Implement TLS authentication for kafka mqt (#1300)

* use secrets to store keys and certificates

charts/fission-all/templates/deployment.yaml

@@ -632,7 +632,50 @@ spec:
           value: {{ .Values.traceSamplingRate | default "0.5" | quote }}
         - name: DEBUG_ENV
           value: {{ .Values.debugEnv | quote }}
+        # TLS authentication is TLS with authentication (2 way)
+        # More info: https://docs.confluent.io/current/kafka/authentication_ssl.html#ssl-overview
+        {{- if .Values.kafka.authentication.tls.enabled }}
+        - name: TLS_ENABLED
+          value: "true"
+        - name: MESSAGE_QUEUE_SECRETS
+          value: /etc/fission/secrets        
+        volumeMounts:
+        - name: kafka-secrets
+          mountPath: /etc/fission/secrets
+        {{- end }}        
       serviceAccount: fission-svc
+      {{- if .Values.kafka.authentication.tls.enabled }}
+      volumes:
+      - name: kafka-secrets
+        secret:
+          secretName: mqtrigger-kafka-secrets
+      {{- end }}
+
+---
+{{- if .Values.kafka.authentication.tls.enabled }}
+apiVersion: v1
+kind: Secret
+metadata: 
+  name: mqtrigger-kafka-secrets
+  labels:
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+data:
+  {{- if .Files.Get  (printf "%s" .Values.kafka.authentication.tls.caCert) }}
+  caCert: {{ .Files.Get (printf "%s" .Values.kafka.authentication.tls.caCert) | b64enc }}
+  {{- else }}
+  {{ fail "Invalid chart. CA Certificate not found." }}
+  {{- end }}
+  {{- if .Files.Get (printf "%s" .Values.kafka.authentication.tls.userCert) }}
+  userCert: {{ .Files.Get (printf "%s" .Values.kafka.authentication.tls.userCert) | b64enc }}
+  {{- else }}
+  {{ fail "Invalid chart. User Certificate not found." }}
+  {{- end }}
+  {{- if .Files.Get (printf "%s" .Values.kafka.authentication.tls.userKey) }}
+  userKey: {{ .Files.Get (printf "%s" .Values.kafka.authentication.tls.userKey) | b64enc }}
+  {{- else }}
+  {{ fail "Invalid chart. User Key not found." }}
+  {{- end }}
+{{- end }}
 {{- if .Values.extraCoreComponentPodConfig }}
 {{ toYaml .Values.extraCoreComponentPodConfig | indent 6 -}}
 {{- end }}

charts/fission-all/values.yaml

@@ -108,7 +108,25 @@ azureStorageQueue:
 ## Kafka: enable and configure the details
 kafka:
   enabled: false
-  brokers: 'broker.kafka:9092'
+  # note: below link is only for reference. 
+  # Please use the brokers link for your kafka here. 
+  brokers: 'broker.kafka:9092' # or your-bootstrap-server.kafka:9092/9093
+  authentication:
+    tls:
+      enabled: false
+      caCert: '' # path to certificate containing public key of CA authority
+      userCert: '' # path to certificate containing public key of the user signed by CA authority
+      userKey: '' # path to private key of the user
+
+  # brokers: 'my-broker.kafka:9092' # or my-bootstrap-server.kafka:9092/9093
+  # Sample config for authentication
+  #   authentication:
+  #   tls:
+  #     enabled: true
+  #     caCert: 'auth/kafka/ca.crt'
+  #     userCert: 'auth/kafka/user.crt'
+  #     userKey: 'auth/kafka/user.key'
+
   ## version of Kafka broker
   ## For 0.x it must be a string in the format
   ## "major.minor.veryMinor.patch" example: 0.8.2.0