Readonly Super User

[langemar]

Hi,

in Issue #2141 it was mentioned that it might be possible to use a wildcard for resource names in acl's. I would like to have a user with RO access to all topics, groups, cluster config, ... .
I've set up a user:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  name: akhq
  namespace: dnbt-oai-imp-mq
  labels:
    strimzi.io/cluster: oai-imp-mq
spec:
  authentication:
    type: scram-sha-512
  authorization:
    acls:
      - host: '*'
        operation: Read
        resource:
          name: '*'
          patternType: literal
          type: topic
        type: allow
      - host: '*'
        operation: Read
        resource:
          name: '*'
          patternType: literal
          type: group
        type: allow
      - host: '*'
        operation: Read
        resource:
          name: '*'
          patternType: literal
          type: cluster
        type: allow
      - host: '*'
        operation: Read
        resource:
          name: '*'
          patternType: literal
          type: transactionalId
        type: allow
    type: simple

there is a topic called test and when i try to user the kafka-console-consumer.sh shipped within the container I get the following:

# cat <<EOF > /tmp/consumer.properties
bootstrap.servers=imp-mq-kafka-ext-bootstrap:443
### SECURITY ######
security.protocol=SASL_SSL
sasl.mechanism=SCRAM-SHA-512
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule required username="akhq" password="****";
ssl.truststore.location=/tmp/kafka/cluster.truststore.p12
ssl.truststore.password=****
EOF
# bin/kafka-console-consumer.sh --bootstrap-server oai-imp-mq-kafka-ext-bootstrap:443 --group test --topic test --from-beginning --consumer.config /tmp/consumer.properties

[2021-06-15 11:06:06,627] WARN [Consumer clientId=consumer-test-1, groupId=test] Error while fetching metadata with correlation id 2 : {test=TOPIC_AUTHORIZATION_FAILED} (org.apache.kafka.clients.NetworkClient)
[2021-06-15 11:06:06,628] ERROR [Consumer clientId=consumer-test-1, groupId=test] Topic authorization failed for topics [test] (org.apache.kafka.clients.Metadata)
[2021-06-15 11:06:06,629] ERROR Error processing message, terminating consumer process:  (kafka.tools.ConsoleConsumer$)
org.apache.kafka.common.errors.TopicAuthorizationException: Not authorized to access topics: [test]
Processed a total of 0 messages

Can someone help?

best regards

[scholzj]

You should probably check the broker logs to see what errors are there. That might provide more details of what ACL are you missing.

[langemar]

@scholzj thanks for your replay, the problem was that there is no topic test its called TEST.

Thank you very much!