Chapter 11. Using the User Operator to manage Kafka users
When you create, modify or delete a user using the KafkaUser
resource, the User Operator ensures that these changes are reflected in the Kafka cluster.
For more information on the KafkaUser
resource, see the KafkaUser
schema reference.
11.1. Configuring Kafka users
Use the properties of the KafkaUser
resource to configure Kafka users.
You can use oc apply
to create or modify users, and oc delete
to delete existing users.
For example:
-
oc apply -f <user_config_file>
-
oc delete KafkaUser <user_name>
Users represent Kafka clients. When you configure Kafka users, you enable the user authentication and authorization mechanisms required by clients to access Kafka. The mechanism used must match the equivalent Kafka
configuration. For more information on using Kafka
and KafkaUser
resources to secure access to Kafka brokers, see Securing access to Kafka brokers.
Prerequisites
- A running Kafka cluster configured with a Kafka broker listener using mTLS authentication and TLS encryption.
- A running User Operator (typically deployed with the Entity Operator).
Procedure
Configure the
KafkaUser
resource.This example specifies mTLS authentication and simple authorization using ACLs.
Example Kafka user configuration
apiVersion: kafka.strimzi.io/v1beta2 kind: KafkaUser metadata: name: my-user-1 labels: strimzi.io/cluster: my-cluster spec: authentication: type: tls authorization: type: simple acls: # Example consumer Acls for topic my-topic using consumer group my-group - resource: type: topic name: my-topic patternType: literal operations: - Describe - Read host: "*" - resource: type: group name: my-group patternType: literal operations: - Read host: "*" # Example Producer Acls for topic my-topic - resource: type: topic name: my-topic patternType: literal operations: - Create - Describe - Write host: "*"
Create the
KafkaUser
resource in OpenShift.oc apply -f <user_config_file>
Wait for the ready status of the user to change to
True
:oc get kafkausers -o wide -w -n <namespace>
Kafka user status
NAME CLUSTER AUTHENTICATION AUTHORIZATION READY my-user-1 my-cluster tls simple True my-user-2 my-cluster tls simple my-user-3 my-cluster tls simple True
User creation is successful when the
READY
output showsTrue
.If the
READY
column stays blank, get more details on the status from the resource YAML or User Operator logs.Messages provide details on the reason for the current status.
oc get kafkausers my-user-2 -o yaml
Details on a user with a
NotReady
status# ... status: conditions: - lastTransitionTime: "2022-06-10T10:07:37.238065Z" message: Simple authorization ACL rules are configured but not supported in the Kafka cluster configuration. reason: InvalidResourceException status: "True" type: NotReady
In this example, the reason the user is not ready is because simple authorization is not enabled in the
Kafka
configuration.Kafka configuration for simple authorization
apiVersion: kafka.strimzi.io/v1beta2 kind: Kafka metadata: name: my-cluster spec: kafka: # ... authorization: type: simple
After updating the Kafka configuration, the status shows the user is ready.
oc get kafkausers my-user-2 -o wide -w -n <namespace>
Status update of the user
NAME CLUSTER AUTHENTICATION AUTHORIZATION READY my-user-2 my-cluster tls simple True
Fetching the details shows no messages.
oc get kafkausers my-user-2 -o yaml
Details on a user with a
READY
status# ... status: conditions: - lastTransitionTime: "2022-06-10T10:33:40.166846Z" status: "True" type: Ready