how does kafkaconnect know which kafka user to use

[cstmgl]

Hi all,

Another basic question from this guy. I'm trying to run a kafka connector jdbc and I'm having problems creating a topic because the user does not have permission.
I can create this new user but and give it permission to create the topic but I want to try and understand how does kafka know which user to take?
Somehow this is working for me before but I just don't understand how, does it just match based on the name? (connector + user?)
I could not find this in the documentation or in a quick google search.

This is the error I get:
"{aip-test-CODE_OBJ_TYPE=UNKNOWN_TOPIC_OR_PARTITION"

indeed the topic does not exist and I wonder can the kafka user get permissions to create the topic or I also need to create a kafka-topic first?

[scholzj]

The KafkaConnect custom resource has a section for configuring authentication. If you want Connect to connect to Kafka as some user, you have to specify it in the there. You can check the examples (IIRC there is example for both TLS and SCRAM-SHA) and the docs.

[cstmgl]

thanks I'll look into this.
I have something like this in my code but I wasn't sure if this was it.

  authentication:
    type: tls
    certificateAndKey:
      certificate: user.crt
      key: user.key
      secretName: @PROJECT_NAME@

so does this mean that I can only define the user at the connect level not for each connector correct?
also it might mean that I have way too many users that are actually not used in my current setup, because for example I was setting up users for my DLQs also and this seems they will not be used

[scholzj]

Yes, correct, this is it. There is one user used by Connect. I think it might have changed in newer Kafka versions, but at least for a long time this was the only way how it worked. And right now it is the only way we support.

[cstmgl]

that is fine, I think it was a miss understanding on my part.
but reading now the documentation I think I understand.
https://strimzi.io/docs/operators/0.20.0/using.html#proc-configuring-kafka-connect-user-authorization-str

I thought for each
kind: KafkaUser
we would create one new user but now I understand that this is just incrementing the roles and accesses for the current user.
I think I got it now, thank you