Principal = User:ANONYMOUS is Denied operation = DESCRIBE from host = 10.42.1.76 on resource

[ChiragR7]

Hi,

I have kafka configuration as below

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: kafka-cluster
  annotations:
    strimzi.io/node-pools: enabled
    strimzi.io/kraft: enabled
spec:
  kafka:
    version: 3.8.0
    metadataVersion: 3.8-IV0
    listeners:
      - name: plain
        port: 9092
        type: internal
        tls: false
      - name: tls
        port: 9093
        type: internal
        tls: true
        configuration:
          brokerCertChainAndKey:
            secretName: kafka-tls
            certificate: tls.crt
            key: tls.key
    config:
      default.replication.factor: 3
      min.insync.replicas: 2
      auto.create.topics.enable: "false"  
  entityOperator:
    topicOperator: {}
    userOperator: {}

now I am trying to enable authorization by adding

    authorization:
      type: simple

I have tried to define KafkaUser also

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  name: kafka-admin
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka-cluster
spec:
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: "*"
          patternType: literal
        operations:
        - All
      - resource:
          type: group
          name: "*"
          patternType: literal
        operations:
        - All
      - resource:
          type: cluster
        operations:
        - All

On client side I do set

security.protocol=ssl
enable.ssl.certificate.verification=false

But still getting this error. Any help?
Note:- everything works until I add

 authorization:
      type: simple

[im-konge]

What error you are getting?

[ChiragR7]

I am trying to follow

https://strimzi.io/blog/2021/05/07/deploying-kafka-with-lets-encrypt-certificates/

it works on client side

But when I enable authorization I am getting error

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  name: kafka-admin
  namespace: kafka
  labels:
    strimzi.io/cluster: kafka-cluster
spec:
  authentication:
    type: tls-external
  authorization:
    type: simple
    acls:
      - resource:
          type: topic
          name: "*"
          patternType: prefix
        operations:
        - All
        host: "*"
      - resource:
          type: group
          name: "*"
          patternType: prefix
        operations:
        - All
        host: "*"

Certificate cerated using

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: kafka-admin
  namespace: kafka
spec:
  secretName: kafka-admin
  privateKey:
    algorithm: ECDSA
    size: 384
  commonName: kafka-admin
  duration: 87600h # 3650 days (10 years)
  renewBefore: 720h # 30 days
  isCA: false
  usages:
    - server auth
    - client auth
  issuerRef:
    name: selfsigned-issuer
    kind: ClusterIssuer
    group: cert-manager.io

I am getting

 Failed authentication with /10.42.0.0 (channelId=10.42.1.109:9094-10.42.0.0:35893-4) (SSL handshake failed) (org.apache.kafka.common.network.Selector) [d │
│ ata-plane-kafka-network-thread-1-ListenerName(EXTERNAL-9094)-SSL-10]

Do I need to sign my certificate using sign it with strimzi-client-ca?

[im-konge]

That would suggest that you are using some wrong certificates or the certificates don't contain the name of the user itself.

[ChiragR7]

kubectl get secret kafka-admin -n kafka -o jsonpath='{.data.tls.crt}' | base64 --decode |openssl x509 -noout -subject
subject=CN = kafka-admin

[im-konge]

There can be more things actually:

• are you connecting to right port with that?
• you should use the cluster certificate and also the user certificate IIRC
• is there anything more in the Kafka logs?

Otherwise if you are using all the certificates correctly, it should be fine. As you can see, it's not about the authorization but authentication now. That points to some issue with how the certificates are used.

[im-konge]

Also, you should check that you are using correct security protocol etc.
Could you try to connect there using the openssl command as mentioned in the blogpost you posted above?