molecule.yml

---
### Installation of Confluent Community Edition on RHEL8.
### Kerberos protocol.
### TLS Enabled.
### Custom TLS certificates.

driver:
  name: docker
platforms:
  - name: kerberos1
    hostname: kerberos1.confluent
    groups:
      - kerberos_server
    image: centos:centos8
    dockerfile: ../Dockerfile-centos8-base.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: ${KRAFT_CONTROLLER:-zookeeper}1
    hostname: ${KRAFT_CONTROLLER:-zookeeper}1.confluent
    groups:
      - ${CONTROLLER_HOSTGROUP:-zookeeper}
      - ${CONTROLLER_HOSTGROUP:-zookeeper}_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: ${KRAFT_CONTROLLER:-zookeeper}2
    hostname: ${KRAFT_CONTROLLER:-zookeeper}2.confluent
    groups:
      - ${CONTROLLER_HOSTGROUP:-zookeeper}
      - ${CONTROLLER_HOSTGROUP:-zookeeper}_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: ${KRAFT_CONTROLLER:-zookeeper}3
    hostname: ${KRAFT_CONTROLLER:-zookeeper}3.confluent
    groups:
      - ${CONTROLLER_HOSTGROUP:-zookeeper}
      - ${CONTROLLER_HOSTGROUP:-zookeeper}_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: kafka-broker1
    hostname: kafka-broker1.confluent
    groups:
      - kafka_broker
      - kafka_broker_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: kafka-broker2
    hostname: kafka-broker2.confluent
    groups:
      - kafka_broker
      - kafka_broker_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: kafka-broker3
    hostname: kafka-broker3.confluent
    groups:
      - kafka_broker
      - kafka_broker_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: schema-registry1
    hostname: schema-registry1.confluent
    groups:
      - schema_registry
      - schema_registry_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: kafka-rest1
    hostname: kafka-rest1.confluent
    groups:
      - kafka_rest
      - kafka_rest_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: kafka-connect1
    hostname: kafka-connect1.confluent
    groups:
      - kafka_connect
      - kafka_connect_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: ksql1
    hostname: ksql1.confluent
    groups:
      - ksql
      - ksql_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: control-center1
    hostname: control-center1.confluent
    groups:
      - control_center
      - control_center_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    published_ports:
      - "9021:9021"
    networks:
      - name: confluent
  - name: control-center-next-gen
    hostname: control-center-next-gen.confluent
    groups:
      - control_center_next_gen
      - control_center_next_gen_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    published_ports:
      - "9022:9022"
    networks:
      - name: confluent
  # Cluster 2 (Kraft) goups, groupnames will be changed during converge phase
  - name: controller1-mig
    hostname: controller1-mig.confluent
    groups:
      - kafka_controller_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: controller2-mig
    hostname: controller2-mig.confluent
    groups:
      - kafka_controller_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
  - name: controller3-mig
    hostname: controller3-mig.confluent
    groups:
      - kafka_controller_migration
    image: redhat/ubi8-minimal
    dockerfile: ../Dockerfile-rhel-java17.j2
    command: ""
    volumes:
      - /sys/fs/cgroup:/sys/fs/cgroup:ro
    privileged: true
    networks:
      - name: confluent
provisioner:
  playbooks:
    converge: ${MIGRATION_CONVERGE:-../collections_converge.yml}
  inventory:
    group_vars:
      all:
        control_center_next_gen_port: 9022
        control_center_next_gen_dependency_prometheus_ssl_enabled: true
        control_center_next_gen_dependency_prometheus_basic_auth_enabled: true
        control_center_next_gen_dependency_alertmanager_ssl_enabled: true
        control_center_next_gen_dependency_alertmanager_basic_auth_enabled: true

        jolokia_enabled: true
        jolokia_auth_mode: basic
        jolokia_user: user1
        jolokia_password: pass

        kafka_controller_jolokia_enabled: true
        kafka_controller_jolokia_access_control_enabled: true
        kafka_controller_jolokia_access_control_custom_file_enabled: true
        kafka_controller_jolokia_access_control_file_src_path: "{{ lookup('env', 'MOLECULE_PROJECT_DIRECTORY') }}/roles/kafka_controller/templates/jolokia_access_control_default.xml"

        scenario_name: confluent-kafka-kerberos-customcerts-rhel

        confluent_server_enabled: false

        ssl_enabled: true

        ssl_custom_certs: true
        ssl_ca_cert_filepath: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/generated_ssl_files/ca.crt"
        ssl_signed_cert_filepath: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/generated_ssl_files/{{inventory_hostname}}-ca1-signed.crt"
        ssl_key_filepath: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/generated_ssl_files/{{inventory_hostname}}-key.pem"
        ssl_key_password: keypass

        sasl_protocol: kerberos

        kerberos:
          realm: realm.example.com
          kdc_hostname: kerberos1
          admin_hostname: kerberos1

      zookeeper:
        zookeeper_kerberos_principal: "zookeeper/{{inventory_hostname}}.confluent@{{kerberos.realm | upper}}"
        zookeeper_kerberos_keytab_path: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/keytabs/zookeeper-{{inventory_hostname}}.keytab"
      kafka_controller:
        kafka_controller_kerberos_principal: "kafka/{{inventory_hostname}}.confluent@{{kerberos.realm | upper}}"
        kafka_controller_kerberos_keytab_path: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/keytabs/kafka_controller-{{inventory_hostname}}.keytab"
      kafka_broker:
        kafka_broker_kerberos_principal: "kafka/{{inventory_hostname}}.confluent@{{kerberos.realm | upper}}"
        kafka_broker_kerberos_keytab_path: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/keytabs/kafka_broker-{{inventory_hostname}}.keytab"
      schema_registry:
        schema_registry_kerberos_principal: "schema_registry/{{inventory_hostname}}.confluent@{{kerberos.realm | upper}}"
        schema_registry_kerberos_keytab_path: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/keytabs/schema_registry-{{inventory_hostname}}.keytab"
      kafka_rest:
        kafka_rest_kerberos_principal: "kafka_rest/{{inventory_hostname}}.confluent@{{kerberos.realm | upper}}"
        kafka_rest_kerberos_keytab_path: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/keytabs/kafka_rest-{{inventory_hostname}}.keytab"
      kafka_connect:
        kafka_connect_kerberos_principal: "kafka_connect/{{inventory_hostname}}.confluent@{{kerberos.realm | upper}}"
        kafka_connect_kerberos_keytab_path: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/keytabs/kafka_connect-{{inventory_hostname}}.keytab"
      ksql:
        ksql_kerberos_principal: "ksql/{{inventory_hostname}}.confluent@{{kerberos.realm | upper}}"
        ksql_kerberos_keytab_path: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/keytabs/ksql-{{inventory_hostname}}.keytab"
      control_center:
        control_center_kerberos_principal: "control_center/{{inventory_hostname}}.confluent@{{kerberos.realm | upper}}"
        control_center_kerberos_keytab_path: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/keytabs/control_center-{{inventory_hostname}}.keytab"
      control_center_next_gen:
        control_center_next_gen_kerberos_principal: "control_center_next_gen/{{inventory_hostname}}.confluent@{{kerberos.realm | upper}}"
        control_center_next_gen_kerberos_keytab_path: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/keytabs/control_center_next_gen-{{inventory_hostname}}.keytab"

      kerberos_server:
        realm_name: "{{ kerberos.realm | upper }}"

        keytab_output_directory: "{{ lookup('env', 'MOLECULE_SCENARIO_DIRECTORY') }}/keytabs"

        kerberos_principals:
          # Wish there was a better way to create this list, this will do for now
          - principal: "zookeeper/zookeeper1.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/zookeeper-zookeeper1.keytab"

          - principal: "zookeeper/zookeeper2.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/zookeeper-zookeeper2.keytab"

          - principal: "zookeeper/zookeeper3.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/zookeeper-zookeeper3.keytab"

          - principal: "kafka/controller1.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/kafka_controller-controller1.keytab"

          - principal: "kafka/controller2.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/kafka_controller-controller2.keytab"

          - principal: "kafka/controller3.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/kafka_controller-controller3.keytab"

          - principal: "kafka/controller1-mig.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/kafka_controller-controller1-mig.keytab"

          - principal: "kafka/controller2-mig.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/kafka_controller-controller2-mig.keytab"

          - principal: "kafka/controller3-mig.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/kafka_controller-controller3-mig.keytab"

          - principal: "kafka/kafka-broker1.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/kafka_broker-kafka-broker1.keytab"

          - principal: "kafka/kafka-broker2.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/kafka_broker-kafka-broker2.keytab"

          - principal: "kafka/kafka-broker3.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/kafka_broker-kafka-broker3.keytab"

          - principal: "schema_registry/schema-registry1.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/schema_registry-schema-registry1.keytab"

          - principal: "kafka_rest/kafka-rest1.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/kafka_rest-kafka-rest1.keytab"

          - principal: "kafka_connect/kafka-connect1.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/kafka_connect-kafka-connect1.keytab"

          - principal: "ksql/ksql1.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/ksql-ksql1.keytab"

          - principal: "control_center/control-center1.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/control_center-control-center1.keytab"

          - principal: "control_center_next_gen/control-center-next-gen.confluent@{{kerberos.realm | upper}}"
            keytab_path: "keytabs/control_center_next_gen-control-center-next-gen.keytab"