部署带SASL认证的Kafka时遇JAAS配置‘Client’段缺失错误

问题现象 #

Kafka启动日志报错：

[2023-02-02 11:49:24,708] WARN SASL configuration failed. Will continue connection to Zookeeper server without SASL authentication, if Zookeeper server allows it. (org.apache.zookeeper.ClientCnxn)
javax.security.auth.login.LoginException: No JAAS configuration section named 'Client' was found in specified JAAS configuration file: '/home/etozhekim/IdeaProjects/veles-core/kafka_server_jaas.conf'

核心原因 #

容器内无法正确读取宿主机挂载的JAAS配置文件，同时Kafka连接Zookeeper的认证模块与Zookeeper的配置不匹配，加上Listeners配置存在重复冲突。

解决步骤 #

1. 修正Docker卷挂载路径

Confluent镜像不会自动识别宿主机的绝对路径，需将配置文件挂载到容器内的标准目录：

修改docker-compose.yml中Zookeeper服务配置

zookeeper:
  image: confluentinc/cp-zookeeper
  environment:
    ZOOKEEPER_CLIENT_PORT: 2181
    ZOOKEEPER_TICK_TIME: 2000
    ZOOKEEPER_INIT_LIMIT: 5
    ZOOKEEPER_SYNC_LIMIT: 2
    KAFKA_OPTS:
      -Djava.security.auth.login.config=/etc/zookeeper/secrets/zookeeper_server_jaas.conf
      -Dquorum.auth.enableSasl=true
      -Dquorum.cnxn.threads.size=20
      -Dzookeeper.authProvider.1=org.apache.zookeeper.server.auth.SASLAuthenticationProvider
      -DjaasLoginRenew=3600000
      -DrequireClientAuthScheme=sasl
  volumes:
    - /home/etozhekim/IdeaProjects/veles-core/zookeeper_server_jaas.conf:/etc/zookeeper/secrets/zookeeper_server_jaas.conf
  networks:
    - kafka-cluster-network

修改docker-compose.yml中Kafka服务配置

kafka:
  image: confluentinc/cp-kafka
  ports:
    - "9092:9092"
  depends_on:
    - zookeeper
  environment:
    KAFKA_ZOOKEEPER_CONNECT: zookeeper:2181
    KAFKA_SASL_ENABLED_MECHANISMS: PLAIN
    KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL: PLAIN
    KAFKA_SECURITY_INTER_BROKER_PROTOCOL: SASL_PLAINTEXT
    KAFKA_LISTENERS: SASL_PLAINTEXT://0.0.0.0:9092
    KAFKA_ADVERTISED_LISTENERS: SASL_PLAINTEXT://localhost:9092
    KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
    KAFKA_OPTS:
      -Dzookeeper.sasl.client=true
      -Djava.security.auth.login.config=/etc/kafka/secrets/kafka_server_jaas.conf
  volumes:
    - /home/etozhekim/IdeaProjects/veles-core/kafka_server_jaas.conf:/etc/kafka/secrets/kafka_server_jaas.conf

2. 匹配Kafka与Zookeeper的认证模块

Zookeeper使用Digest认证，Kafka连接Zookeeper的Client段需对应使用DigestLoginModule，修正kafka_server_jaas.conf：

KafkaServer {
    org.apache.kafka.common.security.scram.ScramLoginModule required
    username="kafkabroker"
    password="password";
};
Client {
    org.apache.zookeeper.server.auth.DigestLoginModule required
    username="admin"
    password="password";
};

3. 重启服务

docker-compose down
docker-compose up -d

内容的提问来源于stack exchange，提问作者Kim Vladimir