Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Client relation-changed and relation-broken fails with ACL error in Kraft mode #285

Open
phvalguima opened this issue Dec 8, 2024 · 1 comment · May be fixed by #281
Open

Client relation-changed and relation-broken fails with ACL error in Kraft mode #285

phvalguima opened this issue Dec 8, 2024 · 1 comment · May be fixed by #281
Assignees
@imanenami
Labels
bug Something isn't working

Comments

@phvalguima
Copy link

I am trying to remove a client application with:

juju remove-relation kafka kafka-benchmark

Kafka config: https://pastebin.ubuntu.com/p/QTh2grfGvY/

Juju Status:

Model  Controller           Cloud/Region         Version      SLA          Timestamp
test   localhost-localhost  localhost/localhost  3.6-beta3.1  unsupported  20:11:17+01:00

App              Version  Status   Scale  Charm            Channel  Rev  Exposed  Message
kafka            3.6.1    active       1  kafka            3/edge   193  no       
kafka-benchmark           blocked      1  kafka-benchmark             0  no       No database relation available

Unit                Workload  Agent      Machine  Public address  Ports  Message
kafka-benchmark/0*  blocked   idle       0        10.156.142.161         No database relation available
kafka/0*            active    executing  1        10.156.142.234         

Machine  State    Address         Inst id        Base          AZ  Message
0        started  10.156.142.161  juju-cee4f8-0  [email protected]      Running
1        started  10.156.142.234  juju-cee4f8-1  [email protected]      Running

Integration provider            Requirer                        Interface        Type     Message
kafka-benchmark:benchmark-peer  kafka-benchmark:benchmark-peer  benchmark_peers  peer     
kafka:cluster                   kafka:cluster                   cluster          peer     
kafka:kafka-client              kafka-benchmark:kafka           kafka_client     regular  
kafka:restart                   kafka:restart                   rolling_op       peer     
kafka:upgrade                   kafka:upgrade                   upgrade          peer

The relation was not populated yet. It fails with:

Traceback (most recent call last):
  File "/var/lib/juju/agents/unit-kafka-0/charm/./src/charm.py", line 178, in <module>
    ops.main(KafkaCharm)  # pyright: ignore[reportCallIssue]
  File "/var/lib/juju/agents/unit-kafka-0/charm/venv/ops/__init__.py", line 343, in __call__
    return _main.main(charm_class=charm_class, use_juju_for_storage=use_juju_for_storage)
  File "/var/lib/juju/agents/unit-kafka-0/charm/venv/ops/_main.py", line 543, in main
    manager.run()
  File "/var/lib/juju/agents/unit-kafka-0/charm/venv/ops/_main.py", line 529, in run
    self._emit()
  File "/var/lib/juju/agents/unit-kafka-0/charm/venv/ops/_main.py", line 518, in _emit
    _emit_charm_event(self.charm, self.dispatcher.event_name, self._juju_context)
  File "/var/lib/juju/agents/unit-kafka-0/charm/venv/ops/_main.py", line 134, in _emit_charm_event
    event_to_emit.emit(*args, **kwargs)
  File "/var/lib/juju/agents/unit-kafka-0/charm/venv/ops/framework.py", line 347, in emit
    framework._emit(event)
  File "/var/lib/juju/agents/unit-kafka-0/charm/venv/ops/framework.py", line 857, in _emit
    self._reemit(event_path)
  File "/var/lib/juju/agents/unit-kafka-0/charm/venv/ops/framework.py", line 947, in _reemit
    custom_handler(event)
  File "/var/lib/juju/agents/unit-kafka-0/charm/src/events/provider.py", line 124, in _on_relation_broken
    self.dependent.auth_manager.remove_all_user_acls(username=username)
  File "/var/lib/juju/agents/unit-kafka-0/charm/src/managers/auth.py", line 309, in remove_all_user_acls
    current_user_acls = {acl for acl in self.current_acls if acl.username == username}
  File "/var/lib/juju/agents/unit-kafka-0/charm/src/managers/auth.py", line 46, in current_acls
    acls = self._get_acls_from_cluster()
  File "/var/lib/juju/agents/unit-kafka-0/charm/src/managers/auth.py", line 56, in _get_acls_from_cluster
    acls = self.workload.run_bin_command(
  File "/var/lib/juju/agents/unit-kafka-0/charm/src/workload.py", line 185, in run_bin_command
    return self.exec(command)
  File "/var/lib/juju/agents/unit-kafka-0/charm/src/workload.py", line 108, in exec
    raise e
  File "/var/lib/juju/agents/unit-kafka-0/charm/src/workload.py", line 96, in exec
    output = subprocess.check_output(
  File "/usr/lib/python3.10/subprocess.py", line 421, in check_output
    return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
  File "/usr/lib/python3.10/subprocess.py", line 526, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command 'KAFKA_LOG4J_OPTS='-Dlog4j.configuration=file:/var/snap/charmed-kafka/current/etc/kafka/tools-log4j.properties -Dcharmed.kafka.log.level=INFO' charmed-kafka.acls --bootstrap-server=10.156.142.234:9092 --command-config=/var/snap/charmed-kafka/current/etc/kafka/client.properties --list' returned non-zero exit status 1.

Full logs: https://pastebin.ubuntu.com/p/jcVd8vkWxB/

Running it manually returns:

root@juju-cee4f8-1:~# KAFKA_LOG4J_OPTS='-Dlog4j.configuration=file:/var/snap/charmed-kafka/current/etc/kafka/tools-log4j.properties -Dcharmed.kafka.log.level=INFO' charmed-kafka.acls --bootstrap-server=10.156.142.234:9092 --command-config=/var/snap/charmed-kafka/current/etc/kafka/client.properties --list
mkdir: cannot create directory ‘/snap/charmed-kafka/42/opt/kafka/bin/../logs’: Read-only file system
[2024-12-08 19:10:33,587] INFO Registered kafka:type=kafka.Log4jController MBean (kafka.utils.Log4jControllerRegistration$)
[2024-12-08 19:10:34,238] INFO AdminClientConfig values: 
	auto.include.jmx.reporter = true
	bootstrap.servers = [10.156.142.234:9092]
	client.dns.lookup = use_all_dns_ips
	client.id = 
	connections.max.idle.ms = 300000
	default.api.timeout.ms = 60000
	metadata.max.age.ms = 300000
	metric.reporters = []
	metrics.num.samples = 2
	metrics.recording.level = INFO
	metrics.sample.window.ms = 30000
	receive.buffer.bytes = 65536
	reconnect.backoff.max.ms = 1000
	reconnect.backoff.ms = 50
	request.timeout.ms = 30000
	retries = 2147483647
	retry.backoff.ms = 100
	sasl.client.callback.handler.class = null
	sasl.jaas.config = [hidden]
	sasl.kerberos.kinit.cmd = /usr/bin/kinit
	sasl.kerberos.min.time.before.relogin = 60000
	sasl.kerberos.service.name = null
	sasl.kerberos.ticket.renew.jitter = 0.05
	sasl.kerberos.ticket.renew.window.factor = 0.8
	sasl.login.callback.handler.class = null
	sasl.login.class = null
	sasl.login.connect.timeout.ms = null
	sasl.login.read.timeout.ms = null
	sasl.login.refresh.buffer.seconds = 300
	sasl.login.refresh.min.period.seconds = 60
	sasl.login.refresh.window.factor = 0.8
	sasl.login.refresh.window.jitter = 0.05
	sasl.login.retry.backoff.max.ms = 10000
	sasl.login.retry.backoff.ms = 100
	sasl.mechanism = SCRAM-SHA-512
	sasl.oauthbearer.clock.skew.seconds = 30
	sasl.oauthbearer.expected.audience = null
	sasl.oauthbearer.expected.issuer = null
	sasl.oauthbearer.jwks.endpoint.refresh.ms = 3600000
	sasl.oauthbearer.jwks.endpoint.retry.backoff.max.ms = 10000
	sasl.oauthbearer.jwks.endpoint.retry.backoff.ms = 100
	sasl.oauthbearer.jwks.endpoint.url = null
	sasl.oauthbearer.scope.claim.name = scope
	sasl.oauthbearer.sub.claim.name = sub
	sasl.oauthbearer.token.endpoint.url = null
	security.protocol = SASL_PLAINTEXT
	security.providers = null
	send.buffer.bytes = 131072
	socket.connection.setup.timeout.max.ms = 30000
	socket.connection.setup.timeout.ms = 10000
	ssl.cipher.suites = null
	ssl.enabled.protocols = [TLSv1.2, TLSv1.3]
	ssl.endpoint.identification.algorithm = https
	ssl.engine.factory.class = null
	ssl.key.password = null
	ssl.keymanager.algorithm = SunX509
	ssl.keystore.certificate.chain = null
	ssl.keystore.key = null
	ssl.keystore.location = null
	ssl.keystore.password = null
	ssl.keystore.type = JKS
	ssl.protocol = TLSv1.3
	ssl.provider = null
	ssl.secure.random.implementation = null
	ssl.trustmanager.algorithm = PKIX
	ssl.truststore.certificates = null
	ssl.truststore.location = null
	ssl.truststore.password = null
	ssl.truststore.type = JKS
 (org.apache.kafka.clients.admin.AdminClientConfig)
[2024-12-08 19:10:34,389] INFO Successfully logged in. (org.apache.kafka.common.security.authenticator.AbstractLogin)
[2024-12-08 19:10:34,446] INFO Kafka version: 3.6.1-ubuntu0 (org.apache.kafka.common.utils.AppInfoParser)
[2024-12-08 19:10:34,446] INFO Kafka commitId: db44db1ebf870854dddfc3be0187a976b997d4dc (org.apache.kafka.common.utils.AppInfoParser)
[2024-12-08 19:10:34,446] INFO Kafka startTimeMs: 1733685034444 (org.apache.kafka.common.utils.AppInfoParser)
[2024-12-08 19:10:35,025] INFO App info kafka.admin.client for adminclient-1 unregistered (org.apache.kafka.common.utils.AppInfoParser)
[2024-12-08 19:10:35,033] INFO Metrics scheduler closed (org.apache.kafka.common.metrics.Metrics)
[2024-12-08 19:10:35,033] INFO Closing reporter org.apache.kafka.common.metrics.JmxReporter (org.apache.kafka.common.metrics.Metrics)
[2024-12-08 19:10:35,033] INFO Metrics reporters closed (org.apache.kafka.common.metrics.Metrics)
Error while executing ACL command: org.apache.kafka.common.errors.SecurityDisabledException: No Authorizer is configured on the broker
java.util.concurrent.ExecutionException: org.apache.kafka.common.errors.SecurityDisabledException: No Authorizer is configured on the broker
	at java.base/java.util.concurrent.CompletableFuture.reportGet(CompletableFuture.java:396)
	at java.base/java.util.concurrent.CompletableFuture.get(CompletableFuture.java:2073)
	at org.apache.kafka.common.internals.KafkaFutureImpl.get(KafkaFutureImpl.java:165)
	at kafka.admin.AclCommand$AdminClientService.getAcls(AclCommand.scala:180)
	at kafka.admin.AclCommand$AdminClientService.listAcls(AclCommand.scala:149)
	at kafka.admin.AclCommand$AdminClientService.$anonfun$listAcls$1(AclCommand.scala:142)
	at kafka.admin.AclCommand$AdminClientService.listAcls(AclCommand.scala:141)
	at kafka.admin.AclCommand$.main(AclCommand.scala:77)
	at kafka.admin.AclCommand.main(AclCommand.scala)
Caused by: org.apache.kafka.common.errors.SecurityDisabledException: No Authorizer is configured on the broker
@phvalguima phvalguima added the bug Something isn't working label Dec 8, 2024
@syncronize-issues-to-jira Syncronize issues to Jira
Copy link

Thank you for reporting us your feedback!

The internal ticket has been created: https://warthogs.atlassian.net/browse/DPE-6166.

This message was autogenerated

@phvalguima phvalguima changed the title Client relation-broken fails with ACL error Client relation-broken fails with ACL error in Kraft mode Dec 8, 2024
@phvalguima phvalguima changed the title Client relation-broken fails with ACL error in Kraft mode Client relation-changed and relation-broken fails with ACL error in Kraft mode Dec 8, 2024
@imanenami imanenami self-assigned this Dec 19, 2024
@imanenami imanenami linked a pull request Dec 19, 2024 that will close this issue
[DPE-5232;DPE-5233] feat: support for scaling operations in KRaft mode (single & multi-app) #281
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@imanenami imanenami

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
2 participants
@phvalguima @imanenami