From b2cdaab66e348656466ab99cc8c50645e91eeeca Mon Sep 17 00:00:00 2001 From: Kochetkov S Date: Mon, 20 Jul 2026 18:17:59 +0300 Subject: [PATCH] ++ skip kafka acls on ugmk broker without authorizer --- infrastructure.yaml | 4 ++++ live/kafka-topics/terragrunt.hcl | 1 + modules/kafka-topics-incluster/main.tf | 2 +- modules/kafka-topics-incluster/variables.tf | 6 ++++++ 4 files changed, 12 insertions(+), 1 deletion(-) diff --git a/infrastructure.yaml b/infrastructure.yaml index 9af7987..e76261e 100644 --- a/infrastructure.yaml +++ b/infrastructure.yaml @@ -56,6 +56,10 @@ environments: buckets: [] kafka: + # Broker has no authorizer configured (authorizer.class.name unset) — + # any ACL write is rejected with "Security features are disabled". + # Topics/users still work; skip ACLs until the broker enables one. + create_acls: false kafka_cluster_refs: main: bootstrap_servers: kafka-kafka-contour.kafka.svc.cluster.local:9092 diff --git a/live/kafka-topics/terragrunt.hcl b/live/kafka-topics/terragrunt.hcl index 9055b4c..4af0129 100644 --- a/live/kafka-topics/terragrunt.hcl +++ b/live/kafka-topics/terragrunt.hcl @@ -49,4 +49,5 @@ inputs = { users = try(local.env_config.kafka.users, []) kafka_cluster_refs = try(local.env_config.kafka.kafka_cluster_refs, {}) kafka_policy = try(local.env_config.kafka.kafka_policy, {}) + create_acls = try(local.env_config.kafka.create_acls, true) } diff --git a/modules/kafka-topics-incluster/main.tf b/modules/kafka-topics-incluster/main.tf index 4d8dcc4..dea9608 100644 --- a/modules/kafka-topics-incluster/main.tf +++ b/modules/kafka-topics-incluster/main.tf @@ -178,7 +178,7 @@ resource "kafka_user_scram_credential" "this" { } resource "kafka_acl" "this" { - for_each = var.create_users ? local.acl_entries : {} + for_each = var.create_users && var.create_acls ? local.acl_entries : {} resource_name = each.value.resource_name resource_type = each.value.resource_type diff --git a/modules/kafka-topics-incluster/variables.tf b/modules/kafka-topics-incluster/variables.tf index d2a2657..036e4c9 100644 --- a/modules/kafka-topics-incluster/variables.tf +++ b/modules/kafka-topics-incluster/variables.tf @@ -76,6 +76,12 @@ variable "create_users" { default = true } +variable "create_acls" { + description = "Create ACL entries. Some brokers run without an authorizer configured (authorizer.class.name unset) and reject any ACL write with \"Security features are disabled\" — set false on those contours." + type = bool + default = true +} + variable "default_user_roles" { description = "Kafka roles granted to generated owner users on their topics." type = list(string)