配置NodePort监听器后Strimzi未生成外部Kafka Broker问题排查

环境与问题 #

• 运行环境：Windows 10 + Docker Desktop Kubernetes
• 核心问题：配置NodePort暴露Kafka外部Broker失败，预期的9094端口服务未生成，同时出现RBAC权限禁止错误

已验证的部署状态 #

执行命令 kubectl get deployments，返回结果显示集群控制器与实体控制器均正常就绪：

NAME                         READY   UP-TO-DATE   AVAILABLE   AGE
my-cluster-entity-operator   1/1     1            1           27m
strimzi-cluster-operator     1/1     1            1           33m

执行命令 kubectl get svc，未发现预期的9094端口外部服务：

NAME                          TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                               AGE
my-cluster-kafka-bootstrap    ClusterIP   10.101.45.155   <none>        9091/TCP,9092/TCP,9093/TCP            28m
my-cluster-kafka-brokers      ClusterIP   None            <none>        9090/TCP,9091/TCP,9092/TCP,9093/TCP   28m
my-cluster-zookeeper-client   ClusterIP   10.110.47.4     <none>        2181/TCP                              32m
my-cluster-zookeeper-nodes    ClusterIP   None            <none>        2181/TCP,2888/TCP,3888/TCP            32m

Kafka配置文件（kafka.yaml） #

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: my-cluster
spec:
  kafka:
    version: 3.2.0
    replicas: 3
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: true
      - name: external
        type: nodeport
        tls: false
        port: 9094
    config:
      offsets.topic.replication.factor: 3
      transaction.state.log.replication.factor: 3
      transaction.state.log.min.isr: 2
      default.replication.factor: 3
      min.insync.replicas: 2
      inter.broker.protocol.version: "3.2"
    storage:
      type: ephemeral
  zookeeper:
    replicas: 3
    storage:
      type: ephemeral
  entityOperator:
    topicOperator: {}
    userOperator: {}

错误详情 #

集群部署过程中出现RBAC权限错误：

Failure executing: GET at: https://10.96.0.1/apis/rbac.authorization.k8s.io/v1/clusterrolebindings/strimzi-debezium-my-cluster-kafka-init. Message: Forbidden!Configured service account doesn't have access. Service account may have been revoked. clusterrolebindings.rbac.authorization.k8s.io "strimzi-debezium-my-cluster-kafka-init" is forbidden: User "system:serviceaccount:debezium:strimzi-cluster-operator" cannot get resource "clusterrolebindings" in API group "rbac.authorization.k8s.io" at the cluster scope

解决步骤 #

1. 补全Strimzi集群操作员的RBAC权限 #

错误表明debezium命名空间下的strimzi-cluster-operator服务账号缺少集群范围的clusterrolebindings读取权限。创建如下ClusterRoleBinding配置文件：

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: strimzi-cluster-operator-clusterrolebinding
subjects:
- kind: ServiceAccount
  name: strimzi-cluster-operator
  namespace: debezium
roleRef:
  kind: ClusterRole
  name: strimzi-cluster-operator-global
  apiGroup: rbac.authorization.k8s.io

执行命令应用配置：

kubectl apply -f clusterrolebinding.yaml

2. 重新部署Kafka集群 #

• 先查看集群操作员日志，确认权限问题已修复：

kubectl logs deployment/strimzi-cluster-operator -n debezium

• 删除现有Kafka资源（注意：临时存储会丢失数据，需提前备份）：

kubectl delete kafka my-cluster

• 重新应用Kafka配置：

kubectl apply -f kafka.yaml

• 等待集群部署完成后，再次检查服务列表，此时应出现包含9094端口的NodePort类型外部服务：

kubectl get svc

3. 额外检查项 #

• 确认Docker Desktop Kubernetes的NodePort范围（默认30000-32767）包含9094，若不包含，需修改Kafka配置的external listener，添加nodePort字段指定范围内的端口，或调整Docker Desktop的NodePort设置。
• 检查Kafka集群状态，确保所有Broker正常运行：

kubectl get kafka my-cluster

内容的提问来源于stack exchange，提问作者Mike H