kafka-ui/documentation/compose/kafka-ui-jmx-secured.yml

---
version: '2'
services:

  kafka-ui:
    container_name: kafka-ui
    image: provectuslabs/kafka-ui:latest
    ports:
      - 8080:8080
    depends_on:
      - kafka0
    environment:
      KAFKA_CLUSTERS_0_NAME: local
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: kafka0:29092
      KAFKA_CLUSTERS_0_SCHEMAREGISTRY: http://schemaregistry0:8085
      KAFKA_CLUSTERS_0_KAFKACONNECT_0_NAME: first
      KAFKA_CLUSTERS_0_KAFKACONNECT_0_ADDRESS: http://kafka-connect0:8083
      KAFKA_CLUSTERS_0_METRICS_PORT: 9997
      KAFKA_CLUSTERS_0_METRICS_USERNAME: root
      KAFKA_CLUSTERS_0_METRICS_PASSWORD: password
      KAFKA_CLUSTERS_0_METRICS_KEYSTORE_LOCATION: /jmx/clientkeystore
      KAFKA_CLUSTERS_0_METRICS_KEYSTORE_PASSWORD: '12345678'
      KAFKA_CLUSTERS_0_SSL_TRUSTSTORE_LOCATION: /jmx/clienttruststore
      KAFKA_CLUSTERS_0_SSL_TRUSTSTORE_PASSWORD: '12345678'
    volumes:
      - ./jmx/clienttruststore:/jmx/clienttruststore
      - ./jmx/clientkeystore:/jmx/clientkeystore

  kafka0:
    image: confluentinc/cp-kafka:7.2.1
    hostname: kafka0
    container_name: kafka0
    ports:
      - 9092:9092
      - 9997:9997
    environment:
      KAFKA_BROKER_ID: 1
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: 'CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT,PLAINTEXT_HOST:PLAINTEXT'
      KAFKA_ADVERTISED_LISTENERS: 'PLAINTEXT://kafka0:29092,PLAINTEXT_HOST://localhost:9092'
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS: 0
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_JMX_PORT: 9997
      KAFKA_PROCESS_ROLES: 'broker,controller'
      KAFKA_NODE_ID: 1
      KAFKA_CONTROLLER_QUORUM_VOTERS: '1@kafka0:29093'
      KAFKA_LISTENERS: 'PLAINTEXT://kafka0:29092,CONTROLLER://kafka0:29093,PLAINTEXT_HOST://0.0.0.0:9092'
      KAFKA_INTER_BROKER_LISTENER_NAME: 'PLAINTEXT'
      KAFKA_CONTROLLER_LISTENER_NAMES: 'CONTROLLER'
      KAFKA_LOG_DIRS: '/tmp/kraft-combined-logs'
      # CHMOD 700 FOR JMXREMOTE.* FILES
      KAFKA_JMX_OPTS: >-
        -Dcom.sun.management.jmxremote
        -Dcom.sun.management.jmxremote.authenticate=true
        -Dcom.sun.management.jmxremote.ssl=true
        -Dcom.sun.management.jmxremote.registry.ssl=true
        -Dcom.sun.management.jmxremote.ssl.need.client.auth=true
        -Djavax.net.ssl.keyStore=/jmx/serverkeystore
        -Djavax.net.ssl.keyStorePassword=12345678
        -Djavax.net.ssl.trustStore=/jmx/servertruststore
        -Djavax.net.ssl.trustStorePassword=12345678
        -Dcom.sun.management.jmxremote.password.file=/jmx/jmxremote.password
        -Dcom.sun.management.jmxremote.access.file=/jmx/jmxremote.access
        -Dcom.sun.management.jmxremote.rmi.port=9997
        -Djava.rmi.server.hostname=kafka0
    volumes:
      - ./jmx/serverkeystore:/jmx/serverkeystore
      - ./jmx/servertruststore:/jmx/servertruststore
      - ./jmx/jmxremote.password:/jmx/jmxremote.password
      - ./jmx/jmxremote.access:/jmx/jmxremote.access
      - ./scripts/update_run.sh:/tmp/update_run.sh
    command: "bash -c 'if [ ! -f /tmp/update_run.sh ]; then echo \"ERROR: Did you forget the update_run.sh file that came with this docker-compose.yml file?\" && exit 1 ; else /tmp/update_run.sh && /etc/confluent/docker/run ; fi'"