In the examples/zookeeper-digitalocean
directory we have some Terraform scripts you can use to spin up 3 nodes, and a cloud-init
Bash script you might find interesting.
Our goal with this exercise is to create 3 Zookeeper nodes, and to get them use TLS for following use cases:
Admin Server on port 8080
Quroum ports on ports 2888 & 3888
Client port on 2281
The nodes will only be accessible over the Private IP addresses because of how we'll configure the certificates.
You'll need to use doctl to set up a DigitalOcean credential file.
Then you'll need to create a DigitalOcean Personal Access Token.
And finally you'll need valid, public addressable DNS Domain. For this tutorial we're using zkocean.hpy.dev but you'll
need to supply your own, or create your own solution for dns.
You can edit the variable.tf to satisfy any of the requirements you might have.
Depending on whether or not you're on macOS, linux, or windows, you'll probably need to adjust the source of your doctl
config file inside of data.tf or you'll need to adjust the DigitalOcean provider in providers.tf
Once that's ready, run the following Terraform commands:
cd ./examples/zookeeper-digitalocean/
terraform init
terraform plan -out tfout
terraform apply "tfout"
In a few moments you should have 3 nodes which you can start using immediately.
Most of this work is already done for you via cloudinit.sh on first boot.
Create SSL keystore JKS to store local credentials, one keystore should be created for each ZK instance.
In this example we generate a self-signed certificate and store it together with the private key in keystore.jks.
This is suitable for testing purposes, but you probably need an official certificate to sign your keys in a production environment.
note
The alias (-alias) and the distinguished name (-dname) must match the hostname of the machine that is associated with, otherwise hostname verification won't work.
(This is already done for you in the cloudinit.sh on boot.)
We add the additional SAN addresses so that we can properly use this certificate with Curl later on when we want to access
the Admin Server over HTTPS.
Extract the signed public key (certificate) from keystore, this step might only necessary for self-signed certificates.
(This is already done for you in the cloudinit.sh on boot.)