muralibasani opened a new pull request, #23397:
URL: https://github.com/apache/kafka/pull/23397
The native Kafka image failed to start with
KAFKA_SASL_ENABLED_MECHANISMS=OAUTHBEARER, throwing "Could not find a public
no-argument constructor" for the OAuthBearer callback handler. GraalVM
native-image prunes the no-arg constructors that Kafka instantiates
reflectively for OAUTHBEARER because those classes are absent from the native
reachability metadata.
Solution :
Fix 1:
Register the OAUTHBEARER classes in
docker/native/native-image-configs/reflect-config.json, mirroring how PLAIN,
SCRAM, Kerberos and the default Login are already registered.
Fix 2:
When this solution is tested, noticed a regression with consumer group
coordinator.
Consumer groups fail on the native image (any security protocol) with "Could
not find a public no-argument constructor for
org.apache.kafka.coordinator.group.streams.NoOpAssignmentRefiner" whenever a
__consumer_offsets partition is loaded.
(Mostly coming from KAFKA-20665 (#23322) It was never tested, as the no-op
constructor was never added to the native reachability metadata)
Added entry NoOpAssignmentRefiner
Test :
Started docker with
python3 docker/docker_build_test.py kafka-native-oauthbearer \
-tag test -type native \
--kafka-archive
"$(pwd)/core/build/distributions/kafka_2.13-4.5.0-SNAPSHOT.tgz" -b
IMAGE=kafka-native-oauthbearer:test docker compose up
```
advertised.listeners = [SASL_PLAINTEXT_HOST://localhost:9094,
SASL_PLAINTEXT://broker:19094]
...
kafka19583-broker | listener.security.protocol.map =
CONTROLLER:PLAINTEXT,SASL_PLAINTEXT:SASL_PLAINTEXT,SASL_PLAINTEXT_HOST:SASL_PLAINTEXT
kafka19583-broker | listeners = [CONTROLLER://:29093,
SASL_PLAINTEXT_HOST://:9094, SASL_PLAINTEXT://:19094]
...
kafka19583-broker | sasl.mechanism.controller.protocol = GSSAPI
kafka19583-broker | sasl.mechanism.inter.broker.protocol =
OAUTHBEARER
```
Produce/Consume
```
echo "hello-oauthbearer" | $KAFKA/bin/kafka-console-producer.sh
--bootstrap-server localhost:9094 \
--producer.config client.properties --topic oauthbearer-smoke
$KAFKA/bin/kafka-console-consumer.sh --bootstrap-server localhost:9094 \
--command-config client.properties --topic oauthbearer-smoke \
--from-beginning --max-messages 1 --group smoke-group
The consumer rebalance protocol (KIP-848) is production-ready! Set
group.protocol=consumer to try it out. See
https://kafka.apache.org/documentation/#consumer_rebalance_protocol
hello-oauthbearer
Processed a total of 1 messages
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
