Kafkauser Secrets Not Created

[stuartm21]

I created a kafka cluster and kafka user in my k8s cluster. The kafka cluster is working fine. But the kafka user is not creating the secret in the k8s cluster.
kafka-user.yaml:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  name: kafka-user01
  namespace: kafka
  labels:
    strimzi.io/cluster: "strimzi"
spec:
  authentication:
    type: tls
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: kafka-topic
          patternType: literal
        operation: Read
        host: "*"
      - resource:
          type: group
          name: kafka-group
          patternType: literal
        operation: Read
        host: "*"

k -n kafka get ku                  
NAME           CLUSTER   AUTHENTICATION   AUTHORIZATION   READY
kafka-user01   strimzi   tls              simple          

While describing the kafka user, I am getting the status like this:

Status:
  Conditions:
    Last Transition Time:  2022-02-22T12:09:34.078608Z
    Message:               Simple authorization ACL rules are configured but not supported in the Kafka cluster configuration.
    Reason:                InvalidResourceException
    Status:                True
    Type:                  NotReady
  Observed Generation:     1
Events:                    <none>

Kafka-cluster:

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: strimzi
  namespace: kafka
spec:
  clusterCa:
    renewalDays: 30
    validityDays: 3650
    generateCertificateAuthority: true
  clientsCa:
    renewalDays: 30
    validityDays: 1095
    generateCertificateAuthority: true
  kafka:
    version: 3.0.0
    replicas: 1
    listeners:
      - name: external
        port: 9094
        type: ingress
        tls: true
        configuration:
          class: kafka
          bootstrap:
            host: dev-kafka-bootstrap.mydomain.com
            annotations:
              danm.k8s.io/interfaces: '[ {"clusterNetwork":"flannel-local", "ip": "dynamic"}, {"tenantNetwork":"tenant-vxlan", "ip": "dynamic"}]'
          brokers:
          - broker: 0
            host: dev-kafka-brokers.mydomain.com
            annotations:
              danm.k8s.io/interfaces: '[ {"clusterNetwork":"flannel-local", "ip": "dynamic"}, {"tenantNetwork":"tenant-vxlan", "ip": "dynamic"}]'
    config:
      offsets.topic.replication.factor: 1
      transaction.state.log.replication.factor: 1
      transaction.state.log.min.isr: 1
      inter.broker.protocol.version: "3.0"
      log.retention.hours: 1
    storage:
      type: ephemeral
    template:
      pod:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
                - matchExpressions:
                  - key: app
                    operator: In
                    values:
                    - kafka
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                - key: app.kubernetes.io/name
                  operator: In
                  values:
                  - kafka
              topologyKey: "kubernetes.io/hostname"
  zookeeper:
    replicas: 1
    storage:
      type: ephemeral
    template:
      pod:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
                - matchExpressions:
                  - key: app
                    operator: In
                    values:
                    - kafka
          podAntiAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                - key: app.kubernetes.io/name
                  operator: In
                  values:
                  - zookeeper
              topologyKey: "kubernetes.io/hostname"
  entityOperator:
    topicOperator: {}
    userOperator: {}

[scholzj]

I guess the error says it all. You want to configure the ACLs for a user, but you do not have authorization enabled in the Kafka cluster. Kafka does not allow to configure ACLs in that case. You do not even have authentication enabled, so you need to enable that as well to make some use of the Kafka User.

[stuartm21]

@scholzj I hope this is the one you are advising to me?

    listeners:
      - name: external
        port: 9094
        type: ingress
        tls: true
        authentication:
          type: tls

[scholzj]

Well, that is the authentication part. You will need to add the authorization part in .spec.kafka as well.

[stuartm21]

@scholzj Thank you, I have added like this:

  authorization: 
      type: simple

authentication part is really needed?

[scholzj]

None of this is really needed. But you need to decide how you want to use your clusters. Without authentication, you cannot really use authorization (how should it authorize someone without knowing who the someone is?). So you need to decide what do you want to do. You can use the cluster without authentication and authorization just fine if you don't care about this particular security aspect. But then you should not try to manage users and their permissions with KafkaUser resources because they would be anyway useless.