Hello team, I have a question, your help would be greatly appreciated. KRaft: enabling ACLs + OAuth on an existing cluster required a full reformat, is this expected?
Apache Kafka 3.9, KRaft mode, 3 nodes (combined controller+broker). Cluster originally formatted and running with no authorizer and PLAINTEXT only. Goal: add StandardAuthorizer + SASL_SSL/OAUTHBEARER without data loss. What I observed: after updating server.properties on all nodes (authorizer class, super.users, OAuth listener config) and rolling restart, the brokers came up but logs showed what looked like a state mismatch, controllers/brokers behaving as if part of them were still on the pre-change config (old listener names, missing principal context for inter-broker traffic). What worked: stop all nodes, wipe log.dirs and the metadata log, kafka-storage.sh format with the authorizer + OAuth config already in server.properties, start fresh. Clean cluster, ACLs and OAuth working immediately. Questions: 1. Is it expected that authorizer + auth listener changes of this magnitude require reformatting in KRaft, because the bootstrap metadata records are written at format time and can't be retroactively reconciled? 2. If a migration path exists (e.g. specific order: controllers first with new config, then brokers; or a metadata upgrade step), is it documented somewhere? I couldn't find a clear procedure. 3. Is the "old config still in effect somewhere" symptom on a rolling restart a known footgun, e.g. controller quorum hasn't fully caught up before brokers reconnect on the new listener?
