KafkaMirrorMaker2 offset-syncs.topic.location: "target" throws Authorization error, but user has access

[ginwakeup]

Hi there,

I am trying to setup a MM2 where I only have read access to the source cluster, therefore I am trying to use "target" as a location for the offset-syncs Topic location.

unfortunately I still get:

2023-02-09 21:46:00,440 WARN [***-kafka->messaging.MirrorCheckpointConnector|task-0] [Consumer clientId=consumer-null-6, groupId=null] Error while fetching metadata with correlation id 1938 : {mm2-offset-syncs.messaging.internal=TOPIC_AUTHORIZATION_FAILED} (org.apache.kafka.clients.NetworkClient) [task-thread-***-kafka->messaging.MirrorCheckpointConnector-0]
2023-02-09 21:46:00,440 ERROR [***-kafka->messaging.MirrorCheckpointConnector|task-0] [Consumer clientId=consumer-null-6, groupId=null] Topic authorization failed for topics [mm2-offset-syncs.messaging.internal] (org.apache.kafka.clients.Metadata) [task-thread-***-kafka->messaging.MirrorCheckpointConnector-0]
2023-02-09 21:46:00,440 WARN [***-kafka->messaging.MirrorCheckpointConnector|task-0] Failure polling consumer state for checkpoints. (org.apache.kafka.connect.mirror.MirrorCheckpointTask) [task-thread-***-kafka->messaging.MirrorCheckpointConnector-0]
org.apache.kafka.common.errors.TopicAuthorizationException: Not authorized to access topics: [mm2-offset-syncs.messaging.internal]

Here's my MM2 config:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaMirrorMaker2
metadata:
  name: kafka-mm-***-***
spec:
  replicas: 1
  image: ***
  template:
    pod:
      imagePullSecrets:
        - name: progetcred
  connectCluster: "target"
  clusters:
  - alias: "source-kafka"
    authentication:
      certificateAndKey:
        certificate: tls.crt
        key: tls.key
        secretName: source-tls
      type: tls
    tls:
      trustedCertificates:
        - secretName: source-ca
          certificate: digicaroot.cer
    bootstrapServers: "***"
    config:
      ssl.endpoint.identification.algorithm: ""

  - alias: "target"
    bootstrapServers: target-brokers:9092
    authentication:
      type: scram-sha-512
      username: ***
      passwordSecret:
        secretName: ***
        password: password
    config:
      config.storage.replication.factor: 4
      offset.storage.replication.factor: 4
      status.storage.replication.factor: 4
      ssl.endpoint.identification.algorithm: ""
      offset.storage.cleanup.policy: "compact"

  mirrors:
  - sourceCluster: "source-kafka"
    targetCluster: "target"
    sourceConnector:
      config:
        replication.factor: 4
        min.insync.replica: 2
        config.storage.replication.factor: 4
        offset.storage.cleanup.policy: "compact"
        offset.storage.replication.factor: 4
        status.storage.replication.factor: 4
        offset.syncs.topic.replication.factor: 4
        sync.topic.acls.enabled: "false"
        config.storage.cleanup.policy: "compact"
        status.storage.cleanup.policy: "compact"
        offset-syncs.topic.location: "target"

    heartbeatConnector:
      config:
        heartbeats.topic.replication.factor: 4
        min.insync.replica: 2

    checkpointConnector:
      config:
        checkpoints.topic.replication.factor: 4
        min.insync.replica: 2

    topicsPattern: "****"

My user:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  name: ***
  labels:
    strimzi.io/cluster: ***
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      # MirrorSourceConnector
      - resource: 
          type: topic
          name: mirrormaker2-cluster-offsets
        operations:
          - Create
          - DescribeConfigs
          - Read
          - Write
      - resource: 
          type: topic
          name: heartbeats
        operations:
          - Create
          - DescribeConfigs
          - Read
          - Write
      - resource:
          type: topic
          name: mirrormaker2-cluster-status
        operations:
          - Create
          - DescribeConfigs
          - Read
          - Write
      - resource: 
          type: topic
          name: mirrormaker2-cluster-configs
        operations:
          - Create
          - DescribeConfigs
          - Read
          - Write
      - resource: 
          type: topic
          name: ***
        operations:
          - Read
          - DescribeConfigs
          - Write
          - Create
      - resource:
          type: cluster
        operations:
          - Describe
      - resource: # Needed for every group for which offsets are synced
          type: group
          name: "*"
        operations:
          - Describe
          - Write
          - Read
          - Create
      - resource: # Needed for every topic which is mirrored
          type: topic
          name: mm2-offset-syncs.target.internal
          patternType: literal
        operations:
          - Read
          - DescribeConfigs
          - Write
          - Create
          - Describe

[ginwakeup]

Ok it seems like I fixed it. Weird, I had to create the offset-syncs Topic manually, as apparently MM2 won't create it.
Also I had to specify it inside checkpointConnector configs.