KeeperErrorCode = NoAuth for /config/topics/__KafkaCruiseControlPartitionMetricSamples

Hi,

I am using cruise-control v2.0.25 branch to setup cruise control for my kafka cluster. I am getting below error from zookeeper client when running cruise control. The zookeerper setup that I am connecting to has kerberos authenticated enabled. The kafka cluster also connects to this zookeeper setup and itself also uses kerberos for authentication. I have setup the required properties as mentioned in the guide.

Could you please help out with what am i missing here. The kafka server and cruise control are both run using the same user.

[2019-01-28 19:32:47,356] INFO EventThread shut down for session: 0x4687a65e0d6000c (org.apache.zookeeper.ClientCnxn) [2019-01-28 19:32:47,357] INFO [ZooKeeperClient] Closed. (kafka.zookeeper.ZooKeeperClient) Exception in thread "main" org.apache.zookeeper.KeeperException$NoAuthException: KeeperErrorCode = NoAuth for /config/topics/__KafkaCruiseControlPartitionMetricSamples at org.apache.zookeeper.KeeperException.create(KeeperException.java:116) at org.apache.zookeeper.KeeperException.create(KeeperException.java:54) at kafka.zookeeper.AsyncResponse.maybeThrow(ZooKeeperClient.scala:499) at kafka.zk.KafkaZkClient.createRecursive(KafkaZkClient.scala:1449) at kafka.zk.KafkaZkClient.createOrSet$1(KafkaZkClient.scala:268) at kafka.zk.KafkaZkClient.setOrCreateEntityConfigs(KafkaZkClient.scala:278) at kafka.zk.AdminZkClient.createOrUpdateTopicPartitionAssignmentPathInZK(AdminZkClient.scala:98) at kafka.zk.AdminZkClient.createTopic(AdminZkClient.scala:56) at com.linkedin.kafka.cruisecontrol.monitor.sampling.KafkaSampleStore.ensureTopicCreated(KafkaSampleStore.java:364) at com.linkedin.kafka.cruisecontrol.monitor.sampling.KafkaSampleStore.ensureTopicsCreated(KafkaSampleStore.java:231) at com.linkedin.kafka.cruisecontrol.monitor.sampling.KafkaSampleStore.configure(KafkaSampleStore.java:164) at com.linkedin.kafka.cruisecontrol.config.KafkaCruiseControlConfig.getConfiguredInstance(KafkaCruiseControlConfig.java:1104) at com.linkedin.kafka.cruisecontrol.monitor.task.LoadMonitorTaskRunner.<init>(LoadMonitorTaskRunner.java:104) at com.linkedin.kafka.cruisecontrol.monitor.task.LoadMonitorTaskRunner.<init>(LoadMonitorTaskRunner.java:74) at com.linkedin.kafka.cruisecontrol.monitor.LoadMonitor.<init>(LoadMonitor.java:157) at com.linkedin.kafka.cruisecontrol.monitor.LoadMonitor.<init>(LoadMonitor.java:113) at com.linkedin.kafka.cruisecontrol.KafkaCruiseControl.<init>(KafkaCruiseControl.java:106) at com.linkedin.kafka.cruisecontrol.async.AsyncKafkaCruiseControl.<init>(AsyncKafkaCruiseControl.java:67) at com.linkedin.kafka.cruisecontrol.KafkaCruiseControlMain.main(KafkaCruiseControlMain.java:71)

Thanks, Abhishek

[nylend95]

Hi, I too am sorry to raise this dead issue. I also get the same error message:

Exception in thread "main" org.apache.zookeeper.KeeperException$NoAuthException: KeeperErrorCode = NoAuth for /config/topics/__KafkaCruiseControlPartitionMetricSamples 
at org.apache.zookeeper.KeeperException.create(KeeperException.java:116) 
at org.apache.zookeeper.KeeperException.create(KeeperException.java:54) 
at kafka.zookeeper.AsyncResponse.maybeThrow(ZooKeeperClient.scala:499) 
at kafka.zk.KafkaZkClient.createRecursive(KafkaZkClient.scala:1449) 

I have followed https://github.com/linkedin/cruise-control/wiki/Secure-zookeeper-configuration , but that does not seem to resolve the issue. I think the reason for that is that we have set the property zookeeper.set.acl=true in our Kafka brokers. The way I read the code apache/kafka/core/src/main/scala/kafka/zk/ZkData.scala is that Kafka adds ZNode ACLs so only brokers can operate on the child nodes under /config/topics.

My question, is therefore if Cruise Control supports this config in Kafka? I think this is the same setup that you had, @barryWarnock . How did you proceed with issue?

[kidkun]

hey @choudhary001
currently Cruise Control does not support secure mechanism.

you are more than welcome to create a patch to make this configurable.