TopicAuthorizationException: Topic authorization failed with Strimzi Kafka Bridge

[shiva-appani-hash]

I have deployed a Kafka Cluster using the Strimzi Operator (Helm Chart - Version 0.40.0). When attempting to retrieve the properties of a topic using curl on localhost [http://localhost:9200/topics/test] I am seeing the following response:

{
"error_code": 500,
"message": "org.apache.kafka.common.errors.TopicAuthorizationException: Topic authorization failed."
}

I have granted all the permissions to the user used in Kafka Bridge, but I am still encountering the above error. Could you please assist?
Below are my Kafka cluster, Kafka user, and Kafka Bridge manifest files for reference:

apiVersion: kafka.strimzi.io/v1beta2
kind: Kafka
metadata:
  name: kafka-no-ssl
spec:
  kafka:
    version: 3.7.0
    replicas: 3  
    listeners:
    - authentication:
        type: scram-sha-512
      name: external
      port: 9094
      tls: false
      type: loadbalancer
    - authentication:
        type: scram-sha-512
      name: internal
      port: 9092
      tls: false
      type: internal        
    authorization:
      type: simple
    config:
      offsets.topic.replication.factor: 3
      transaction.state.log.replication.factor: 3
      transaction.state.log.min.isr: 2
      inter.broker.protocol.version: 3.7
    storage:
      type: persistent-claim
      size: 25Gi
    template:
      pod:
        affinity:
          nodeAffinity:
            requiredDuringSchedulingIgnoredDuringExecution:
              nodeSelectorTerms:
              - matchExpressions:
                - key: name
                  operator: In
                  values:
                  - kafka
        tolerations:
        - effect: NoSchedule
          key: name
          operator: Equal
          value: kafka                  
  zookeeper:
    replicas: 3
    storage:
      type: persistent-claim
      size: 25Gi     
  entityOperator:
    topicOperator: {}
    userOperator: {}
  #clusterCa:
  #  validityDays: 365
  #  renewalDays: 30

---

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  name: user-no-ssl
  labels:
    strimzi.io/cluster: kafka-no-ssl
spec:
  authentication:
    type: scram-sha-512
  authorization:
    type: simple
    acls:
      # Permissions for creating any topic
      - resource:
          type: topic
          name: '*'
          patternType: literal
        operations: [Read, Write, Create, Describe, Delete]
        host: "*"
      
      # Permissions for creating any consumer group
      - resource:
          type: group
          name: '*'
          patternType: literal
        operations: [Read, Write, Create, Describe, Delete]
        host: "*"      
---


apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaBridge
metadata:
  name: kafka-external-bridge
spec:
  replicas: 1
  bootstrapServers: kafka-no-ssl-kafka-bootstrap:9092
  enableMetrics: true
  authentication: 
    type: scram-sha-512
    username: user-no-ssl
    passwordSecret:
      secretName: user-no-ssl
      password: password
  http: 
    port: 8080
  consumer: 
    config:
      auto.offset.reset: earliest
  producer: 
    config:
      delivery.timeout.ms: 300000
  logging: 
    type: inline
    loggers:
      logger.bridge.level: DEBUG
      # enabling DEBUG just for send operation
      logger.send.name: "http.openapi.operation.send"
      logger.send.level: DEBUG
  jvmOptions: 
    "-Xmx": "1g"
    "-Xms": "1g"
  readinessProbe: 
    initialDelaySeconds: 15
    timeoutSeconds: 5
  livenessProbe:
    initialDelaySeconds: 15
    timeoutSeconds: 5
  template:
    pod:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: name
                operator: In
                values:
                - kafka
      tolerations:
      - effect: NoSchedule
        key: name
        operator: Equal
        value: kafka

[scholzj]

The error does not make much sense ...

• The kafka-external-kafka-bootstrap:9093 is clearly wrong:
  • You do not have any listener on port 9093
  • You should not connect internally to external listener. So the service is wrong as well.

So I would not expect this to work at all.

---

The best way to debug ACL errors is to check the Kafka broker logs which will give you the exact information about:

• Who send the request (i.e. what is your identity)
• What was the request and what ACL might be missing

[shiva-appani-hash]

My bas! I have corrected the manifest files.

I have an internal listener configured on port 9092, which is used in Kafka Bridge.
user-no-ssl is used for authentication in Kafka Bridge.

..
  authentication: 
    type: scram-sha-512
    username: user-no-ssl
    passwordSecret:
      secretName: user-no-ssl
      password: password
..

[scholzj]

Ok. I think the config looks fine now ... so you should check the broker logs.

[shiva-appani-hash]

2024-09-05 18:59:53,709 INFO Principal = User:user-no-ssl is Denied Operation = DescribeConfigs from host = 172.18.153.95 on resource = Topic:LITERAL:test for request = DescribeConfigs with resourceRefCount = 1 (kafka.authorizer.logger) [data-plane-kafka-request-handler-3]
2024-09-05 18:59:55,096 INFO Principal = User:user-no-ssl is Denied Operation = DescribeConfigs from host = 172.18.153.95 on resource = Topic:LITERAL:test for request = DescribeConfigs with resourceRefCount = 1 (kafka.authorizer.logger) [data-plane-kafka-request-handler-5]

I m seeing above logs in broker.

[shiva-appani-hash]

Adding DescribeConfigs resolved the problem!
Thank you @scholzj !