Apache NiFi 2.x 3노드 클러스터 구성 가이드 — TLS 인증서, NiFi Registry, 외부 API 접근

# NiFi Toolkit 다운로드 (NiFi 버전과 동일하게)
wget https://archive.apache.org/dist/nifi/2.4.0/nifi-toolkit-2.4.0-bin.zip
unzip nifi-toolkit-2.4.0-bin.zip
cd nifi-toolkit-2.4.0

./bin/tls-toolkit.sh standalone \
  -n 'nifi1.example.com,nifi2.example.com,nifi3.example.com' \
  -C 'CN=admin, OU=NIFI' \
  -o ./certs \
  -K changeit \
  -S changeit \
  -P changeit \
  --days 825 \
  -k 2048

tree ./certs/

./bin/tls-toolkit.sh standalone \
  -n 'nifi1.example.com,nifi2.example.com,nifi3.example.com' \
  -C 'CN=admin, OU=NIFI' \
  --additionalCACertificate /path/to/existing-ca.pem \
  -o ./certs \
  -K changeit \
  -S changeit \
  -P changeit

# Keystore 내용 확인
keytool -list -v -keystore ./certs/nifi1.example.com/keystore.jks \
  -storepass changeit
 
# SAN, Key Usage, Extended Key Usage 확인
keytool -list -v -keystore ./certs/nifi1.example.com/keystore.jks \
  -storepass changeit | grep -A 5 "SubjectAlternativeName\|ExtendedKeyUsages\|KeyUsage"
 
# Truststore에 Root CA가 포함되어 있는지 확인
keytool -list -keystore ./certs/nifi1.example.com/truststore.jks \
  -storepass changeit

# 노드 1 (192.168.0.1)
scp ./certs/nifi1.example.com/keystore.jks  root@192.168.0.1:/opt/nifi/conf/
scp ./certs/nifi1.example.com/truststore.jks root@192.168.0.1:/opt/nifi/conf/
 
# 노드 2 (192.168.0.2)
scp ./certs/nifi2.example.com/keystore.jks  root@192.168.0.2:/opt/nifi/conf/
scp ./certs/nifi2.example.com/truststore.jks root@192.168.0.2:/opt/nifi/conf/
 
# 노드 3 (192.168.0.3)
scp ./certs/nifi3.example.com/keystore.jks  root@192.168.0.3:/opt/nifi/conf/
scp ./certs/nifi3.example.com/truststore.jks root@192.168.0.3:/opt/nifi/conf/

# 랜덤 키 생성
openssl rand -base64 32
# 출력 예: k8Jh3F7gT2mN9pQr4sVw6xYz1aBcDeF0hIjKlMnOpRs=

# ==================== Web Properties ====================
# HTTP를 비활성화하고 HTTPS만 사용
nifi.web.http.host=
nifi.web.http.port=
nifi.web.https.host={NODE_HOSTNAME}
nifi.web.https.port=8443
 
# ==================== Security Properties ====================
nifi.security.keystore=./conf/keystore.jks
nifi.security.keystoreType=jks
nifi.security.keystorePasswd=changeit
nifi.security.keyPasswd=changeit
nifi.security.truststore=./conf/truststore.jks
nifi.security.truststoreType=jks
nifi.security.truststorePasswd=changeit
 
# ==================== Sensitive Properties ====================
# 모든 노드에서 반드시 동일한 값
nifi.sensitive.props.key=k8Jh3F7gT2mN9pQr4sVw6xYz1aBcDeF0hIjKlMnOpRs=
 
# ==================== Cluster Properties ====================
nifi.cluster.is.node=true
nifi.cluster.node.address={NODE_HOSTNAME}
nifi.cluster.node.protocol.port=11443
nifi.cluster.protocol.is.secure=true
 
# ==================== ZooKeeper Properties ====================
nifi.state.management.embedded.zookeeper.start=true
nifi.zookeeper.connect.string=nifi1.example.com:2181,nifi2.example.com:2181,nifi3.example.com:2181
nifi.zookeeper.connect.timeout=10 secs
nifi.zookeeper.session.timeout=10 secs
 
# ==================== Cluster Load Balancing ====================
nifi.cluster.load.balance.host={NODE_HOSTNAME}
nifi.cluster.load.balance.port=6342

dataDir=./state/zookeeper
clientPort=2181
initLimit=10
syncLimit=5
tickTime=2000
autopurge.snapRetainCount=30
autopurge.purgeInterval=1
 
server.1=nifi1.example.com:2888:3888
server.2=nifi2.example.com:2888:3888
server.3=nifi3.example.com:2888:3888

# 노드 1 (192.168.0.1)
mkdir -p /opt/nifi/state/zookeeper
echo 1 > /opt/nifi/state/zookeeper/myid
 
# 노드 2 (192.168.0.2)
mkdir -p /opt/nifi/state/zookeeper
echo 2 > /opt/nifi/state/zookeeper/myid
 
# 노드 3 (192.168.0.3)
mkdir -p /opt/nifi/state/zookeeper
echo 3 > /opt/nifi/state/zookeeper/myid

<cluster-provider>
    <id>zk-provider</id>
    <class>org.apache.nifi.controller.state.providers.zookeeper.ZooKeeperStateProvider</class>
    <property name="Connect String">nifi1.example.com:2181,nifi2.example.com:2181,nifi3.example.com:2181</property>
    <property name="Root Node">/nifi</property>
    <property name="Session Timeout">10 seconds</property>
    <property name="Access Control">CreatorOnly</property>
</cluster-provider>

<authorizers>
    <userGroupProvider>
        <identifier>file-user-group-provider</identifier>
        <class>org.apache.nifi.authorization.FileUserGroupProvider</class>
        <property name="Users File">./conf/users.xml</property>
        <property name="Initial User Identity 1">CN=admin, OU=NIFI</property>
        <property name="Initial User Identity 2">CN=nifi1.example.com, OU=NIFI</property>
        <property name="Initial User Identity 3">CN=nifi2.example.com, OU=NIFI</property>
        <property name="Initial User Identity 4">CN=nifi3.example.com, OU=NIFI</property>
    </userGroupProvider>
 
    <accessPolicyProvider>
        <identifier>file-access-policy-provider</identifier>
        <class>org.apache.nifi.authorization.FileAccessPolicyProvider</class>
        <property name="User Group Provider">file-user-group-provider</property>
        <property name="Authorizations File">./conf/authorizations.xml</property>
        <property name="Initial Admin Identity">CN=admin, OU=NIFI</property>
        <property name="Node Identity 1">CN=nifi1.example.com, OU=NIFI</property>
        <property name="Node Identity 2">CN=nifi2.example.com, OU=NIFI</property>
        <property name="Node Identity 3">CN=nifi3.example.com, OU=NIFI</property>
    </accessPolicyProvider>
 
    <authorizer>
        <identifier>managed-authorizer</identifier>
        <class>org.apache.nifi.authorization.StandardManagedAuthorizer</class>
        <property name="Access Policy Provider">file-access-policy-provider</property>
    </authorizer>
</authorizers>

# firewalld 사용 시 (각 노드에서 실행)
firewall-cmd --permanent --add-port=8443/tcp
firewall-cmd --permanent --add-port=11443/tcp
firewall-cmd --permanent --add-port=6342/tcp
firewall-cmd --permanent --add-port=2181/tcp
firewall-cmd --permanent --add-port=2888/tcp
firewall-cmd --permanent --add-port=3888/tcp
firewall-cmd --reload

# 각 노드에서 실행
/opt/nifi/bin/nifi.sh start
 
# 로그 확인
tail -f /opt/nifi/logs/nifi-app.log

# 기존에 생성한 CA를 재사용하여 Registry 인증서 생성
./bin/tls-toolkit.sh standalone \
  -n 'nifi1.example.com' \
  -o ./certs-registry \
  -K changeit \
  -S changeit \
  -P changeit \
  --nifiDnPrefix 'CN=' \
  --nifiDnSuffix ', OU=NIFI-REGISTRY'

# CA 재사용 방법
mkdir -p ./certs-registry
cp ./certs/nifi-cert.pem ./certs-registry/
cp ./certs/nifi-key.key ./certs-registry/
 
./bin/tls-toolkit.sh standalone \
  -n 'nifi1.example.com' \
  -o ./certs-registry \
  -K changeit \
  -S changeit \
  -P changeit \
  --nifiDnPrefix 'CN=' \
  --nifiDnSuffix ', OU=NIFI-REGISTRY'

cp ./certs-registry/nifi1.example.com/keystore.jks  /opt/nifi-registry/conf/keystore.jks
cp ./certs-registry/nifi1.example.com/truststore.jks /opt/nifi-registry/conf/truststore.jks

# ==================== Web Properties ====================
nifi.registry.web.http.host=
nifi.registry.web.http.port=
nifi.registry.web.https.host=nifi1.example.com
nifi.registry.web.https.port=18443
 
# ==================== Security Properties ====================
nifi.registry.security.keystore=./conf/keystore.jks
nifi.registry.security.keystoreType=jks
nifi.registry.security.keystorePasswd=changeit
nifi.registry.security.keyPasswd=changeit
nifi.registry.security.truststore=./conf/truststore.jks
nifi.registry.security.truststoreType=jks
nifi.registry.security.truststorePasswd=changeit
nifi.registry.security.needClientAuth=true

<authorizers>
    <userGroupProvider>
        <identifier>file-user-group-provider</identifier>
        <class>org.apache.nifi.registry.security.authorization.file.FileUserGroupProvider</class>
        <property name="Users File">./conf/users.xml</property>
        <property name="Initial User Identity 1">CN=admin, OU=NIFI</property>
        <property name="Initial User Identity 2">CN=nifi1.example.com, OU=NIFI</property>
        <property name="Initial User Identity 3">CN=nifi2.example.com, OU=NIFI</property>
        <property name="Initial User Identity 4">CN=nifi3.example.com, OU=NIFI</property>
    </userGroupProvider>
 
    <accessPolicyProvider>
        <identifier>file-access-policy-provider</identifier>
        <class>org.apache.nifi.registry.security.authorization.file.FileAccessPolicyProvider</class>
        <property name="User Group Provider">file-user-group-provider</property>
        <property name="Authorizations File">./conf/authorizations.xml</property>
        <property name="Initial Admin Identity">CN=admin, OU=NIFI</property>
        <property name="NiFi Identity 1">CN=nifi1.example.com, OU=NIFI</property>
        <property name="NiFi Identity 2">CN=nifi2.example.com, OU=NIFI</property>
        <property name="NiFi Identity 3">CN=nifi3.example.com, OU=NIFI</property>
    </accessPolicyProvider>
 
    <authorizer>
        <identifier>managed-authorizer</identifier>
        <class>org.apache.nifi.registry.security.authorization.StandardManagedAuthorizer</class>
        <property name="Access Policy Provider">file-access-policy-provider</property>
    </authorizer>
</authorizers>

/opt/nifi-registry/bin/nifi-registry.sh start
tail -f /opt/nifi-registry/logs/nifi-registry-app.log

# 클라이언트 인증서 비밀번호 확인
cat ./certs/CN=admin_OU=NIFI.password
 
# PKCS12 인증서를 사용한 API 호출
curl -k --cert-type P12 \
  --cert ./certs/CN=admin_OU=NIFI.p12:<CLIENT_PASSWORD> \
  https://nifi1.example.com:8443/nifi-api/flow/status

# PKCS12를 PEM으로 변환 (인증서 + 키 분리)
openssl pkcs12 -in ./certs/CN=admin_OU=NIFI.p12 \
  -clcerts -nokeys -out client-cert.pem \
  -passin pass:<CLIENT_PASSWORD>
 
openssl pkcs12 -in ./certs/CN=admin_OU=NIFI.p12 \
  -nocerts -nodes -out client-key.pem \
  -passin pass:<CLIENT_PASSWORD>

import requests
 
response = requests.get(
    'https://nifi1.example.com:8443/nifi-api/flow/status',
    cert=('client-cert.pem', 'client-key.pem'),
    verify='./certs/nifi-cert.pem'  # Root CA 인증서로 서버 검증
)
print(response.json())

import javax.net.ssl.*;
import java.io.FileInputStream;
import java.net.http.*;
import java.net.URI;
import java.security.KeyStore;
 
// Keystore 로드 (클라이언트 인증서)
KeyStore keyStore = KeyStore.getInstance("PKCS12");
keyStore.load(new FileInputStream("CN=admin_OU=NIFI.p12"),
    "<CLIENT_PASSWORD>".toCharArray());
 
KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
kmf.init(keyStore, "<CLIENT_PASSWORD>".toCharArray());
 
// Truststore 로드 (Root CA)
KeyStore trustStore = KeyStore.getInstance("JKS");
trustStore.load(new FileInputStream("truststore.jks"),
    "changeit".toCharArray());
 
TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509");
tmf.init(trustStore);
 
// SSL Context 구성
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
 
// HTTP 클라이언트로 API 호출
HttpClient client = HttpClient.newBuilder()
    .sslContext(sslContext)
    .build();
 
HttpRequest request = HttpRequest.newBuilder()
    .uri(URI.create("https://nifi1.example.com:8443/nifi-api/flow/status"))
    .GET()
    .build();
 
HttpResponse<String> response = client.send(request,
    HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());

# 토큰 발급
TOKEN=$(curl -k -X POST \
  https://nifi1.example.com:8443/nifi-api/access/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'username=admin&password=your_password')
 
# 토큰을 사용한 API 호출
curl -k -H "Authorization: Bearer $TOKEN" \
  https://nifi1.example.com:8443/nifi-api/flow/status

# 추가 클라이언트 인증서 생성
./bin/tls-toolkit.sh standalone \
  -n 'nifi1.example.com' \
  -C 'CN=monitoring-system, OU=OPERATIONS' \
  -C 'CN=cicd-pipeline, OU=DEVOPS' \
  -o ./certs-clients \
  -K changeit \
  -S changeit \
  -P changeit

<!-- authorizers.xml에 추가 -->
<property name="Initial User Identity 5">CN=monitoring-system, OU=OPERATIONS</property>
<property name="Initial User Identity 6">CN=cicd-pipeline, OU=DEVOPS</property>

# Truststore 내용 확인
keytool -list -keystore truststore.jks -storepass changeit

# SAN 확인
keytool -list -v -keystore keystore.jks -storepass changeit | grep -A 3 "SubjectAlternativeName"

# 방화벽 포트 확인
nc -zv nifi2.example.com 11443

# myid 파일 확인
cat /opt/nifi/state/zookeeper/myid
 
# ZooKeeper 포트 확인
nc -zv nifi1.example.com 2181

# 인증서의 정확한 DN 확인
keytool -list -v -keystore keystore.jks -storepass changeit | grep "Owner:"
 
# 출력 예: Owner: CN=nifi1.example.com, OU=NIFI
# → authorizers.xml의 Node Identity와 정확히 일치해야 함