Chapter 12. Using the User Operator to manage Kafka users When you create, modify or delete a user using the KafkaUser resource, the User Operator ensures that these changes are reflected in the Kafka cluster. For more information on the KafkaUser resource, see the KafkaUser schema reference . 12.1. Configuring Kafka users Use the properties of the KafkaUser resource to configure Kafka users. You can use oc apply to create or modify users, and oc delete to delete existing users. For example: oc apply -f <user_config_file> oc delete KafkaUser <user_name> Users represent Kafka clients. When you configure Kafka users, you enable the user authentication and authorization mechanisms required by clients to access Kafka. The mechanism used must match the equivalent Kafka configuration. For more information on using Kafka and KafkaUser resources to secure access to Kafka brokers, see https://docs.redhat.com/en/documentation/red_hat_streams_for_apache_kafka/2.9/html-single/deploying_and_managing_streams_for_apache_kafka_on_openshift/index#assembly-securing-access-str . Prerequisites A running Kafka cluster configured with a Kafka broker listener using mTLS authentication and TLS encryption. A running User Operator (typically deployed with the Entity Operator). Procedure Configure the KafkaUser resource. This example specifies mTLS authentication and simple authorization using ACLs. Example Kafka user configuration apiVersion: kafka.strimzi.io/v1beta2 kind: KafkaUser metadata: name: my-user-1 labels: strimzi.io/cluster: my-cluster spec: authentication: type: tls authorization: type: simple acls: # Example consumer Acls for topic my-topic using consumer group my-group - resource: type: topic name: my-topic patternType: literal operations: - Describe - Read host: "*" - resource: type: group name: my-group patternType: literal operations: - Read host: "*" # Example Producer Acls for topic my-topic - resource: type: topic name: my-topic patternType: literal operations: - Create - Describe - Write host: "*" Create the KafkaUser resource in OpenShift. oc apply -f <user_config_file> Wait for the ready status of the user to change to True : oc get kafkausers -o wide -w -n <namespace> Kafka user status NAME CLUSTER AUTHENTICATION AUTHORIZATION READY my-user-1 my-cluster tls simple True my-user-2 my-cluster tls simple my-user-3 my-cluster tls simple True User creation is successful when the READY output shows True . If the READY column stays blank, get more details on the status from the resource YAML or User Operator logs. Messages provide details on the reason for the current status. oc get kafkausers my-user-2 -o yaml Details on a user with a NotReady status # ... status: conditions: - lastTransitionTime: "2022-06-10T10:07:37.238065Z" message: Simple authorization ACL rules are configured but not supported in the Kafka cluster configuration. reason: InvalidResourceException status: "True" type: NotReady In this example, the reason the user is not ready is because simple authorization is not enabled in the Kafka configuration. Kafka configuration for simple authorization apiVersion: kafka.strimzi.io/v1beta2 kind: Kafka metadata: name: my-cluster spec: kafka: # ... authorization: type: simple After updating the Kafka configuration, the status shows the user is ready. oc get kafkausers my-user-2 -o wide -w -n <namespace> Status update of the user NAME CLUSTER AUTHENTICATION AUTHORIZATION READY my-user-2 my-cluster tls simple True Fetching the details shows no messages. oc get kafkausers my-user-2 -o yaml Details on a user with a READY status # ... status: conditions: - lastTransitionTime: "2022-06-10T10:33:40.166846Z" status: "True" type: Ready

Commands:
apiVersion: kafka.strimzi.io/v1beta2 kind: KafkaUser metadata: name: my-user-1 labels: strimzi.io/cluster: my-cluster spec: authentication: type: tls authorization: type: simple acls: # Example consumer Acls for topic my-topic using consumer group my-group - resource: type: topic name: my-topic patternType: literal operations: - Describe - Read host: "*" - resource: type: group name: my-group patternType: literal operations: - Read host: "*" # Example Producer Acls for topic my-topic - resource: type: topic name: my-topic patternType: literal operations: - Create - Describe - Write host: "*"
apply -f <user_config_file>
get kafkausers -o wide -w -n <namespace>
NAME CLUSTER AUTHENTICATION AUTHORIZATION READY my-user-1 my-cluster tls simple True my-user-2 my-cluster tls simple my-user-3 my-cluster tls simple True
get kafkausers my-user-2 -o yaml
status: conditions: - lastTransitionTime: "2022-06-10T10:07:37.238065Z" message: Simple authorization ACL rules are configured but not supported in the Kafka cluster configuration. reason: InvalidResourceException status: "True" type: NotReady
apiVersion: kafka.strimzi.io/v1beta2 kind: Kafka metadata: name: my-cluster spec: kafka: # authorization: type: simple
get kafkausers my-user-2 -o wide -w -n <namespace>
NAME CLUSTER AUTHENTICATION AUTHORIZATION READY my-user-2 my-cluster tls simple True
get kafkausers my-user-2 -o yaml
status: conditions: - lastTransitionTime: "2022-06-10T10:33:40.166846Z" status: "True" type: Ready