Strimzi
-
|
I would like to enable auth on a Strimzi Cluster ( testing out with latest version 0.32). We have our own tooling to create Kafka Users and share secrets. The one KafkaUser I created for the admin aside, any other user that we create via our own tooling gets deleted by the UserOperator. I was looking at the UserOperator code, but its not apparent to me there is a way to avoid this situation. With the topicOperator I've encountered exactly what we need -- we create the topics and the reconciler adds the KafkaTopic resources. Any suggestions much appreciated. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 4 replies
-
|
Yes, that is exactly how it was designed to work. The If you want to use your own tooling for managing users, that is fine - you can simply disable the User Operator by removing the User Operator section from the Kafka custom resource. |
Beta Was this translation helpful? Give feedback.
-
|
PS: Yes, the Topic Operator behaves differently. But when it comes to operators, it is rather an exception which doesn't follow the pattern. The main reason for that is that there are many applications creating their own topics ... such as Kafka Connect or the Streams API. So the operator pattern would not work for it otherwise. |
Beta Was this translation helpful? Give feedback.
-
|
Got it thanks for clearing that up. One follow up question -- how would one go about creating the first user, without having to load in a jaas file? I can tell the Kafka resource that "admin" is a superUser, but as far as I can tell, I would still need to load in a user/password with the scram mechanism we intend to use. |
Beta Was this translation helpful? Give feedback.
-
|
You mean when the User Operator is disabled? That is an interesting question which I think nobody asked before I guess 🤔. I guess you would need to start with some listener without authentication, setup the initial users and then disable the listener without authentication (or enable the authentication). Another possible workaround would be to start with the User Operator enabled, create the first user and disable the User Operator (it will not delete the users when being disabled if the KafkaUser resources still exist). |
Beta Was this translation helpful? Give feedback.
-
|
Got it. Thanks a ton for the quick responses! Will think more about how to proceed. 🙏 |
Beta Was this translation helpful? Give feedback.
Yes, that is exactly how it was designed to work. The
KafkaUserresources are the single source of truth -> so when a user doesn't exist there, it should not exist in Kafka either.If you want to use your own tooling for managing users, that is fine - you can simply disable the User Operator by removing the User Operator section from the Kafka custom resource.