Kafka Connect の承認が有効である場合、Kafka Connect ユーザーを設定し、Kafka Connect のコンシューマーグループおよび内部トピックに読み書き権限を付与する必要があります。
apiVersion: kafka.strimzi.io/v1beta1
kind: KafkaConnect
metadata:
name: my-connect
spec:
# ...
config:
group.id: my-connect-cluster
offset.storage.topic: my-connect-cluster-offsets
config.storage.topic: my-connect-cluster-configs
status.storage.topic: my-connect-cluster-status
# ...
# ...
apiVersion: kafka.strimzi.io/v1beta1
kind: KafkaConnect
metadata:
name: my-connect
spec:
config:
group.id: my-connect-cluster
1
offset.storage.topic: my-connect-cluster-offsets
2
config.storage.topic: my-connect-cluster-configs
3
status.storage.topic: my-connect-cluster-status
4
Copy to Clipboard
Copied!
Toggle word wrap
Toggle overflow
この手順では、Kafka Connect のユーザーアクセスを承認する方法を説明します。
Kafka でいかなるタイプの承認が使用される場合、Kafka Connect ユーザーは Kafka Connect のコンシューマーグループおよび内部トピックへのアクセス権限が必要になります。
この手順では、simple
承認の使用時にアクセス権限が付与される方法を説明します。
簡易 (simple) 承認は、Kafka SimpleAclAuthorizer
プラグインによって処理される ACL ルールを使用し、適切なレベルのアクセス権限が提供されます。KafkaUser
リソースの設定による簡易承認の使用に関する詳細は Kafka User リソース を参照してください。
前提条件
-
OpenShift クラスター
-
稼働中の Cluster Operator
手順
KafkaUser
リソースの authorization
プロパティーを編集し、アクセス権限をユーザーに付与します。
以下の例では、literal
の名前の値を使用して Kafka Connect トピックおよびコンシューマーグループにアクセス権限が設定されます。
Expandプロパティー | 名前 |
---|
offset.storage.topic
|
connect-cluster-offsets
|
status.storage.topic
|
connect-cluster-status
|
config.storage.topic
|
connect-cluster-configs
|
group
|
connect-cluster
|
apiVersion: kafka.strimzi.io/v1beta1
kind: KafkaUser
metadata:
name: my-user
labels:
strimzi.io/cluster: my-cluster
spec:
# ...
authorization:
type: simple
acls:
# access to offset.storage.topic
- resource:
type: topic
name: connect-cluster-offsets
patternType: literal
operation: Write
host: "*"
- resource:
type: topic
name: connect-cluster-offsets
patternType: literal
operation: Create
host: "*"
- resource:
type: topic
name: connect-cluster-offsets
patternType: literal
operation: Describe
host: "*"
- resource:
type: topic
name: connect-cluster-offsets
patternType: literal
operation: Read
host: "*"
# access to status.storage.topic
- resource:
type: topic
name: connect-cluster-status
patternType: literal
operation: Write
host: "*"
- resource:
type: topic
name: connect-cluster-status
patternType: literal
operation: Create
host: "*"
- resource:
type: topic
name: connect-cluster-status
patternType: literal
operation: Describe
host: "*"
- resource:
type: topic
name: connect-cluster-status
patternType: literal
operation: Read
host: "*"
# access to config.storage.topic
- resource:
type: topic
name: connect-cluster-configs
patternType: literal
operation: Write
host: "*"
- resource:
type: topic
name: connect-cluster-configs
patternType: literal
operation: Create
host: "*"
- resource:
type: topic
name: connect-cluster-configs
patternType: literal
operation: Describe
host: "*"
- resource:
type: topic
name: connect-cluster-configs
patternType: literal
operation: Read
host: "*"
# consumer group
- resource:
type: group
name: connect-cluster
patternType: literal
operation: Read
host: "*"
apiVersion: kafka.strimzi.io/v1beta1
kind: KafkaUser
metadata:
name: my-user
labels:
strimzi.io/cluster: my-cluster
spec:
authorization:
type: simple
acls:
- resource:
type: topic
name: connect-cluster-offsets
patternType: literal
operation: Write
host: "*"
- resource:
type: topic
name: connect-cluster-offsets
patternType: literal
operation: Create
host: "*"
- resource:
type: topic
name: connect-cluster-offsets
patternType: literal
operation: Describe
host: "*"
- resource:
type: topic
name: connect-cluster-offsets
patternType: literal
operation: Read
host: "*"
- resource:
type: topic
name: connect-cluster-status
patternType: literal
operation: Write
host: "*"
- resource:
type: topic
name: connect-cluster-status
patternType: literal
operation: Create
host: "*"
- resource:
type: topic
name: connect-cluster-status
patternType: literal
operation: Describe
host: "*"
- resource:
type: topic
name: connect-cluster-status
patternType: literal
operation: Read
host: "*"
- resource:
type: topic
name: connect-cluster-configs
patternType: literal
operation: Write
host: "*"
- resource:
type: topic
name: connect-cluster-configs
patternType: literal
operation: Create
host: "*"
- resource:
type: topic
name: connect-cluster-configs
patternType: literal
operation: Describe
host: "*"
- resource:
type: topic
name: connect-cluster-configs
patternType: literal
operation: Read
host: "*"
- resource:
type: group
name: connect-cluster
patternType: literal
operation: Read
host: "*"
Copy to Clipboard
Copied!
Toggle word wrap
Toggle overflow
リソースを作成または更新します。
oc apply -f your-file
oc apply -f your-file
Copy to Clipboard
Copied!
Toggle word wrap
Toggle overflow