search

danielqsj / kafka_exporter

Kafka exporter for Prometheus
Apache License 2.0
2.16k stars 607 forks source link

When ACL are enabled in Kafka Topic , Exporter is not exporting topic data #132

Open contacttapan opened 4 years ago

contacttapan commented 4 years ago

Hi, I have enabled ACL on a TOPIC , for example User : Consumer can only consume from TestTopic User : Producer can only produce from TestTopic User Admin can do all activity in Test Topic.

My kafka brokers are running with SASL_SSL . I tried running exporter with /bin/kafka_exporter --kafka.server=BokerIp:SSL_ADVERTISED_PORT --web.listen-address=:9309 --sasl.username= --sasl.password=--tls.insecure-skip-tls-verify --tls.enabled

It's not working . Any help??

Thanks Tapan

contacttapan commented 4 years ago

Hi, Just able to identify root cause We are unable to set SASL based authentication as our broker configuration is sasl.enabled.mechanisms=SCRAM-SHA-256

I did look at the code , seems only SASL_PLAIN is supported by kafka exporter.

Any idea when we will have the implementation.

danielmotaleite commented 3 years ago

I'm using scram-sha256 and authentication works fine. If i put a wrong the password, the exporter fail to startup, with the good password, it starts and get a few metrics. Notice that mechanism is scram-sha256, not scram-sha-256. Do not confuse SASL_PLAIN and SASL_TLS vs SASL mechanism (connection type vs authentication protocol)

My problem is that a monitoring user with describe ACL to topics and cluster is unable to get all metrics, but the admin user can get all metrics.