tinsaetadesse/t-metahub

By tinsaetadesse

•Updated about 7 hours ago

A production-ready image for a secure and highly available deployment of Schema Registry instances.

Image

Message queues

262

Overview Tags

tinsaetadesse/t-metahub repository overview

⁠T-MetaHub Image

A production-ready container image designed for secure, highly available deployments with multiple Schema Registry⁠ instances backed by an SSL-enabled Kafka⁠ cluster.

⁠Features

The T-MetaHub image comes with the following features:

Java 21 runtime — Temurin JRE 21 is included in the image.
SSL/TLS enabled — Kafka communication uses SSL, and Schema Registry clients can use HTTPS.
Mutual TLS support — Client authentication is enabled for HTTPS listener.
Schema Registry distributed mode — Multiple instances can operate as a single cluster.
Non-root execution — The application runs as the t-soft user.
Configurable through environment variables — METAHUB settings are supplied through METAHUB_* environment variables.
Multi-architecture build support — The image supports AMD64 and ARM64 architectures.

⁠Container Image

The image contains the T-METAHUB runtime and its supporting components, so end users do not need to install Java or Schema Registry inside the container.

⁠Main image components

Component	Version / Location
Base OS	Alpine Linux 3.21
Java	Temurin JRE 21.0.10+7
Confluent Schema Registry libraries	8.2.1
Runtime user	`t-soft`
Application home	`/usr/local/t-soft/t-metahub`
Configuration	`/etc/t-soft/t-metahub`
Secrets	`/etc/t-soft/t-metahub/secrets`
Logs	`/var/log/t-soft/t-metahub`

⁠Configuration

T-Metahub is configured through METAHUB_* environment variables.

Example:

environment:
  METAHUB_HOST_NAME: 'metahub-1.tsoft.internal'
  METAHUB_GROUP_ID: 'metahub-cluster'
  METAHUB_LEADER_ELIGIBILITY: true

This allows deployment-specific settings to be changed without rebuilding the image.

⁠Listener Configuration

Instances can define multiple listeners (i.e. for internal communication within the T-MetaHub cluster and for communication with clients):

INTERNAL://0.0.0.0:8081
CLIENT://0.0.0.0:8181

with:

INTERNAL -> http
CLIENT   -> https

The internal listener is selected for inter-instance communication:

METAHUB_INTER_INSTANCE_LISTENER_NAME: 'INTERNAL'

The client listener uses SSL/TLS.

⁠SSL/TLS Configuration

When client authentication is needed, it can be explicitly required by setting the SSL_CLIENT_AUTHENTICATION environment for the client as:

METAHUB_LISTENER_NAME_CLIENT_SSL_CLIENT_AUTHENTICATION: 'REQUIRED'

Then, all the required keysore, truststore, and credential files used by the client listener can be configured using METAHUB_LISTENER_NAME_*_SSL_ environments:

METAHUB_LISTENER_NAME_CLIENT_SSL_TRUSTSTORE_LOCATION: '/etc/t-soft/t-metahub/secrets/star.tsoft.internal.truststore.jks'
METAHUB_LISTENER_NAME_CLIENT_SSL_KEYSTORE_LOCATION: '/etc/t-soft/t-metahub/secrets/metahub.client.keystore.jks'
METAHUB_LISTENER_NAME_CLIENT_SSL_TRUSTSTORE_CREDENTIAL_FILE: 'star.tsoft.internal.ssl.truststore.credential'
METAHUB_LISTENER_NAME_CLIENT_SSL_KEYSTORE_CREDENTIAL_FILE: 'metahub.client.ssl.keystore.credential'
METAHUB_LISTENER_NAME_CLIENT_SSL_KEY_CREDENTIAL_FILE: 'metahub.client.ssl.key.credential'

⁠T-DataBus Configuration

The settings that are related to the T-DataBus cluster can be managed through the METAHUB_KAFKASTORE_* environment variables. The bootstrap servers, and the security protocol used for connecting to them is set by:

METAHUB_KAFKASTORE_SECURITY_PROTOCOL: 'SSL'
METAHUB_KAFKASTORE_BOOTSTRAP_SERVERS: 'SSL://broker-1.tsoft.internal:9192,SSL://broker-2.tsoft.internal:9192,SSL://broker-3.tsoft.internal:9192'

⁠Runtime Configuration

All properties used in the Schema Registry image can be configured using environment variables prefixed with SCHEMA_REGISTRY_. During container startup, these variables are translated into the corresponding Schema Registry configuration properties.

Example:

environment:
    ...
    SCHEMA_REGISTRY_KAFKASTORE_SECURITY_PROTOCOL: 'SSL'

Security-related listener environment variables include:

SCHEMA_REGISTRY_LISTENER_NAME_CLIENT_SSL_TRUSTSTORE_LOCATION
SCHEMA_REGISTRY_LISTENER_NAME_CLIENT_SSL_KEYSTORE_LOCATION
SCHEMA_REGISTRY_LISTENER_NAME_CLIENT_SSL_TRUSTSTORE_CREDENTIALS
SCHEMA_REGISTRY_LISTENER_NAME_CLIENT_SSL_KEYSTORE_CREDENTIALS
SCHEMA_REGISTRY_LISTENER_NAME_CLIENT_SSL_KEY_CREDENTIALS
SCHEMA_REGISTRY_LISTENER_NAME_CLIENT_SSL_CLIENT_AUTHENTICATION

Security-related databus environment variables include:

SCHEMA_REGISTRY_KAFKASTORE_SECURITY_PROTOCOL
SCHEMA_REGISTRY_KAFKASTORE_SSL_TRUSTSTORE_LOCATION
SCHEMA_REGISTRY_KAFKASTORE_SSL_TRUSTSTORE_CREDENTIALS
SCHEMA_REGISTRY_KAFKASTORE_SSL_KEYSTORE_LOCATION
SCHEMA_REGISTRY_KAFKASTORE_SSL_KEYSTORE_CREDENTIALS
SCHEMA_REGISTRY_KAFKASTORE_SSL_KEY_CREDENTIALS

Security-related

SCHEMA_REGISTRY_METADATA_ENCODER_CREDENTIALS

⁠Deployment Example

The compose script below is an example template you can use to quickly spin-up T-MetaHub containers.

services:
  metahub-1:
    image: docker.io/tinsaetadesse/t-metahub:latest
    container_name: metahub-1
    hostname: metahub-1.tsoft.internal
    ports:
      - 18181:8181
    environment:
      METAHUB_HOST_NAME: 'metahub-1.tsoft.internal'
      METAHUB_LISTENERS: 'INTERNAL://0.0.0.0:8081,CLIENT://0.0.0.0:8181'
      METAHUB_LISTENER_PROTOCOL_MAP: 'INTERNAL:http,CLIENT:https'
      METAHUB_INTER_INSTANCE_LISTENER_NAME: 'INTERNAL'
      METAHUB_LISTENER_NAME_CLIENT_SSL_TRUSTSTORE_LOCATION: '/etc/t-soft/t-metahub/secrets/star.tsoft.internal.truststore.jks'
      METAHUB_LISTENER_NAME_CLIENT_SSL_KEYSTORE_LOCATION: '/etc/t-soft/t-metahub/secrets/metahub.client.keystore.jks'
      METAHUB_LISTENER_NAME_CLIENT_SSL_TRUSTSTORE_CREDENTIAL_FILE: 'star.tsoft.internal.ssl.truststore.credential'
      METAHUB_LISTENER_NAME_CLIENT_SSL_KEYSTORE_CREDENTIAL_FILE: 'metahub.client.ssl.keystore.credential'
      METAHUB_LISTENER_NAME_CLIENT_SSL_KEY_CREDENTIAL_FILE: 'metahub.client.ssl.key.credential'
      METAHUB_LISTENER_NAME_CLIENT_SSL_CLIENT_AUTHENTICATION: 'REQUIRED' 
      METAHUB_KAFKASTORE_BOOTSTRAP_SERVERS: 'SSL://broker-1.tsoft.internal:9192,SSL://broker-2.tsoft.internal:9192,SSL://broker-3.tsoft.internal:9192'
      METAHUB_KAFKASTORE_SECURITY_PROTOCOL: 'SSL'
      METAHUB_KAFKASTORE_SSL_TRUSTSTORE_LOCATION: '/etc/t-soft/t-metahub/secrets/star.tsoft.internal.truststore.jks'
      METAHUB_KAFKASTORE_SSL_TRUSTSTORE_CREDENTIAL_FILE: 'star.tsoft.internal.ssl.truststore.credential'
      METAHUB_KAFKASTORE_SSL_KEYSTORE_LOCATION: '/etc/t-soft/t-metahub/secrets/databus-metahub.keystore.jks'
      METAHUB_KAFKASTORE_SSL_KEYSTORE_CREDENTIAL_FILE: 'databus-client.ssl.keystore.credential'
      METAHUB_KAFKASTORE_SSL_KEY_CREDENTIAL_FILE: 'databus-client.ssl.key.credential'
      METAHUB_METADATA_ENCODER_CREDENTIAL_FILE: 'metahub.metadata.encoder.credential'
      METAHUB_GROUP_ID: 'metahub-cluster'
      METAHUB_LEADER_ELIGIBILITY: true
    volumes:
      - ./include/secrets:/etc/t-soft/t-metahub/secrets:ro,z
    networks:
      my-network:
        aliases:
          - metahub-1.tsoft.internal

  metahub-2:
    image: docker.io/tinsaetadesse/t-metahub:latest
    container_name: metahub-2
    hostname: metahub-2.tsoft.internal
    ports:
      - 28181:8181
    environment:
      METAHUB_HOST_NAME: 'metahub-2.tsoft.internal'
      METAHUB_LISTENERS: 'INTERNAL://0.0.0.0:8081,CLIENT://0.0.0.0:8181'
      METAHUB_LISTENER_PROTOCOL_MAP: 'INTERNAL:http,CLIENT:https'
      METAHUB_INTER_INSTANCE_LISTENER_NAME: 'INTERNAL'
      METAHUB_LISTENER_NAME_CLIENT_SSL_TRUSTSTORE_LOCATION: '/etc/t-soft/t-metahub/secrets/star.tsoft.internal.truststore.jks'
      METAHUB_LISTENER_NAME_CLIENT_SSL_KEYSTORE_LOCATION: '/etc/t-soft/t-metahub/secrets/metahub.client.keystore.jks'
      METAHUB_LISTENER_NAME_CLIENT_SSL_TRUSTSTORE_CREDENTIAL_FILE: 'star.tsoft.internal.ssl.truststore.credential'
      METAHUB_LISTENER_NAME_CLIENT_SSL_KEYSTORE_CREDENTIAL_FILE: 'metahub.client.ssl.keystore.credential'
      METAHUB_LISTENER_NAME_CLIENT_SSL_KEY_CREDENTIAL_FILE: 'metahub.client.ssl.key.credential'
      METAHUB_LISTENER_NAME_CLIENT_SSL_CLIENT_AUTHENTICATION: 'REQUIRED' 
      METAHUB_KAFKASTORE_BOOTSTRAP_SERVERS: 'SSL://broker-1.tsoft.internal:9192,SSL://broker-2.tsoft.internal:9192,SSL://broker-3.tsoft.internal:9192'
      METAHUB_KAFKASTORE_SECURITY_PROTOCOL: 'SSL'
      METAHUB_KAFKASTORE_SSL_TRUSTSTORE_LOCATION: '/etc/t-soft/t-metahub/secrets/star.tsoft.internal.truststore.jks'
      METAHUB_KAFKASTORE_SSL_TRUSTSTORE_CREDENTIAL_FILE: 'star.tsoft.internal.ssl.truststore.credential'
      METAHUB_KAFKASTORE_SSL_KEYSTORE_LOCATION: '/etc/t-soft/t-metahub/secrets/databus-metahub.keystore.jks'
      METAHUB_KAFKASTORE_SSL_KEYSTORE_CREDENTIAL_FILE: 'databus-client.ssl.keystore.credential'
      METAHUB_KAFKASTORE_SSL_KEY_CREDENTIAL_FILE: 'databus-client.ssl.key.credential'
      METAHUB_METADATA_ENCODER_CREDENTIAL_FILE: 'metahub.metadata.encoder.credential'
      METAHUB_GROUP_ID: 'metahub-cluster'
      METAHUB_LEADER_ELIGIBILITY: true
    volumes:
      - ./include/secrets:/etc/t-soft/t-metahub/secrets:ro,z
    networks:
      my-network:
        aliases:
          - metahub-2.tsoft.internal

networks:
  my-network:
    external: true

⁠Production Recommendations

Do not commit secrets to source control.
Protect private keys and credential files on the host.
Keep the secret mount read-only.
Keep the application running as the non-root t-soft user.
Use certificates with appropriate SANs for the configured hostnames.
Keep client authentication enabled unless there is a deliberate security requirement to change it.
Ensure T-DataBus is reachable only through the intended SSL endpoint.
Verify that all required SSL keystores and truststores are present along with the credential files.

⁠Troubleshooting

⁠View Logs

podman logs <container-name>

or inspect:

/var/log/t-soft/t-metahub

Tag summary

Recent tags

Content type

Image

Digest

sha256:26afd4991…

Size

766.6 MB

Last updated

about 7 hours ago

docker pull tinsaetadesse/t-metahub