integer, Set<String>> externalAddresses) {
    ClusterCa clusterCa = new ClusterCa(Reconciliation.DUMMY_RECONCILIATION, new OpenSslCertManager(), new PasswordGenerator(10, "a", "a"), cluster, null, null);
    clusterCa.createRenewOrReplace(namespace, cluster, emptyMap(), emptyMap(), emptyMap(), null, true);
    ClientsCa clientsCa = new ClientsCa(Reconciliation.DUMMY_RECONCILIATION, new OpenSslCertManager(), new PasswordGenerator(10, "a", "a"), null, null, null, null, 365, 30, true, CertificateExpirationPolicy.RENEW_CERTIFICATE);
    clientsCa.createRenewOrReplace(namespace, cluster, emptyMap(), emptyMap(), emptyMap(), null, true);
    return kc.generateCertificatesSecret(clusterCa, clientsCa, externalBootstrapAddress, externalAddresses, true);
}

Example 9 with OpenSslCertManager

use of io.strimzi.certs.OpenSslCertManager in project strimzi-kafka-operator by strimzi.

the class CruiseControlReconcilerTest method reconcileEnabledCruiseControl.

@Test
public void reconcileEnabledCruiseControl(VertxTestContext context) {
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(false);
    DeploymentOperator mockDepOps = supplier.deploymentOperations;
    SecretOperator mockSecretOps = supplier.secretOperations;
    ServiceAccountOperator mockSaOps = supplier.serviceAccountOperations;
    ServiceOperator mockServiceOps = supplier.serviceOperations;
    NetworkPolicyOperator mockNetPolicyOps = supplier.networkPolicyOperator;
    ConfigMapOperator mockCmOps = supplier.configMapOperations;
    ArgumentCaptor<ServiceAccount> saCaptor = ArgumentCaptor.forClass(ServiceAccount.class);
    when(mockSaOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.serviceAccountName(NAME)), saCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<Secret> secretCaptor = ArgumentCaptor.forClass(Secret.class);
    when(mockSecretOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.secretName(NAME)), secretCaptor.capture())).thenReturn(Future.succeededFuture());
    when(mockSecretOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.apiSecretName(NAME)), secretCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<Service> serviceCaptor = ArgumentCaptor.forClass(Service.class);
    when(mockServiceOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.serviceName(NAME)), serviceCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<NetworkPolicy> netPolicyCaptor = ArgumentCaptor.forClass(NetworkPolicy.class);
    when(mockNetPolicyOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.networkPolicyName(NAME)), netPolicyCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<ConfigMap> cmCaptor = ArgumentCaptor.forClass(ConfigMap.class);
    when(mockCmOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.logAndMetricsConfigMapName(NAME)), cmCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<Deployment> depCaptor = ArgumentCaptor.forClass(Deployment.class);
    when(mockDepOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.deploymentName(NAME)), depCaptor.capture())).thenReturn(Future.succeededFuture());
    when(mockDepOps.waitForObserved(any(), eq(NAMESPACE), eq(CruiseControlResources.deploymentName(NAME)), anyLong(), anyLong())).thenReturn(Future.succeededFuture());
    when(mockDepOps.readiness(any(), eq(NAMESPACE), eq(CruiseControlResources.deploymentName(NAME)), anyLong(), anyLong())).thenReturn(Future.succeededFuture());
    Kafka kafka = new KafkaBuilder(ResourceUtils.createKafka(NAMESPACE, NAME, 3, "foo", 120, 30)).editSpec().withCruiseControl(cruiseControlSpec).endSpec().build();
    ClusterCa clusterCa = new ClusterCa(Reconciliation.DUMMY_RECONCILIATION, new OpenSslCertManager(), new PasswordGenerator(10, "a", "a"), NAME, ResourceUtils.createInitialCaCertSecret(NAMESPACE, NAME, AbstractModel.clusterCaCertSecretName(NAME), MockCertManager.clusterCaCert(), MockCertManager.clusterCaCertStore(), "123456"), ResourceUtils.createInitialCaKeySecret(NAMESPACE, NAME, AbstractModel.clusterCaKeySecretName(NAME), MockCertManager.clusterCaKey()));
    CruiseControlReconciler rcnclr = new CruiseControlReconciler(Reconciliation.DUMMY_RECONCILIATION, ResourceUtils.dummyClusterOperatorConfig(), supplier, kafka, VERSIONS, kafka.getSpec().getKafka().getStorage(), clusterCa);
    Checkpoint async = context.checkpoint();
    rcnclr.reconcile(false, null, null, Date::new).onComplete(context.succeeding(v -> context.verify(() -> {
        assertThat(saCaptor.getAllValues().size(), is(1));
        assertThat(saCaptor.getValue(), is(notNullValue()));
        assertThat(secretCaptor.getAllValues().size(), is(2));
        assertThat(secretCaptor.getAllValues().get(0), is(notNullValue()));
        assertThat(secretCaptor.getAllValues().get(1), is(notNullValue()));
        assertThat(serviceCaptor.getAllValues().size(), is(1));
        assertThat(serviceCaptor.getValue(), is(notNullValue()));
        assertThat(netPolicyCaptor.getAllValues().size(), is(1));
        assertThat(netPolicyCaptor.getValue(), is(notNullValue()));
        assertThat(cmCaptor.getAllValues().size(), is(1));
        assertThat(cmCaptor.getValue(), is(notNullValue()));
        assertThat(depCaptor.getAllValues().size(), is(1));
        assertThat(depCaptor.getValue(), is(notNullValue()));
        async.flag();
    })));
}

Example 10 with OpenSslCertManager

use of io.strimzi.certs.OpenSslCertManager in project strimzi-kafka-operator by strimzi.

the class CruiseControlReconcilerTest method reconcileDisabledCruiseControl.

@Test
public void reconcileDisabledCruiseControl(VertxTestContext context) {
    ResourceOperatorSupplier supplier = ResourceUtils.supplierWithMocks(false);
    DeploymentOperator mockDepOps = supplier.deploymentOperations;
    SecretOperator mockSecretOps = supplier.secretOperations;
    ServiceAccountOperator mockSaOps = supplier.serviceAccountOperations;
    ServiceOperator mockServiceOps = supplier.serviceOperations;
    NetworkPolicyOperator mockNetPolicyOps = supplier.networkPolicyOperator;
    ConfigMapOperator mockCmOps = supplier.configMapOperations;
    ArgumentCaptor<ServiceAccount> saCaptor = ArgumentCaptor.forClass(ServiceAccount.class);
    when(mockSaOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.serviceAccountName(NAME)), saCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<Secret> secretCaptor = ArgumentCaptor.forClass(Secret.class);
    when(mockSecretOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.secretName(NAME)), secretCaptor.capture())).thenReturn(Future.succeededFuture());
    when(mockSecretOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.apiSecretName(NAME)), secretCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<Service> serviceCaptor = ArgumentCaptor.forClass(Service.class);
    when(mockServiceOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.serviceName(NAME)), serviceCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<NetworkPolicy> netPolicyCaptor = ArgumentCaptor.forClass(NetworkPolicy.class);
    when(mockNetPolicyOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.networkPolicyName(NAME)), netPolicyCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<ConfigMap> cmCaptor = ArgumentCaptor.forClass(ConfigMap.class);
    when(mockCmOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.logAndMetricsConfigMapName(NAME)), cmCaptor.capture())).thenReturn(Future.succeededFuture());
    ArgumentCaptor<Deployment> depCaptor = ArgumentCaptor.forClass(Deployment.class);
    when(mockDepOps.reconcile(any(), eq(NAMESPACE), eq(CruiseControlResources.deploymentName(NAME)), depCaptor.capture())).thenReturn(Future.succeededFuture());
    when(mockDepOps.waitForObserved(any(), eq(NAMESPACE), eq(CruiseControlResources.deploymentName(NAME)), anyLong(), anyLong())).thenReturn(Future.succeededFuture());
    when(mockDepOps.readiness(any(), eq(NAMESPACE), eq(CruiseControlResources.deploymentName(NAME)), anyLong(), anyLong())).thenReturn(Future.succeededFuture());
    Kafka kafka = ResourceUtils.createKafka(NAMESPACE, NAME, 3, "foo", 120, 30);
    ClusterCa clusterCa = new ClusterCa(Reconciliation.DUMMY_RECONCILIATION, new OpenSslCertManager(), new PasswordGenerator(10, "a", "a"), NAME, ResourceUtils.createInitialCaCertSecret(NAMESPACE, NAME, AbstractModel.clusterCaCertSecretName(NAME), MockCertManager.clusterCaCert(), MockCertManager.clusterCaCertStore(), "123456"), ResourceUtils.createInitialCaKeySecret(NAMESPACE, NAME, AbstractModel.clusterCaKeySecretName(NAME), MockCertManager.clusterCaKey()));
    CruiseControlReconciler rcnclr = new CruiseControlReconciler(Reconciliation.DUMMY_RECONCILIATION, ResourceUtils.dummyClusterOperatorConfig(), supplier, kafka, VERSIONS, kafka.getSpec().getKafka().getStorage(), clusterCa);
    Checkpoint async = context.checkpoint();
    rcnclr.reconcile(false, null, null, Date::new).onComplete(context.succeeding(v -> context.verify(() -> {
        assertThat(saCaptor.getAllValues().size(), is(1));
        assertThat(saCaptor.getValue(), is(nullValue()));
        assertThat(secretCaptor.getAllValues().size(), is(2));
        assertThat(secretCaptor.getAllValues().get(0), is(nullValue()));
        assertThat(secretCaptor.getAllValues().get(1), is(nullValue()));
        assertThat(serviceCaptor.getAllValues().size(), is(1));
        assertThat(serviceCaptor.getValue(), is(nullValue()));
        assertThat(netPolicyCaptor.getAllValues().size(), is(1));
        assertThat(netPolicyCaptor.getValue(), is(nullValue()));
        assertThat(cmCaptor.getAllValues().size(), is(1));
        assertThat(cmCaptor.getValue(), is(nullValue()));
        assertThat(depCaptor.getAllValues().size(), is(1));
        assertThat(depCaptor.getValue(), is(nullValue()));
        async.flag();
    })));
}