Kraft模式单节点Kafka集群启用ACL时遇No Authorizer is configured错误

搭建Kraft模式单节点Kafka集群，要求仅对客户端连接启用ACL，内部连接不启用ACL，但启动容器时出现No Authorizer is configured错误。

version: '3'
services:
  kafka:
    image: 'bitnami/kafka'
    container_name: kafka
    network_mode: host
    environment:
      - KAFKA_ENABLE_KRAFT=yes
      - KAFKA_CFG_PROCESS_ROLES=broker,controller
      - KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER
      - KAFKA_CFG_LISTENERS=PLAINTEXT://:9092,CONTROLLER://:2181,CLIENT://0.0.0.0:29092
      -KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT,CLIENT:SASL_PLAINTEXT
      - KAFKA_CFG_BROKER_ID=0
      - KAFKA_CFG_NODE_ID=0
      - KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=0@127.0.0.1:2181
      - KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://127.0.0.1:9092
      - ALLOW_PLAINTEXT_LISTENER=yes
      - KAFKA_KRAFT_CLUSTER_ID=r4zt_wrqTRuT7W2NJsB_GA
      - KAFKA_CFG_AUTHORIZER_CLASS=org.apache.kafka.metadata.authorizer.StandardAuthorizer
      - KAFKA_CFG_SASL_ENABLED_MECHANISMS=PLAIN
      - KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL=PLAIN
      - KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND=true
      - KAFKA_SUPER_USERS=User:admin
      - KAFKA_JAAS_CONFIG=file:/opt/bitnami/kafka/config/kafka_jaas.conf
      - KAFKA_CFG_SASL_MECHANISM_CONTROLLER_PROTOCOL=PLAIN ##
      - KAFKA_LOG4J_LOGGERS=org.apache.kafka=DEBUG,org.apache.zookeeper=DEBUG
    volumes:
      - ./kafka:/opt/bitnami/

1. 语法错误导致配置加载失败 #

KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP配置项前缺少空格，正确格式应为- KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT,CLIENT:SASL_PLAINTEXT。这个语法错误会导致Kafka无法正确解析监听协议映射，进而影响授权器初始化。

2. 完善Kraft模式授权器配置 #

使用StandardAuthorizer时，需确保：

• 已正确设置KAFKA_CFG_AUTHORIZER_CLASS=org.apache.kafka.metadata.authorizer.StandardAuthorizer（你的配置已满足）
• KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND=true配置生效（你的配置已满足）
• 补充内部通信用户到超级用户列表，避免内部连接被ACL拦截：KAFKA_SUPER_USERS=User:admin;User:controller

3. 修正监听地址配置 #

KAFKA_CFG_ADVERTISED_LISTENERS需包含客户端监听地址，否则客户端无法通过SASL连接：

KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://127.0.0.1:9092,CLIENT://127.0.0.1:29092

4. 确保JAAS配置文件有效 #

你指定了KAFKA_JAAS_CONFIG=file:/opt/bitnami/kafka/config/kafka_jaas.conf，需在挂载的./kafka/config目录下创建该文件，内容示例：

KafkaServer {
    org.apache.kafka.common.security.plain.PlainLoginModule required
    username="admin"
    password="admin-secret"
    user_admin="admin-secret"
    user_controller="controller-secret";
};

该文件需包含内部通信（controller）和超级用户（admin）的认证信息。

version: '3'
services:
  kafka:
    image: 'bitnami/kafka'
    container_name: kafka
    network_mode: host
    environment:
      - KAFKA_ENABLE_KRAFT=yes
      - KAFKA_CFG_PROCESS_ROLES=broker,controller
      - KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER
      - KAFKA_CFG_LISTENERS=PLAINTEXT://:9092,CONTROLLER://:2181,CLIENT://0.0.0.0:29092
      - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT,CLIENT:SASL_PLAINTEXT
      - KAFKA_CFG_BROKER_ID=0
      - KAFKA_CFG_NODE_ID=0
      - KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=0@127.0.0.1:2181
      - KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://127.0.0.1:9092,CLIENT://127.0.0.1:29092
      - ALLOW_PLAINTEXT_LISTENER=yes
      - KAFKA_KRAFT_CLUSTER_ID=r4zt_wrqTRuT7W2NJsB_GA
      - KAFKA_CFG_AUTHORIZER_CLASS=org.apache.kafka.metadata.authorizer.StandardAuthorizer
      - KAFKA_CFG_SASL_ENABLED_MECHANISMS=PLAIN
      - KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL=PLAIN
      - KAFKA_ALLOW_EVERYONE_IF_NO_ACL_FOUND=true
      - KAFKA_SUPER_USERS=User:admin;User:controller
      - KAFKA_JAAS_CONFIG=file:/opt/bitnami/kafka/config/kafka_jaas.conf
      - KAFKA_CFG_SASL_MECHANISM_CONTROLLER_PROTOCOL=PLAIN
      - KAFKA_LOG4J_LOGGERS=org.apache.kafka=DEBUG
    volumes:
      - ./kafka:/opt/bitnami/

1. 确认./kafka/config/kafka_jaas.conf文件存在且内容正确
2. 启动容器后，使用带SASL认证的客户端连接CLIENT://127.0.0.1:29092，验证ACL规则生效
3. 检查Kafka日志，确认No Authorizer is configured错误消失

内容的提问来源于stack exchange，提问作者Ariyaee