Skip to content

Handle ClusterAuthorizationException when loading quorum info for limited-permission accounts #1672

@CoderYellow

Description

@CoderYellow

Issue submitter TODO list

  • I've looked up my issue in FAQ
  • I've searched for an already existing issues here
  • I've tried running main-labeled docker image and the issue still persists there
  • I'm running a supported version of the application which is listed here

Describe the bug (actual behavior)

Hi team,

In the following code:

  @NotNull
  private static Mono<Optional<QuorumInfo>> loadQuorumInfo(ReactiveAdminClient ac) {
    return ac.describeMetadataQuorum()
        .map(Optional::of)
        .onErrorResume(t ->
            t instanceof UnsupportedVersionException
                ? Mono.just(Optional.empty())
                : Mono.error(t)
        );
  }

We’ve observed that describeMetadataQuorum() can also throw:

org.apache.kafka.common.errors.ClusterAuthorizationException: Cluster authorization failed.

In this scenario, the exception prevents Kafka-UI from functioning correctly, even though quorum metadata is only used for display purposes in the UI and is not essential for core functionality.

Expected behavior

Would it make sense to:

  1. Also ignore ClusterAuthorizationException and return Optional.empty(), similar to how UnsupportedVersionException is handled?

  2. Or more generally, ignore all exceptions for this call if the quorum info is only used for UI display?

This would allow Kafka-UI to work properly with restricted-service accounts, which are common in production environments.

Happy to help with a PR if this approach makes sense.

Your installation details

Commit 2c1dc19

Steps to reproduce

use below account for testing

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  name: teset
  labels:
    strimzi.io/cluster: test-cluster
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: bronze-
          patternType: prefix
        operations:
          - Read
      - resource:
          type: topic
          name: bronze-
          patternType: prefix
        operations:
          - Write
      - resource:
          type: topic
          name: bronze-
          patternType: prefix
        operations:
          - Describe
      - resource:
          type: group
          name: bronze-
          patternType: prefix
        operations:
          - Read

Screenshots

No response

Logs

No response

Additional context

No response

Metadata

Metadata

Assignees

Labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions