Is it possible to disable SASL and exclusively utilize an IP-based connection?

[runkecheng]

I attempted the following configuration without success. Despite my efforts, I continue to receive the Topic Authorization Failed: the client is not authorized to access the requested topic: Authorization failed. prompt when attempting to create a topic.

## my cr 
  kafka:
    authorization:
      superUsers:
      - kafka-root
      type: simple
    - authentication:
        listenerConfig:
          sasl.enabled.mechanisms: ""
          sasl.mechanism.inter.broker.protocol: ""
          security.inter.broker.protocol: PLAINTEXT
        sasl: false
        type: custom
      name: nopass
      port: 9099
      tls: false
      type: internal

## server.config

##########
# Listener configuration: NOPASS-9099
##########
listener.name.nopass-9099.sasl.enabled.mechanisms=
listener.name.nopass-9099.sasl.mechanism.inter.broker.protocol=
listener.name.nopass-9099.security.inter.broker.protocol=PLAINTEXT

Is it possible to establish a connection to the cluster within Kubernetes without any authentication, where the client only needs to configure the server's IP and port?

[runkecheng]

This is my client implementation：

	writer := &kafka.Writer{
		Addr:     kafka.TCP(Bootstrap),
		Topic:    topic,
		Balancer: &kafka.LeastBytes{},
		// Transport: sharedTransport,
	}
	defer writer.Close()

	client := NewKafkaClient()
	res, err := client.CreateTopics(context.TODO(), &kafka.CreateTopicsRequest{
		Topics: []kafka.TopicConfig{
			{
				Topic: topic,
			},
		},
	})
	if err != nil {
		fmt.Printf("err: %s", err.Error())
		return 
	}

[runkecheng]

After adding this configuration to the settings, I am able to establish a connection

allow.everyone.if.no.acl.found: "true"

bin/kafka-producer-perf-test.sh --producer-props bootstrap.servers=xxxx-bootstrap.<namespace>.svc:9092 --topic my-topic --throughput -1 --num-records 1000  --record-size 10

[scholzj]

SASL is not used unless you use it (i.e. using type: scram-sha-512 or type: oauth authentication). The configuration you shared makes no real sense -> you do not need to use type: custom authentication to disable authentication. You can just not configure the authentication.

[runkecheng]

SASL is not used unless you use it (i.e. using type: scram-sha-512 or type: oauth authentication). The configuration you shared makes no real sense -> you do not need to use type: custom authentication to disable authentication. You can just not configure the authentication.

Thank you for your help. this listener can be accessed seamlessly without the need for authentication after set allow.everyone.if.no.acl.found to true

listeners:
    - name: plain
      port: 9092
      tls: false
      type: internal

[scholzj]

I guess you should not enable authorization either? Then you don't have to care about setting allow.everyone.if.no.acl.found.