2.2.3. 配置 Kafka Connect 用户授权
这个步骤描述了如何授权用户对 Kafka Connect 的访问。
当 Kafka 中使用任何类型的授权时，Kafka Connect 用户需要对消费者组的读/写访问权限以及 Kafka Connect 的内部主题。
用户组和内部主题的属性由 AMQ Streams 自动配置，或者可以在 KafkaConnect 或 资源的 KafkaConnect S2Ispec 中明确指定。
KafkaConnect 资源中的配置属性示例
apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaConnect
metadata:
name: my-connect
spec:
# ...
config:
group.id: my-connect-cluster 1
offset.storage.topic: my-connect-cluster-offsets 2
config.storage.topic: my-connect-cluster-configs 3
status.storage.topic: my-connect-cluster-status 4
# ...
# ...
此流程演示了在使用 简单 授权时如何提供访问权限。
简单的授权使用由 Kafka AclAuthorizer 插件处理的 ACL 规则来提供正确的访问级别。有关将 KafkaUser 资源配置为使用简单授权的更多信息，请参阅 AclRule schema 引用。
运行多个实例时，使用者组和主题的默认值将有所不同。
先决条件
- OpenShift 集群
- 一个正在运行的 Cluster Operator
流程
编辑
KafkaUser资源中的授权属性，以便为用户提供访问权限。在以下示例中，使用
字面名称值为 Kafka Connect 主题和消费者组配置访问权限：属性 名称 offset.storage.topicconnect-cluster-offsetsstatus.storage.topicconnect-cluster-statusconfig.storage.topicconnect-cluster-configsgroupconnect-clusterapiVersion: kafka.strimzi.io/v1beta2 kind: KafkaUser metadata: name: my-user labels: strimzi.io/cluster: my-cluster spec: # ... authorization: type: simple acls: # access to offset.storage.topic - resource: type: topic name: connect-cluster-offsets patternType: literal operation: Write host: "*" - resource: type: topic name: connect-cluster-offsets patternType: literal operation: Create host: "*" - resource: type: topic name: connect-cluster-offsets patternType: literal operation: Describe host: "*" - resource: type: topic name: connect-cluster-offsets patternType: literal operation: Read host: "*" # access to status.storage.topic - resource: type: topic name: connect-cluster-status patternType: literal operation: Write host: "*" - resource: type: topic name: connect-cluster-status patternType: literal operation: Create host: "*" - resource: type: topic name: connect-cluster-status patternType: literal operation: Describe host: "*" - resource: type: topic name: connect-cluster-status patternType: literal operation: Read host: "*" # access to config.storage.topic - resource: type: topic name: connect-cluster-configs patternType: literal operation: Write host: "*" - resource: type: topic name: connect-cluster-configs patternType: literal operation: Create host: "*" - resource: type: topic name: connect-cluster-configs patternType: literal operation: Describe host: "*" - resource: type: topic name: connect-cluster-configs patternType: literal operation: Read host: "*" # consumer group - resource: type: group name: connect-cluster patternType: literal operation: Read host: "*"创建或更新资源。
oc apply -f KAFKA-USER-CONFIG-FILE
