{"action":"created","comment":{"url":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/comments/165796864","pull_request_review_id":93798728,"id":165796864,"diff_hunk":"@@ -0,0 +1,242 @@\n+---\n+layout: layout.pug\n+navigationTitle:\n+excerpt:\n+title: Kerberos\n+menuWeight: 22\n+\n+---\n+\n+# DC/OS Apache Kafka Security\n+\n+The DC/OS Apache Kafka service supports Kafka's native transport encryption, authentication, and authorization mechanisms. The service provides automation and orchestration to simplify the usage of these important features.\n+\n+A good overview of these features can be found [here](https://www.confluent.io/blog/apache-kafka-security-authorization-authentication-encryption/), and Kafka's security documentation can be found [here](http://kafka.apache.org/documentation/#security).\n+\n+*Note*: These security features are only available on DC/OS Enterprise.\n+\n+## Transport Encryption\n+\n+With transport encryption enabled, DC/OS Apache Kafka will automatically deploy all brokers with the correct configuration to communicate via SSL. The Brokers will communicate securely between themselves using SSl. Optionally, plaintext communication can be left open to clients.\n+\n+The service uses the [DC/OS CA](https://docs.mesosphere.com/1.10/security/ent/tls-ssl/) to generate the TLS artifacts that it uses to secure the service. Any client that trusts the DC/OS CA will consider the service's certificates valid.\n+\n+*Note*: Enabling transport encryption is _required_ to use [SSL Auth](#ssl-auth) for [authentication](#authentication) (authn), but is optional for [Kerberos authn](#kerberos-authn).\n+\n+### Prerequisites\n+- [A DC/OS Service Account with a secret stored in the DC/OS Secret Store](https://docs.mesosphere.com/latest/security/ent/service-auth/custom-service-auth/).\n+- DC/OS Superuser permissions for modifying the permissions of the Service Account.\n+\n+### Configure Transport Encryption\n+\n+#### Setup the Service Account\n+\n+Grant the service account the correct permissions.\n+- In DC/OS 1.10, the required permission is `dcos:superuser full`.\n+- In DC/OS 1.11+ the required permissions are:","path":"frameworks/kafka/docs/security.md","position":36,"original_position":36,"commit_id":"90fbf1c0b8f370c63993ba18796e31b4d461af2c","original_commit_id":"90fbf1c0b8f370c63993ba18796e31b4d461af2c","user":{"login":"benclarkwood","id":4732025,"avatar_url":"https://avatars3.githubusercontent.com/u/4732025?v=4","gravatar_id":"","url":"https://api.github.com/users/benclarkwood","html_url":"https://github.com/benclarkwood","followers_url":"https://api.github.com/users/benclarkwood/followers","following_url":"https://api.github.com/users/benclarkwood/following{/other_user}","gists_url":"https://api.github.com/users/benclarkwood/gists{/gist_id}","starred_url":"https://api.github.com/users/benclarkwood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benclarkwood/subscriptions","organizations_url":"https://api.github.com/users/benclarkwood/orgs","repos_url":"https://api.github.com/users/benclarkwood/repos","events_url":"https://api.github.com/users/benclarkwood/events{/privacy}","received_events_url":"https://api.github.com/users/benclarkwood/received_events","type":"User","site_admin":false},"body":"https://jira.mesosphere.com/browse/INFINITY-3080","created_at":"2018-02-03T01:04:21Z","updated_at":"2018-02-03T01:04:21Z","html_url":"https://github.com/mesosphere/dcos-commons/pull/2181#discussion_r165796864","pull_request_url":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/2181","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/comments/165796864"},"html":{"href":"https://github.com/mesosphere/dcos-commons/pull/2181#discussion_r165796864"},"pull_request":{"href":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/2181"}},"in_reply_to_id":165580711},"pull_request":{"url":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/2181","id":166692334,"html_url":"https://github.com/mesosphere/dcos-commons/pull/2181","diff_url":"https://github.com/mesosphere/dcos-commons/pull/2181.diff","patch_url":"https://github.com/mesosphere/dcos-commons/pull/2181.patch","issue_url":"https://api.github.com/repos/mesosphere/dcos-commons/issues/2181","number":2181,"state":"open","locked":false,"title":"[INFINITY-2798] Condense SSL and Kerberos into a single \"security\" section.","user":{"login":"benclarkwood","id":4732025,"avatar_url":"https://avatars3.githubusercontent.com/u/4732025?v=4","gravatar_id":"","url":"https://api.github.com/users/benclarkwood","html_url":"https://github.com/benclarkwood","followers_url":"https://api.github.com/users/benclarkwood/followers","following_url":"https://api.github.com/users/benclarkwood/following{/other_user}","gists_url":"https://api.github.com/users/benclarkwood/gists{/gist_id}","starred_url":"https://api.github.com/users/benclarkwood/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/benclarkwood/subscriptions","organizations_url":"https://api.github.com/users/benclarkwood/orgs","repos_url":"https://api.github.com/users/benclarkwood/repos","events_url":"https://api.github.com/users/benclarkwood/events{/privacy}","received_events_url":"https://api.github.com/users/benclarkwood/received_events","type":"User","site_admin":false},"body":"1. Make everything a single file\r\n2. Streamline everything together\r\n3. Take out directions around creating principals (not our responsibility to tell you how to do it).","created_at":"2018-02-02T00:51:26Z","updated_at":"2018-02-03T01:04:21Z","closed_at":null,"merged_at":null,"merge_commit_sha":"c4dca47d99ded890e511e6d061360a1d7f12b60a","assignee":null,"assignees":[],"requested_reviewers":[{"login":"imaxxs","id":260022,"avatar_url":"https://avatars3.githubusercontent.com/u/260022?v=4","gravatar_id":"","url":"https://api.github.com/users/imaxxs","html_url":"https://github.com/imaxxs","followers_url":"https://api.github.com/users/imaxxs/followers","following_url":"https://api.github.com/users/imaxxs/following{/other_user}","gists_url":"https://api.github.com/users/imaxxs/gists{/gist_id}","starred_url":"https://api.github.com/users/imaxxs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/imaxxs/subscriptions","organizations_url":"https://api.github.com/users/imaxxs/orgs","repos_url":"https://api.github.com/users/imaxxs/repos","events_url":"https://api.github.com/users/imaxxs/events{/privacy}","received_events_url":"https://api.github.com/users/imaxxs/received_events","type":"User","site_admin":false}],"requested_teams":[],"milestone":null,"commits_url":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/2181/commits","review_comments_url":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/2181/comments","review_comment_url":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/comments{/number}","comments_url":"https://api.github.com/repos/mesosphere/dcos-commons/issues/2181/comments","statuses_url":"https://api.github.com/repos/mesosphere/dcos-commons/statuses/90fbf1c0b8f370c63993ba18796e31b4d461af2c","head":{"label":"mesosphere:inf-2798-kerb-polish-kafka","ref":"inf-2798-kerb-polish-kafka","sha":"90fbf1c0b8f370c63993ba18796e31b4d461af2c","user":{"login":"mesosphere","id":3458585,"avatar_url":"https://avatars0.githubusercontent.com/u/3458585?v=4","gravatar_id":"","url":"https://api.github.com/users/mesosphere","html_url":"https://github.com/mesosphere","followers_url":"https://api.github.com/users/mesosphere/followers","following_url":"https://api.github.com/users/mesosphere/following{/other_user}","gists_url":"https://api.github.com/users/mesosphere/gists{/gist_id}","starred_url":"https://api.github.com/users/mesosphere/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mesosphere/subscriptions","organizations_url":"https://api.github.com/users/mesosphere/orgs","repos_url":"https://api.github.com/users/mesosphere/repos","events_url":"https://api.github.com/users/mesosphere/events{/privacy}","received_events_url":"https://api.github.com/users/mesosphere/received_events","type":"Organization","site_admin":false},"repo":{"id":60286497,"name":"dcos-commons","full_name":"mesosphere/dcos-commons","owner":{"login":"mesosphere","id":3458585,"avatar_url":"https://avatars0.githubusercontent.com/u/3458585?v=4","gravatar_id":"","url":"https://api.github.com/users/mesosphere","html_url":"https://github.com/mesosphere","followers_url":"https://api.github.com/users/mesosphere/followers","following_url":"https://api.github.com/users/mesosphere/following{/other_user}","gists_url":"https://api.github.com/users/mesosphere/gists{/gist_id}","starred_url":"https://api.github.com/users/mesosphere/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mesosphere/subscriptions","organizations_url":"https://api.github.com/users/mesosphere/orgs","repos_url":"https://api.github.com/users/mesosphere/repos","events_url":"https://api.github.com/users/mesosphere/events{/privacy}","received_events_url":"https://api.github.com/users/mesosphere/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mesosphere/dcos-commons","description":"Simplifying stateful services","fork":false,"url":"https://api.github.com/repos/mesosphere/dcos-commons","forks_url":"https://api.github.com/repos/mesosphere/dcos-commons/forks","keys_url":"https://api.github.com/repos/mesosphere/dcos-commons/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mesosphere/dcos-commons/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mesosphere/dcos-commons/teams","hooks_url":"https://api.github.com/repos/mesosphere/dcos-commons/hooks","issue_events_url":"https://api.github.com/repos/mesosphere/dcos-commons/issues/events{/number}","events_url":"https://api.github.com/repos/mesosphere/dcos-commons/events","assignees_url":"https://api.github.com/repos/mesosphere/dcos-commons/assignees{/user}","branches_url":"https://api.github.com/repos/mesosphere/dcos-commons/branches{/branch}","tags_url":"https://api.github.com/repos/mesosphere/dcos-commons/tags","blobs_url":"https://api.github.com/repos/mesosphere/dcos-commons/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mesosphere/dcos-commons/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mesosphere/dcos-commons/git/refs{/sha}","trees_url":"https://api.github.com/repos/mesosphere/dcos-commons/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mesosphere/dcos-commons/statuses/{sha}","languages_url":"https://api.github.com/repos/mesosphere/dcos-commons/languages","stargazers_url":"https://api.github.com/repos/mesosphere/dcos-commons/stargazers","contributors_url":"https://api.github.com/repos/mesosphere/dcos-commons/contributors","subscribers_url":"https://api.github.com/repos/mesosphere/dcos-commons/subscribers","subscription_url":"https://api.github.com/repos/mesosphere/dcos-commons/subscription","commits_url":"https://api.github.com/repos/mesosphere/dcos-commons/commits{/sha}","git_commits_url":"https://api.github.com/repos/mesosphere/dcos-commons/git/commits{/sha}","comments_url":"https://api.github.com/repos/mesosphere/dcos-commons/comments{/number}","issue_comment_url":"https://api.github.com/repos/mesosphere/dcos-commons/issues/comments{/number}","contents_url":"https://api.github.com/repos/mesosphere/dcos-commons/contents/{+path}","compare_url":"https://api.github.com/repos/mesosphere/dcos-commons/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mesosphere/dcos-commons/merges","archive_url":"https://api.github.com/repos/mesosphere/dcos-commons/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mesosphere/dcos-commons/downloads","issues_url":"https://api.github.com/repos/mesosphere/dcos-commons/issues{/number}","pulls_url":"https://api.github.com/repos/mesosphere/dcos-commons/pulls{/number}","milestones_url":"https://api.github.com/repos/mesosphere/dcos-commons/milestones{/number}","notifications_url":"https://api.github.com/repos/mesosphere/dcos-commons/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mesosphere/dcos-commons/labels{/name}","releases_url":"https://api.github.com/repos/mesosphere/dcos-commons/releases{/id}","deployments_url":"https://api.github.com/repos/mesosphere/dcos-commons/deployments","created_at":"2016-06-02T18:09:08Z","updated_at":"2018-01-27T09:16:17Z","pushed_at":"2018-02-02T21:42:46Z","git_url":"git://github.com/mesosphere/dcos-commons.git","ssh_url":"git@github.com:mesosphere/dcos-commons.git","clone_url":"https://github.com/mesosphere/dcos-commons.git","svn_url":"https://github.com/mesosphere/dcos-commons","homepage":"https://mesosphere.github.io/dcos-commons/","size":58622,"stargazers_count":118,"watchers_count":118,"language":"Java","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":120,"mirror_url":null,"archived":false,"open_issues_count":61,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":120,"open_issues":61,"watchers":118,"default_branch":"master"}},"base":{"label":"mesosphere:master","ref":"master","sha":"868c1b046df87f5746f2e7e2863098b711c30875","user":{"login":"mesosphere","id":3458585,"avatar_url":"https://avatars0.githubusercontent.com/u/3458585?v=4","gravatar_id":"","url":"https://api.github.com/users/mesosphere","html_url":"https://github.com/mesosphere","followers_url":"https://api.github.com/users/mesosphere/followers","following_url":"https://api.github.com/users/mesosphere/following{/other_user}","gists_url":"https://api.github.com/users/mesosphere/gists{/gist_id}","starred_url":"https://api.github.com/users/mesosphere/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mesosphere/subscriptions","organizations_url":"https://api.github.com/users/mesosphere/orgs","repos_url":"https://api.github.com/users/mesosphere/repos","events_url":"https://api.github.com/users/mesosphere/events{/privacy}","received_events_url":"https://api.github.com/users/mesosphere/received_events","type":"Organization","site_admin":false},"repo":{"id":60286497,"name":"dcos-commons","full_name":"mesosphere/dcos-commons","owner":{"login":"mesosphere","id":3458585,"avatar_url":"https://avatars0.githubusercontent.com/u/3458585?v=4","gravatar_id":"","url":"https://api.github.com/users/mesosphere","html_url":"https://github.com/mesosphere","followers_url":"https://api.github.com/users/mesosphere/followers","following_url":"https://api.github.com/users/mesosphere/following{/other_user}","gists_url":"https://api.github.com/users/mesosphere/gists{/gist_id}","starred_url":"https://api.github.com/users/mesosphere/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mesosphere/subscriptions","organizations_url":"https://api.github.com/users/mesosphere/orgs","repos_url":"https://api.github.com/users/mesosphere/repos","events_url":"https://api.github.com/users/mesosphere/events{/privacy}","received_events_url":"https://api.github.com/users/mesosphere/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/mesosphere/dcos-commons","description":"Simplifying stateful services","fork":false,"url":"https://api.github.com/repos/mesosphere/dcos-commons","forks_url":"https://api.github.com/repos/mesosphere/dcos-commons/forks","keys_url":"https://api.github.com/repos/mesosphere/dcos-commons/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mesosphere/dcos-commons/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mesosphere/dcos-commons/teams","hooks_url":"https://api.github.com/repos/mesosphere/dcos-commons/hooks","issue_events_url":"https://api.github.com/repos/mesosphere/dcos-commons/issues/events{/number}","events_url":"https://api.github.com/repos/mesosphere/dcos-commons/events","assignees_url":"https://api.github.com/repos/mesosphere/dcos-commons/assignees{/user}","branches_url":"https://api.github.com/repos/mesosphere/dcos-commons/branches{/branch}","tags_url":"https://api.github.com/repos/mesosphere/dcos-commons/tags","blobs_url":"https://api.github.com/repos/mesosphere/dcos-commons/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mesosphere/dcos-commons/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mesosphere/dcos-commons/git/refs{/sha}","trees_url":"https://api.github.com/repos/mesosphere/dcos-commons/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mesosphere/dcos-commons/statuses/{sha}","languages_url":"https://api.github.com/repos/mesosphere/dcos-commons/languages","stargazers_url":"https://api.github.com/repos/mesosphere/dcos-commons/stargazers","contributors_url":"https://api.github.com/repos/mesosphere/dcos-commons/contributors","subscribers_url":"https://api.github.com/repos/mesosphere/dcos-commons/subscribers","subscription_url":"https://api.github.com/repos/mesosphere/dcos-commons/subscription","commits_url":"https://api.github.com/repos/mesosphere/dcos-commons/commits{/sha}","git_commits_url":"https://api.github.com/repos/mesosphere/dcos-commons/git/commits{/sha}","comments_url":"https://api.github.com/repos/mesosphere/dcos-commons/comments{/number}","issue_comment_url":"https://api.github.com/repos/mesosphere/dcos-commons/issues/comments{/number}","contents_url":"https://api.github.com/repos/mesosphere/dcos-commons/contents/{+path}","compare_url":"https://api.github.com/repos/mesosphere/dcos-commons/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mesosphere/dcos-commons/merges","archive_url":"https://api.github.com/repos/mesosphere/dcos-commons/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mesosphere/dcos-commons/downloads","issues_url":"https://api.github.com/repos/mesosphere/dcos-commons/issues{/number}","pulls_url":"https://api.github.com/repos/mesosphere/dcos-commons/pulls{/number}","milestones_url":"https://api.github.com/repos/mesosphere/dcos-commons/milestones{/number}","notifications_url":"https://api.github.com/repos/mesosphere/dcos-commons/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mesosphere/dcos-commons/labels{/name}","releases_url":"https://api.github.com/repos/mesosphere/dcos-commons/releases{/id}","deployments_url":"https://api.github.com/repos/mesosphere/dcos-commons/deployments","created_at":"2016-06-02T18:09:08Z","updated_at":"2018-01-27T09:16:17Z","pushed_at":"2018-02-02T21:42:46Z","git_url":"git://github.com/mesosphere/dcos-commons.git","ssh_url":"git@github.com:mesosphere/dcos-commons.git","clone_url":"https://github.com/mesosphere/dcos-commons.git","svn_url":"https://github.com/mesosphere/dcos-commons","homepage":"https://mesosphere.github.io/dcos-commons/","size":58622,"stargazers_count":118,"watchers_count":118,"language":"Java","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":120,"mirror_url":null,"archived":false,"open_issues_count":61,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":120,"open_issues":61,"watchers":118,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/2181"},"html":{"href":"https://github.com/mesosphere/dcos-commons/pull/2181"},"issue":{"href":"https://api.github.com/repos/mesosphere/dcos-commons/issues/2181"},"comments":{"href":"https://api.github.com/repos/mesosphere/dcos-commons/issues/2181/comments"},"review_comments":{"href":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/2181/comments"},"review_comment":{"href":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/mesosphere/dcos-commons/pulls/2181/commits"},"statuses":{"href":"https://api.github.com/repos/mesosphere/dcos-commons/statuses/90fbf1c0b8f370c63993ba18796e31b4d461af2c"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"benclarkwood"}}