Kafka User config location inside the kafka pod

[mjrepo2]

Strimzi: 0.20.1

Hello, I am trying to execute kafka scripts inside the pod - for example kafka-topics.sh
I have scram-sha-512 enabled, and a kafka user with scram-sha also. How do I pass a proper --command-config ?
Where does Strimzi create the "user" configs for me to be able to use the CLI to check on the cluster? I don't see anything useable in the custom-config folder.

[scholzj]

The user credentials are not available anywhere in the Kafka pod. They are available in the secret created by the user operator. If you want to use them you can either copy them from there or mount it into the pod. Also, the general recommendation is to not run any commands from the broker or ZooKeeper pods - you should always start new separate pod for it to make sure you do not disturb the Kafka cluster (by starting a new JVM inside the broker pod you can for example cause resource issues etc.).

[mjrepo2]

I apologize in advance for the noob question, but do you know of any examples how I could "copy the secret" into the pod? I assume its not as simple as packing the secret into a .config and copying it over and using it directly?
I will also try to mount the secret - but then I am still unaware how to call the secret from the kafka CLI's...

[scholzj]

Well, you will have to create the config file with the configuration. You can either copy it into the pod using kubectl cp or create it directly inside the pod. The new partition reassignment guide is using TLS authentication and not SCRAM-SHA-512, but maybe it can give you an idea how to do it: https://strimzi.io/docs/operators/in-development/full/using.html#proc-generating-reassignment-json-files-str

[mjrepo2]

One part thats confusing me in the documentation you linked. I asked in a previous Q&A about having a user field in the kafka-user secret, and was told there isn't one and it isn't needed. Yet in the Docu it says to extract the user field from the secret, I am a bit perplexed?

Or is this only related to TLS* generated secrets?

[scholzj]

This just extracts the user certificate for the TLS authentication -> this will be different if you use SCRAM-SHA ... you would need to get and copy the JAAS configuration string.

[mjrepo2]

Just in case anyone needs it as well this scram-sha-512 config worked for me with --command-config

bootstrap.servers=kafka-cluster-kafka-bootstrap.kafka.svc.cluster.local:9092
sasl.mechanism=SCRAM-SHA-512
security.protocol=SASL_PLAINTEXT
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username='kafka-user' password='password';