cfk-c3-sso/cluster.yaml at main · pneff93/cfk-c3-sso · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
#apiVersion: platform.confluent.io/v1beta1
#kind: KRaftController
#metadata:
#  name: kraftcontroller
#  namespace: confluent
#spec:
#  dataVolumeCapacity: 10G
#  image:
#    application: docker.io/confluentinc/cp-server:7.7.0
#    init: confluentinc/confluent-init-container:2.9.1
#  replicas: 1
---
apiVersion: platform.confluent.io/v1beta1
kind: Zookeeper
metadata:
  name: zookeeper
  namespace: confluent
spec:
  replicas: 3
  image:
    application: confluentinc/cp-zookeeper:7.7.0
    init: confluentinc/confluent-init-container:2.9.0
  dataVolumeCapacity: 10Gi
  logVolumeCapacity: 10Gi
  authentication:
    type: mtls
  tls:
    secretRef: tls-group1
---

apiVersion: platform.confluent.io/v1beta1
kind: Kafka
metadata:
  name: kafka
  namespace: confluent
spec:
  dataVolumeCapacity: 10G
  image:
    application: docker.io/confluentinc/cp-server:7.7.0
    init: confluentinc/confluent-init-container:2.9.1
  replicas: 3
  tls:
    secretRef: tls-group1
  configOverrides:
    server:
      -  confluent.metadata.server.user.store=OAUTH
  authorization:
    type: rbac
    superUsers:
    - User:4113761a-d187-402f-a48a-8ae0e86f78dd,User:kafka # sub
  services:
    mds:
#      tls:
#        enabled: true
      tokenKeyPair:
        secretRef: mds-token
      provider:
        sso:
          clientCredentials:
            secretRef: oauth-jass
          configurations:
#            groupsClaimName: groups
            subClaimName: sub
            issuer: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/v2.0
            jwksEndpointUri: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/discovery/v2.0/keys
            authorizeBaseEndpointUri: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/oauth2/v2.0/authorize
            tokenBaseEndpointUri: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/oauth2/v2.0/token
            refreshToken: false
        oauth: # OAuth server configs
          configurations:
            groupsClaimName: groups
            subClaimName: sub
            audience: d4330c88-ca9e-4340-b06f-a490449b4d7b
            expectedIssuer: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/v2.0
            jwksEndpointUri: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/discovery/v2.0/keys
            tokenEndpointUri: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/oauth2/v2.0/token

  dependencies:
#    kRaftController:
#      clusterRef:
#        name: kraftcontroller
    zookeeper:
      endpoint: zookeeper.confluent.svc.cluster.local:2182
      authentication:
        type: mtls
      tls:
        enabled: true
#    kafkaRest:
#      authentication:
#        type: oauth
#        jaasConfig:
#          secretRef: oauth-jass
#        oauthSettings:
#          tokenEndpointUri: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/oauth2/v2.0/token
#          expectedIssuer: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/v2.0
#          jwksEndpointUri: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/discovery/v2.0/keys
##          scope: d4330c88-ca9e-4340-b06f-a490449b4d7b/.default
#          subClaimName: sub
##          audience: 6b566e15-8094-4832-95be-02a3f8b20fe2
    kafkaRest:
      authentication:
        type: bearer
        bearer:
          secretRef: mds-client
#---
#apiVersion: platform.confluent.io/v1beta1
#kind: ControlCenter
#metadata:
#  name: controlcenter
#  namespace: confluent
#spec:
#  replicas: 1
#  image:
#    application: confluentinc/cp-enterprise-control-center:7.7.0
#    init: confluentinc/confluent-init-container:2.9.1
#  dataVolumeCapacity: 10Gi
#  authorization:
#    type: rbac
#  dependencies:
#    kafka:
#      bootstrapEndpoint: kafka.confluent.svc.cluster.local:9071
#    mds:
#      ssoProtocol: oidc
#      endpoint: https://kafka.confluent.svc.cluster.local:8090
#      tokenKeyPair:
#        secretRef: mds-token
#      authentication:
#        type: oauth
#        jaasConfig:
#          secretRef: oauth-jass
#        oauthSettings:
#          tokenEndpointUri: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/oauth2/v2.0/token
#          scope: d4330c88-ca9e-4340-b06f-a490449b4d7b/.default
---

apiVersion: platform.confluent.io/v1beta1
kind: KafkaRestClass
metadata:
  name: default
  namespace: confluent
spec:
  kafkaRest:
#    tls:
#      secretRef: tls-group1
    authentication:
#      type: oauth
#      oauth:
#        secretRef: oauth-jass
#        configuration:
##          groupsClaimName: groups
#          subClaimName: sub
##          audience: d4330c88-ca9e-4340-b06f-a490449b4d7b
#          tokenEndpointUri: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/oauth2/v2.0/token
##          expectedIssuer: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/v2.0
##          jwksEndpointUri: https://login.microsoftonline.com/0893715b-959b-4906-a185-2789e1ead045/discovery/v2.0/keys
#          scope: d4330c88-ca9e-4340-b06f-a490449b4d7b/.default
      type: bearer
      bearer:
        secretRef: rest-credential