Unable to publish the messages using the producer console getting an error errors.TopicAuthorizationException: Not authorized to access topics

[damodarreddy08]

Hi..
I have created Strimizi Kafka clustering in Azure kubernetes, this is Strimzi operator Kafka and able to started clustering successfully post that i can able to create the kafka users and topics as well, but while pushing the messages using the producer console getting an below error

[xxxxx@zzzzzzz ~]$ kubectl -n kafka run kafka-producer -ti --image=quay.io/strimzi/kafka:0.38.0-kafka-3.5.0 --rm=true --restart=Never -- bin/kafka-console-producer.sh --bootstrap-server service/sims-kafka-cluster-kafka-bootstrap:9092 --topic ravi
If you don't see a command prompt, try pressing enter.

hi
[2024-03-02 10:58:27,027] WARN [Producer clientId=console-producer] Error while fetching metadata with correlation id 4 : {ravi=TOPIC_AUTHORIZATION_FAILED} (org.apache.kafka.clients.NetworkClient)
[2024-03-02 10:58:27,035] ERROR [Producer clientId=console-producer] Topic authorization failed for topics [ravi] (org.apache.kafka.clients.Metadata)
[2024-03-02 10:58:27,036] ERROR Error when sending message to topic ravi with key: null, value: 2 bytes with error: (org.apache.kafka.clients.producer.internals.ErrorLoggingCallback)
org.apache.kafka.common.errors.TopicAuthorizationException: Not authorized to access topics: [ravi]
broker0_logs.txt
broker1_logs.txt
broker2_logs.txt
cluster-operator.log
zookeepr0.log
zookeepr1.log
zookeepr2.log

Cluster yaml file:
apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
name: sims-kafka-cluster
spec:
entityOperator:
topicOperator: {}
userOperator: {}
kafka:
authorization:
type: simple
superUsers:
- CN=admin-user
version: 3.5.0
replicas: 3
listeners:
- name: plain
port: 9092
type: internal
tls: false
- name: tls
port: 9094
type: cluster-ip
tls: true
authentication:
type: tls
configuration:
bootstrap:
alternativeNames:
- kafkabootstrap-pilot.xxxx.xxx.net
- kafkabroker-pilot-0.xxxx.xxx.net
- kafkabroker-pilot-1.xxxx.xxx.net
- kafkabroker-pilot-2.xxxx.xxx.net
- kafka-cluster-kafka-tls-bootstrap.kafka.svc
brokers:
- broker: 0
advertisedHost: kafkabroker-pilot-0.xxxx.xxx.net
advertisedPort: 9095
- broker: 1
advertisedHost: kafkabroker-pilot-1.xxxx.xxx.net
advertisedPort: 9096
- broker: 2
advertisedHost: kafkabroker-pilot-2.xxxx.xxx.net
advertisedPort: 9097
config:
offsets.topic.replication.factor: 1
transaction.state.log.replication.factor: 1
transaction.state.log.min.isr: 1
log.message.format.version: "2.4"
storage:
type: persistent-claim
size: 2Gi
deleteClaim: true
zookeeper:
replicas: 3
storage:
type: persistent-claim
size: 1Gi
deleteClaim: true

user yaml file:
apiVersion: kafka.strimzi.io/v1beta1
kind: KafkaUser
metadata:
namespace: kafka
name: kafka-user
labels:
strimzi.io/cluster: sims-kafka-cluster
spec:
authentication:
type: tls
authorization:
type: simple
acls:
- resource:
type: topic
name: ""
patternType: literal
operation: All
- resource:
type: group
name: ""
patternType: literal
operation: All
- resource:
type: cluster
name: ""
patternType: literal
operation: All
- resource:
type: transactionalId
name: ""
patternType: literal
operation: All

[scholzj]

1. You should start by formatting things properly to make them readable!
2. You should also try to go through the logs yourself first -> the client clearly tells you that authorization fails and the broker will probably list some details of what you are missing etc.
3. How do you expect the client to be authorized when you do not do any authentication?

[damodarreddy08]

@scholzj thanks for info.. I am new to strimzi Kafka as part of POC which is going to implement in Azure kubernetes environment, Kindly share the any reference steps/document how to create and use authentication mechanism to fix the issue...

[scholzj]

To be honest, you do not have to be an expert on Kafka to try to read the logs, read the docs, and try to figure out what is wrong. The errors you got here is pretty much self-explanatory and I already told you what to look into. It is also the second discussion you opened where you didn't bother to format anything, so it's hard to help when things are not readable. I told you that you have to format it properly already in the last one.