Chapter 11. Using the User Operator to manage Kafka users

Procedure

1. Configure the KafkaUser resource.

   This example specifies mTLS authentication and simple authorization using ACLs.

   Example Kafka user configuration

   apiVersion: kafka.strimzi.io/v1beta2
   kind: KafkaUser
   metadata:
     name: my-user-1
     labels:
       strimzi.io/cluster: my-cluster
   spec:
     authentication:
       type: tls
     authorization:
       type: simple
       acls:
         # Example consumer Acls for topic my-topic using consumer group my-group
         - resource:
             type: topic
             name: my-topic
             patternType: literal
           operations:
             - Describe
             - Read
           host: "*"
         - resource:
             type: group
             name: my-group
             patternType: literal
           operations:
             - Read
           host: "*"
         # Example Producer Acls for topic my-topic
         - resource:
             type: topic
             name: my-topic
             patternType: literal
           operations:
             - Create
             - Describe
             - Write
           host: "*"

2. Create the KafkaUser resource in OpenShift.

   oc apply -f <user_config_file>

3. Wait for the ready status of the user to change to True:

   oc get kafkausers -o wide -w -n <namespace>

   Kafka user status

   NAME       CLUSTER     AUTHENTICATION  AUTHORIZATION READY
   my-user-1  my-cluster  tls             simple        True
   my-user-2  my-cluster  tls             simple
   my-user-3  my-cluster  tls             simple        True

   User creation is successful when the READY output shows True.

4. If the READY column stays blank, get more details on the status from the resource YAML or User Operator logs.

   Messages provide details on the reason for the current status.

   oc get kafkausers my-user-2 -o yaml

   Details on a user with a NotReady status

   # ...
   status:
     conditions:
     - lastTransitionTime: "2022-06-10T10:07:37.238065Z"
       message: Simple authorization ACL rules are configured but not supported in the
         Kafka cluster configuration.
       reason: InvalidResourceException
       status: "True"
       type: NotReady

   In this example, the reason the user is not ready is because simple authorization is not enabled in the Kafka configuration.

   Kafka configuration for simple authorization

     apiVersion: kafka.strimzi.io/v1beta2
     kind: Kafka
     metadata:
       name: my-cluster
     spec:
       kafka:
         # ...
         authorization:
           type: simple

   After updating the Kafka configuration, the status shows the user is ready.

   oc get kafkausers my-user-2 -o wide -w -n <namespace>

   Status update of the user

   NAME       CLUSTER     AUTHENTICATION  AUTHORIZATION READY
   my-user-2  my-cluster  tls             simple        True

   Fetching the details shows no messages.

   oc get kafkausers my-user-2 -o yaml

   Details on a user with a READY status

   # ...
   status:
     conditions:
     - lastTransitionTime: "2022-06-10T10:33:40.166846Z"
       status: "True"
       type: Ready