Added templates for Kubernetes deployments

README.md

@@ -97,7 +97,18 @@ are using Strimzi it is probably called `kafka-cluster-bootstrap`).
 
 #### No authentication, no transport encryption
 
-No additional configuration is required
+No additional configuration is required.
+
+For Kubernetes deployments you can use following templates:
+
+
+* [./assets/toolbox-plaintext.yaml](./assets/toolbox-plaintext.yaml):
+  if connect to zookeeper without transport encryption
+* [./assets/toolbox-plaintext-zookeeper-sidecar.yaml](./assets/toolbox-plaintext-zookeeper-sidecar.yaml):
+  if you use a sidecar to encrypt zookeeper traffic
+
+Do not forget to replace all values in `{{curly-brackets}}` by
+appropriate values!
 
 #### Mutual TLS
 
@@ -107,6 +118,17 @@ You need to provide following environment variables:
 * `KAFKA_USER_CERT_LOCATION`
 * `KAFKA_CA_CERT_LOCATION`
 
+For Kubernetes deployments you can use following templates:
+
+
+* [./assets/toolbox-mutual-tls.yaml](./assets/toolbox-mutual-tls.yaml)
+  if connect to zookeeper without transport encryption
+* [./assets/toolbox-mutual-tls-zookeeper-sidecar.yaml](./assets/toolbox-mutual-tls-zookeeper-sidecar.yaml):
+  if you use a sidecar to encrypt zookeeper traffic
+
+Do not forget to replace all values in `{{curly-brackets}}` by
+appropriate values!
+
 #### Other Authentication methods
 
 currently not supported. If you need it, open a ticket or provide a

assets/toolbox-mutual-tls-zookeeper-sidecar.yaml

@@ -0,0 +1,52 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kafka-toolbox
+spec:
+  containers:
+    - name: kafka-toolbox
+      image: azapps/kafka-toolbox:latest
+      env:
+        - name: KAFKA_USER_KEY_LOCATION
+          value: /var/private/ssl/kafka-client-ca-certs/user.key
+        - name: KAFKA_USER_CERT_LOCATION
+          value: /var/private/ssl/kafka-client-ca-certs/user.crt
+        - name: KAFKA_CA_CERT_LOCATION
+          value: /var/private/ssl/kafka-cluster-ca-certs/ca.crt
+        - name: KAFKA_BOOTSTRAP_SERVERS
+          value: "{{kafka-url}}"
+        - name: KAFKA_ZOOKEEPER
+          value: "localhost:2181"
+      volumeMounts:
+      - name: client-ca-certs
+        mountPath: "/var/private/ssl/kafka-client-ca-certs"
+        readOnly: true
+      - name: cluster-ca-cert
+        mountPath: "/var/private/ssl/kafka-cluster-ca-certs"
+        readOnly: true
+      command:
+        - sleep
+        - infinity
+    - name: tls-sidecar
+      image: 'strimzi/entity-operator-stunnel:0.11.3'
+      env:
+        - name: STRIMZI_ZOOKEEPER_CONNECT
+          value: '{{zookeeper-url}}'
+        - name: TLS_SIDECAR_LOG_LEVEL
+          value: notice
+      volumeMounts:
+        # For Zookeeper connet
+        - mountPath: "/etc/tls-sidecar/cluster-ca-certs"
+          name: cluster-ca-cert
+        - mountPath: "/etc/tls-sidecar/eo-certs"
+          name: zk-client-cert
+  volumes:
+    - name: cluster-ca-cert
+      secret:
+        secretName: kafka-cluster-ca-cert
+    - name: client-ca-certs
+      secret:
+        secretName: {{kafka-user}}
+    - name: zk-client-cert
+      secret:
+        secretName: kafka-entity-operator-certs

assets/toolbox-mutual-tls.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kafka-toolbox
+spec:
+  containers:
+    - name: kafka-toolbox
+      image: azapps/kafka-toolbox:latest
+      env:
+        - name: KAFKA_USER_KEY_LOCATION
+          value: /var/private/ssl/kafka-client-ca-certs/user.key
+        - name: KAFKA_USER_CERT_LOCATION
+          value: /var/private/ssl/kafka-client-ca-certs/user.crt
+        - name: KAFKA_CA_CERT_LOCATION
+          value: /var/private/ssl/kafka-cluster-ca-certs/ca.crt
+        - name: KAFKA_BOOTSTRAP_SERVERS
+          value: "{{kafka-url}}"
+        - name: KAFKA_ZOOKEEPER
+          value: "{{zookeeper-url}}"
+      volumeMounts:
+      - name: client-ca-certs
+        mountPath: "/var/private/ssl/kafka-client-ca-certs"
+        readOnly: true
+      - name: cluster-ca-cert
+        mountPath: "/var/private/ssl/kafka-cluster-ca-certs"
+        readOnly: true
+      command:
+        - sleep
+        - infinity
+  volumes:
+    - name: cluster-ca-cert
+      secret:
+        secretName: kafka-cluster-ca-cert
+    - name: client-ca-certs
+      secret:
+        secretName: {{kafka-user}}

assets/toolbox-plaintext-zookeeper-sidecar.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kafka-toolbox
+spec:
+  containers:
+    - name: kafka-toolbox
+      image: azapps/kafka-toolbox:latest
+      env:
+        - name: KAFKA_BOOTSTRAP_SERVERS
+          value: "{{kafka-url}}"
+        - name: KAFKA_ZOOKEEPER
+          # Do not change! This is the sidecar connection URL
+          value: "localhost:2181"
+      command:
+        - sleep
+        - infinity
+    - name: tls-sidecar
+      image: 'strimzi/entity-operator-stunnel:0.11.3'
+      env:
+        - name: STRIMZI_ZOOKEEPER_CONNECT
+          value: '{{zookeeper-url}}'
+        - name: TLS_SIDECAR_LOG_LEVEL
+          value: notice
+      volumeMounts:
+        - mountPath: "/etc/tls-sidecar/cluster-ca-certs"
+          name: cluster-ca-cert
+        - mountPath: "/etc/tls-sidecar/eo-certs"
+          name: zk-client-cert
+  volumes:
+    - name: cluster-ca-cert
+      secret:
+        secretName: kafka-cluster-ca-cert
+    - name: zk-client-cert
+      secret:
+        secretName: kafka-entity-operator-certs

assets/toolbox-plaintext.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kafka-toolbox
+spec:
+  containers:
+    - name: kafka-toolbox
+      image: azapps/kafka-toolbox:latest
+      env:
+        - name: KAFKA_BOOTSTRAP_SERVERS
+          value: "{{kafka-url}}"
+        - name: KAFKA_ZOOKEEPER
+          value: "{{zookeeper-url}}"
+      command:
+        - sleep
+        - infinity