Cruise Control REST API unavailable on 0.28?

[talonx]

In past versions of Kafka clusters deployed with cruise control we have used the CC REST API to add/remove brokers (i.e. move partitions to/from). In the 0.28 version the REST API seems to be unavailable. Any way to access it?

[scholzj]

The APi was never accessible AFAIK. You always had to hack around to make it accessible. @kyguy might now if something changes in the way you should do it.

[ppatierno]

How were you accessing it in the past? Were you disabling the HTTP Basic auth and then SSL, port-forwarding the API?
Of course @kyguy can provide you more insights on this.
But related to your problem, I would like to mention this proposal. It was approved and I am working on the corresponding implementation.
In one of the next releases, you should be able to add/remove brokers and doing rebalancing by using the KafkaRebalance resource, so no CC REST API access needed anymore.

[talonx]

Well in a previous version of the operator the API was accessible - and it was exposed without HTTPS and auth. A simple curl (no SSL, or basic auth) used to work both from inside the pod or using port forwarding.

"In one of the next releases, you should be able to add/remove brokers and doing rebalancing by using the KafkaRebalance resource, so no CC REST API access needed anymore." - this is interesting, but I need to do this with the current brokers I have.

Is there any way to access the API in 0.28? What auth is required?

[kyguy]

Hey @talonx, we added HTTPS and auth and enabled it by default in Strimzi v0.26, but as @ppatierno mentioned you can disable it like this:

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: my-cluster
spec:
  # ...
  cruiseControl:
    config:
      webserver.security.enable: false
      webserver.ssl.enable: false
# ...

to have the same functionality as before Strimzi 0.26. For more information, check out the Cruise Control REST API security section here [1].

[1] https://strimzi.io/docs/operators/latest/configuring.html#ref-cruise-control-configuration-str

[talonx]

Thanks @kyguy - that helps. The previous operator version we were using was pretty old so the API was accessible without TLS/auth. I'll try disabling it with the config you gave.

[talonx]

This worked - thanks @kyguy