KRaft模式Kafka报错：未在JAAS或Kafka配置中定义serviceName

错误原因 #

在Kafka Kraft模式中，使用SASL认证的CONTROLLER监听器时，JAAS配置必须包含serviceName参数；同时需确保Kafka进程正确加载JAAS配置，并完成SASL_SSL的完整参数配置，否则会触发No serviceName defined in either JAAS or Kafka config错误。

解决方案 #

1. 修改JAAS配置文件 #

更新kafka_jaas.conf，在KafkaServer模块中添加serviceName="kafka"参数：

KafkaServer {
    org.apache.kafka.common.security.plain.PlainLoginModule required
    username="kafka"
    password="password"
    serviceName="kafka";
};

2. 配置JAAS文件加载路径 #

在docker-compose.yml的environment中添加KAFKA_OPTS，指定JAAS配置文件的路径：

- KAFKA_OPTS="-Djava.security.auth.login.config=/opt/bitnami/kafka/conf/kafka_jaas.conf"

3. 完善SASL_SSL相关配置 #

补充以下环境变量，确保CONTROLLER监听器的SSL与SASL参数完整：

- KAFKA_CFG_CONTROLLER_SASL_MECHANISM=PLAIN
- KAFKA_CFG_SSL_KEYSTORE_LOCATION=/opt/bitnami/kafka/config/certs/kafka.keystore.jks
- KAFKA_CFG_SSL_KEYSTORE_PASSWORD=password
- KAFKA_CFG_SSL_TRUSTSTORE_LOCATION=/opt/bitnami/kafka/config/certs/kafka.truststore.jks
- KAFKA_CFG_SSL_TRUSTSTORE_PASSWORD=password

4. 完整的Docker Compose环境变量示例 #

更新后的environment部分如下：

environment:
  - KAFKA_ENABLE_KRAFT=yes
  - KAFKA_CFG_PROCESS_ROLES=broker,controller
  - KAFKA_CFG_LISTENER_SECURITY_PROTOCOL_MAP=CONTROLLER:SASL_SSL,PLAINTEXT:PLAINTEXT
  - KAFKA_CFG_LISTENERS=PLAINTEXT://:9092,CONTROLLER://:2181
  - KAFKA_CFG_ADVERTISED_LISTENERS=PLAINTEXT://127.0.0.1:9092
  - KAFKA_CFG_CONTROLLER_LISTENER_NAMES=CONTROLLER
  - KAFKA_CFG_SASL_ENABLED_MECHANISMS=PLAIN,SCRAM-SHA-256,SCRAM-SHA-512
  - KAFKA_CLIENTS_USER=user
  - KAFKA_CLIENTS_PASSWORD=password
  - KAFKA_TLS_CLIENT_AUTH=none
  - KAFKA_CFG_SSL_ENDPOINT_IDENTIFICATION_ALGORITHM=
  - KAFKA_CERTIFICATE_PASSWORD=password
  - KAFKA_BROKER_ID=1
  - KAFKA_CFG_CONTROLLER_QUORUM_VOTERS=1@127.0.0.1:2181
  - ALLOW_PLAINTEXT_LISTENER=yes
  - KAFKA_OPTS="-Djava.security.auth.login.config=/opt/bitnami/kafka/conf/kafka_jaas.conf"
  - KAFKA_CFG_CONTROLLER_SASL_MECHANISM=PLAIN
  - KAFKA_CFG_SSL_KEYSTORE_LOCATION=/opt/bitnami/kafka/config/certs/kafka.keystore.jks
  - KAFKA_CFG_SSL_KEYSTORE_PASSWORD=password
  - KAFKA_CFG_SSL_TRUSTSTORE_LOCATION=/opt/bitnami/kafka/config/certs/kafka.truststore.jks
  - KAFKA_CFG_SSL_TRUSTSTORE_PASSWORD=password

说明 #

• serviceName：SASL认证的必填参数，Kafka控制器默认服务名称为kafka。
• KAFKA_OPTS：确保Kafka进程加载自定义JAAS配置，否则认证规则不会生效。
• SSL参数：补充密钥库、信任库的路径与密码，保证SASL_SSL协议的SSL层正常工作。

内容的提问来源于stack exchange，提问作者cod