如何为代理设置 kafka ACL？

Question

我在配置 Kafka Acls 代理时遇到了一些问题。

我正在为我的项目使用 bitnami docker-compose-cluster.yml，我想为每个代理设置身份验证

我用以下内容创建了 kafka_jass.conf 文件：

kafkabroker {
        security.protocol=SASL_PLAINTEXT
        sasl.mechanism=PLAIN
        sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required
        username="alice"
        password="******";
};

并将这些行添加到每个代理的 docker compose 中：

KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CLIENT:PLAINTEXT,EXTERNAL:PLAINTEXT,SASL_PLAINTEXT:PLAINTEXT
KAFKA_CFG_LISTENERS=CLIENT://:29092,EXTERNAL://0.0.0.0:9092,SASL_PLAINTEXT://broker1:9095
KAFKA_CFG_ADVERTISED_LISTENERS=CLIENT://broker1:29092,EXTERNAL://******:9092,SASL_PLAINTEXT://localhost:9095
security.inter.broker.protocol=SASL_PLAINTEXT

和 server.properties 的这一行：

authorizer.class.name=kafka.security.authorizer.AclAuthorizer

启动 docker compose 后，我收到每个代理的此错误：

[2022-12-06 06:47:19,679] ERROR Exiting Kafka due to fatal exception (kafka.Kafka$)
broker1    | org.apache.kafka.common.KafkaException: Exception while loading Zookeeper JAAS login context [java.security.auth.login.config=/opt/bitnami/kafka/config/kafka_jaas.conf, zookeeper.sasl.client=default:true, zookeeper.sasl.clientconfig=default:Client]
broker1    |    at org.apache.kafka.common.security.JaasUtils.isZkSaslEnabled(JaasUtils.java:67)
broker1    |    at kafka.server.KafkaServer$.zkClientConfigFromKafkaConfig(KafkaServer.scala:79)
broker1    |    at kafka.server.KafkaServer.<init>(KafkaServer.scala:149)
broker1    |    at kafka.Kafka$.buildServer(Kafka.scala:73)
broker1    |    at kafka.Kafka$.main(Kafka.scala:87)
broker1    |    at kafka.Kafka.main(Kafka.scala)
broker1    | Caused by: java.lang.SecurityException: java.io.IOException: Configuration Error:
broker1    |    Line 2: expected [controlFlag]

更新问题：

这是 docker 撰写的内容：

version: "2"

services:
  zookeeper:
    image: dockerhub.******/bitnami/zookeeper:3.8
    hostname: zookeeper,SASL_PLAINTEXT://localhost:9091
    container_name: zookeeper
    ports:
      - '2181:2181'
    environment:
      - ALLOW_ANONYMOUS_LOGIN=yes
      - KAFKA_OPTS="-Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider -Djava.security.auth.login.config=/opt/bitnami/kafka/config/zookeeper-server.jaas"
    volumes:
      - ./config:/opt/bitnami/kafka/config

  kafka-0:
    image: dockerhub.******/bitnami/kafka:3.2
    hostname: broker1
    container_name: broker1
    ports:
      - '9092:9092'
    volumes:
      - ./config/broker1:/bitnami
      - ./config/broker1/kafka/config/server.properties:/bitnami/kafka/config/server.properties
    environment:
      - KAFKA_BROKER_ID=1
      - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CLIENT:SASL_PLAINTEXT,EXTERNAL:SASL_PLAINTEXT
      - KAFKA_CFG_LISTENERS=CLIENT://0.0.0.0:29092,EXTERNAL://0.0.0.0:9092
      - KAFKA_CFG_ADVERTISED_LISTENERS=CLIENT://broker1:29092,EXTERNAL://*****:9092
      - KAFKA_CFG_INTER_BROKER_LISTENER_NAME=CLIENT
      - KAFKA_CFG_ZOOKEEPER_CONNECT=zookeeper:2181
      - ALLOW_PLAINTEXT_LISTENER=yes
      - KAFKA_INTER_BROKER_LISTENER_NAME=SASL_PLAINTEXT
      - KAFKA_CFG_SASL_MECHANISM_INTER_BROKER_PROTOCOL=PLAIN
      - KAFKA_CFG_SASL_ENABLED_MECHANISMS=PLAIN
      - KAFKA_CFG_LISTENER_NAME_EXTERNAL_SASL_ENABLED_MECHANISMS=PLAIN
      - KAFKA_CFG_LISTENER_NAME_EXTERNAL_PLAIN_SASL_JAAS_CONFIG="org.apache.kafka.common.security.plain.PlainLoginModule required user_admin='admin-secret' user_producer='producer-secret' user_consumer='consu>      
      - KAFKA_CFG_LISTENER_NAME_CLIENT_SASL_ENABLED_MECHANISMS=PLAIN
      - KAFKA_CFG_LISTENER_NAME_CLIENT_PLAIN_SASL_JAAS_CONFIG="org.apache.kafka.common.security.plain.PlainLoginModule required user_broker='broker-secret' username='broker' password='*****';"
      - KAFKA_CFG_SUPER_USERS="User:broker;User:admin"
      - KAFKA_CFG_ALLOW_EVERYONE_IF_NO_ACL_FOUND="false"
      - KAFKA_CFG_ZOOKEEPER_SET_ACL="true"
      - KAFKA_CFG_OPTS="-Djava.security.auth.login.config=/opt/bitnami/kafka/config/kafka-server.jaas"
    depends_on:
      - zookeeper
      

Answer 1

您的 JAAS 文件格式不正确。前两个选项是 Kafka 代理属性，而不是 JAAS 条目。

这是您需要的最少信息，但您也可以在此处添加其他用户。

参考。 https://docs.confluent.io/platform/current/kafka/authentication_sasl/index.html

KafkaServer {
   org.apache.kafka.common.security.plain.PlainLoginModule required
        username="alice"
        password="******";
};

关于您的容器，您不能直接编辑服务器属性；这就是环境变量已经做的事情。使用KAFKA_CFG_AUTHORIZER_CLASS。类似地，中间代理协议需要大写和适当的前缀以便 bitnami 容器使用它。

此外，请查看 bitnami Kafka 容器的自述文件，它已经提供了通过额外环境变量配置身份验证和用户帐户的方法。