2.2.3. 配置 Kafka Connect 用户授权
这个步骤描述了如何授权用户对 Kafka Connect 的访问。
当 Kafka 中使用任何类型的授权时,Kafka Connect 用户需要对消费者组的读/写访问权限以及 Kafka Connect 的内部主题。
用户组和内部主题的属性由 AMQ Streams 自动配置,或者可以在 KafkaConnect 或
资源的 KafkaConnect
S2Ispec
中明确指定。
KafkaConnect
资源中的配置属性示例
apiVersion: kafka.strimzi.io/v1beta2 kind: KafkaConnect metadata: name: my-connect spec: # ... config: group.id: my-connect-cluster 1 offset.storage.topic: my-connect-cluster-offsets 2 config.storage.topic: my-connect-cluster-configs 3 status.storage.topic: my-connect-cluster-status 4 # ... # ...
此流程演示了在使用 简单
授权时如何提供访问权限。
简单的授权使用由 Kafka AclAuthorizer
插件处理的 ACL 规则来提供正确的访问级别。有关将 KafkaUser
资源配置为使用简单授权的更多信息,请参阅 AclRule
schema 引用。
运行多个实例时,使用者组和主题的默认值将有所不同。
先决条件
- OpenShift 集群
- 一个正在运行的 Cluster Operator
流程
编辑
KafkaUser
资源中的授权
属性,以便为用户提供访问权限。在以下示例中,使用
字面
名称值为 Kafka Connect 主题和消费者组配置访问权限:属性 名称 offset.storage.topic
connect-cluster-offsets
status.storage.topic
connect-cluster-status
config.storage.topic
connect-cluster-configs
group
connect-cluster
apiVersion: kafka.strimzi.io/v1beta2 kind: KafkaUser metadata: name: my-user labels: strimzi.io/cluster: my-cluster spec: # ... authorization: type: simple acls: # access to offset.storage.topic - resource: type: topic name: connect-cluster-offsets patternType: literal operation: Write host: "*" - resource: type: topic name: connect-cluster-offsets patternType: literal operation: Create host: "*" - resource: type: topic name: connect-cluster-offsets patternType: literal operation: Describe host: "*" - resource: type: topic name: connect-cluster-offsets patternType: literal operation: Read host: "*" # access to status.storage.topic - resource: type: topic name: connect-cluster-status patternType: literal operation: Write host: "*" - resource: type: topic name: connect-cluster-status patternType: literal operation: Create host: "*" - resource: type: topic name: connect-cluster-status patternType: literal operation: Describe host: "*" - resource: type: topic name: connect-cluster-status patternType: literal operation: Read host: "*" # access to config.storage.topic - resource: type: topic name: connect-cluster-configs patternType: literal operation: Write host: "*" - resource: type: topic name: connect-cluster-configs patternType: literal operation: Create host: "*" - resource: type: topic name: connect-cluster-configs patternType: literal operation: Describe host: "*" - resource: type: topic name: connect-cluster-configs patternType: literal operation: Read host: "*" # consumer group - resource: type: group name: connect-cluster patternType: literal operation: Read host: "*"
创建或更新资源。
oc apply -f KAFKA-USER-CONFIG-FILE