Hi everyone,
I’m encountering an issue while working with a KRaft-mode Kafka cluster. I can list ACLs without any issues, but when I try to add a new ACL, I get the following error:
Error while executing ACL command: org.apache.kafka.common.errors.SecurityDisabledException: No Authorizer is configured.
Here’s the command I’m running to add the ACL:
kafka-acls --bootstrap-server broker01.abc.net:9094 --command-config adminclient.properties --add --allow-principal User:testing --operation Read --operation Write --topic '*'
I’ve confirmed that the authorizer is supposed to be configured, as I have set the KAFKA_AUTHORIZER_CLASS_NAME to org.apache.kafka.metadata.authorizer.StandardAuthorizer in the environment variables.
Cluster Setup:
- 3-node KRaft cluster, with each node running both broker and controller containers in isolated mode.
- 6 containers in total: 3 for brokers and 3 for controllers.
- I’m using KAFKA_KRAFT_MODE=“true” in all the relevant containers.
Error Details:
When running the kafka-acls command, I get the following error message:
org.apache.kafka.common.errors.SecurityDisabledException: No Authorizer is configured.
Playbook: Here is the relevant portion of my Ansible playbook used to configure Kafka:
* name: Setup Kafka with KRaft and SSL
hosts: kafka
become: yes
vars:
kafka_version: "7.8.0"
kafka_container_name: "kafka"
kafka_volume_broker: "kafka-data-broker"
kafka_volume_controller: "kafka-data-controller"
kafka_data_dir_broker: "/var/lib/kafka/data"
kafka_data_dir_controller: "/var/lib/kafka/data"
kafka_env:
KAFKA_KRAFT_MODE: "true"
KAFKA_AUTHORIZER_CLASS_NAME: "org.apache.kafka.metadata.authorizer.StandardAuthorizer"
KAFKA_SASL_ENABLED_MECHANISMS: "PLAIN"
KAFKA_SECURITY_INTER_BROKER_PROTOCOL: "SASL_SSL"
KAFKA_SUPER_USERS: "User:admin"
KAFKA_LISTENERS: "SASL_SSL://:9094,SASL_SSL01://:19094,SASL_SSL02://:29094"
Troubleshooting Attempts:
- I have verified the
KAFKA_AUTHORIZER_CLASS_NAMEis correctly set toStandardAuthorizerfor both brokers and controllers. - I also tried using a different properties file (
kafka.properties), but then I encountered a TimeoutException with the error:
Timed out waiting for a node assignment. Call: createAcls
Broker kafka.properties:
properties
replica.fetch.max.bytes=1152921504
ssl.keystore.filename=kafka.keystore.jks
super.users=User:admin
default.replication.factor=1
transaction.state.log.min.isr=1
ssl.key.credentials=kafka_ssl_key_creds
process.roles=broker
security.inter.broker.protocol=SASL_SSL
controller.listener.names=CONTROLLER
controller.quorum.voters=1@broker01.abc.net:29092,2@broker02.abc.net:29092,3@broker03.abc.net:29092
message.max.bytes=1152921504
auto.create.topics.enable=false
node.id=6
ssl.key.password=XXXXXX
ssl.truststore.password=YYYYYY
ssl.keystore.type=JKS
log.retention.ms=604800000
metadata.load.timeout.ms=60000
advertised.listeners=SASL_SSL://broker03.abc.net:9094,SASL_SSL01://broker02.abc.net:19094,SASL_SSL02://broker01.abc.net:29094
sasl.enabled.mechanisms=PLAIN
kraft.mode=true
listener.security.protocol.map=SASL_SSL01:SASL_SSL,SASL_SSL02:SASL_SSL,CONTROLLER:PLAINTEXT,SASL_SSL:SASL_SSL,SSL:SSL
ssl.truststore.filename=kafka.truststore.jks
fetch.message.max.bytes=1152921504
authorizer.class.name=org.apache.kafka.metadata.authorizer.StandardAuthorizer
ssl.truststore.credentials=kafka_truststore_creds
log.retention.hours=168
broker.rack=Test123
ssl.keystore.password=XXXXX
min.insync.replicas=1
transaction.state.log.replication.factor=1
listeners=SASL_SSL://:9094,SASL_SSL01://:19094,SASL_SSL02://:29094
ssl.keystore.location=/etc/kafka/secrets/kafka.keystore.jks
zookeeper.connect=
sasl.mechanism.inter.broker.protocol=PLAIN
ssl.truststore.location=/etc/kafka/secrets/kafka.truststore.jks
ssl.endpoint.identification.algorithm=
ssl.truststore.type=JKS
log.dirs=/var/lib/kafka/data
offsets.topic.replication.factor=1
allow.everyone.if.no.acl.found=true
ssl.client.auth=required
ssl.keystore.credentials=kafka_keystore_creds
Controller kafka.properties:
inter.broker.listener.name=SASL_SSL
transaction.state.log.min.isr=1
process.roles=controller
controller.listener.names=CONTROLLER
group.initial.rebalance.delay.ms=0
controller.quorum.voters=1@broker01.abc.net:29092,2@broker02.abc.net:29092,3@broker03.abc.net:29092
node.id=3
kraft.mode=true
transaction.state.log.replication.factor=1
listeners=CONTROLLER://:29092
zookeeper.connect=
log.dirs=/var/lib/kafka/data
offsets.topic.replication.factor=1
Has anyone faced a similar issue or has any suggestions on what might be misconfigured in my setup? Any help or insights would be greatly appreciated!
Thanks in advance!