Kerberros GSSAPI 在 kafkacat 高山容器中不起作用

编程问答 2022-05-02

问题描述

之前我已将其报告给 kafkacat tracker，但该问题已因与 cyrus-sasl/krb5 相关而被关闭。

podman run --rm -it --name kafkacat-DEV \
        -v$(pwd)/conf/integration:/conf -v$(pwd)/conf/integration/krb5.conf:/etc/krb5.conf \
        localhost/kafkacat_gssapi:1 \
                kafkacat \
                        -b kafka-int.epm-eco.projects.epam.com:9095 \
                                -Xssl.ca.location=/conf/epm-eco-int.ca.crt \
                                -Xsecurity.protocol=SASL_SSL \
                                -Xsasl.mechanisms=GSSAPI \
                                '-Xsasl.kerberos.kinit.cmd=cat /conf/paswd | /usr/bin/kinit Pavel_Alexeev@PETERSBURG.EPAM.COM' \
                                -Xsasl.kerberos.service.name=kafka \
                                        -m30 -L

错误：

Password for Pavel_Alexeev@PETERSBURG.EPAM.COM: 
%5|1620820968.991|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 1
%2|1620820969.336|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI Error:  Miscellaneous failure (see text) (Matching credential (kafka/ecsc00a09ead.epam.com@EPAM.COM) not found)
%3|1620820969.336|FAIL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: Failed to initialize SASL authentication: SASL handshake Failed (start (-1)): SASL(-1): generic failure: GSSAPI Error:  Miscellaneous failure (see text) (Matching credential (kafka/ecsc00a09ead.epam.com@EPAM.COM) not found) (after 345ms in state AUTH_REQ)
%5|1620820970.006|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 1
%2|1620820970.137|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI Error:  Miscellaneous failure (see text) (Matching credential (kafka/ecsc00a09ead.epam.com@EPAM.COM) not found)
%3|1620820970.137|FAIL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: Failed to initialize SASL authentication: SASL handshake Failed (start (-1)): SASL(-1): generic failure: GSSAPI Error:  Miscellaneous failure (see text) (Matching credential (kafka/ecsc00a09ead.epam.com@EPAM.COM) not found) (after 131ms in state AUTH_REQ,1 identical error(s) suppressed)
%5|1620820971.431|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 1
%2|1620820972.935|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI Error:  Miscellaneous failure (see text) (Matching credential (kafka/ecsc00a09ead.epam.com@EPAM.COM) not found)
%5|1620820976.319|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 1
%2|1620820976.745|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI Error:  Miscellaneous failure (see text) (Matching credential (kafka/ecsc00a09ead.epam.com@EPAM.COM) not found)
%5|1620820987.183|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 1
%2|1620820987.651|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI Error:  Miscellaneous failure (see text) (Matching credential (kafka/ecsc00a09ead.epam.com@EPAM.COM) not found)
%5|1620820998.114|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 1
%2|1620820998.480|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI Error:  Miscellaneous failure (see text) (Matching credential (kafka/ecsc00a09ead.epam.com@EPAM.COM) not found)
% ERROR: Failed to acquire Metadata: Local: broker transport failure

其中 localhost/kafkacat_gssapi:1 刚刚从 Dockerfile 构建：

FROM docker.io/edenhill/kafkacat:1.6.0                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      
RUN apk add --no-cache cyrus-sasl cyrus-sasl-gssapiv2 krb5 openssl ca-certificates

$ podman run -it --rm localhost/kafkacat_gssapi:1 -V
kafkacat - Apache Kafka producer and consumer tool
https://github.com/edenhill/kafkacat
copyright (c) 2014-2019,Magnus Edenhill
Version 1.6.0 (JSON,Avro,Transactions,librdkafka 1.5.0 builtin.features=gzip,snappy,ssl,sasl,regex,lz4,sasl_gssapi,sasl_plain,sasl_scram,plugins,zstd,sasl_oauthbearer)

在 Fedora 33 上运行相同：

kafkacat \
        -b kafka-int.epm-eco.projects.epam.com:9095 \
        -Xssl.ca.location=conf/integration/epm-eco-int.ca.crt \
        -Xsecurity.protocol=SASL_SSL \
        -Xsasl.mechanisms=GSSAPI \
        '-Xsasl.kerberos.kinit.cmd=cat conf/paswd | /usr/bin/kinit Pavel_Alexeev@PETERSBURG.EPAM.COM' \
        -Xsasl.kerberos.service.name=kafka \
        -m 30 \
        -L

Password for Pavel_Alexeev@PETERSBURG.EPAM.COM: 
%5|1620821374.957|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 1
%5|1620821384.957|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 1
%5|1620821385.027|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 2
Metadata for all topics (from broker -1: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap):
 3 brokers:
  broker 202 at ecsc00a09eab.epam.com:9095
  broker 201 at ecsc00a09eaa.epam.com:9095 (controller)
  broker 203 at ecsc00a09eac.epam.com:9095
 1440 topics:
  topic "test-topic" with 1 partitions:
    partition 0,leader 202,replicas: 202,203,201,isrs: 201,202
  topic "datahub.epm_prj.EffectiveFrom" with 1 partitions:
    partition 0,leader 201,replicas: 201,203
...

有趣的是，如果我在直接工作案例中使用 KRB5_TRACE=/dev/stdout 运行，我会看到 (full log)：

[2616356] 1620807906.324107: Sending DNS URI query for _kerberos.PETERSBURG.EPAM.COM.
[2616356] 1620807906.324108: No URI records found
[2616356] 1620807906.324109: Sending DNS SRV query for _kerberos._tcp.PETERSBURG.EPAM.COM.
[2616356] 1620807906.324110: SRV answer: 0 100 88 "evrupetsa0001.petersburg.epam.com."
[2616356] 1620807906.324111: SRV answer: 0 100 88 "evrupetsa0007.petersburg.epam.com."
[2616356] 1620807906.324112: SRV answer: 0 100 88 "evbyminsa0007.petersburg.epam.com."
[2616356] 1620807906.324113: SRV answer: 0 100 88 "evusprisa0049.petersburg.epam.com."
[2616356] 1620807906.324114: SRV answer: 0 100 88 "evhubudsa0001.petersburg.epam.com."
[2616356] 1620807906.324115: Resolving hostname evrupetsa0001.petersburg.epam.com.
[2616356] 1620807906.324116: Initiating TCP connection to stream 10.66.110.11:88
[2616356] 1620807906.324117: Sending TCP request to stream 10.66.110.11:88
[2616356] 1620807906.324118: Received answer (4491 bytes) from stream 10.66.110.11:88
[2616356] 1620807906.324119: Terminating TCP connection to stream 10.66.110.11:88
[2616356] 1620807906.324120: Sending DNS URI query for _kerberos.PETERSBURG.EPAM.COM.
[2616356] 1620807906.324121: No URI records found
[2616356] 1620807906.324122: Sending DNS SRV query for _kerberos-master._tcp.PETERSBURG.EPAM.COM.
[2616356] 1620807906.324123: No SRV records found
[2616356] 1620807906.324124: Response was not from master KDC
[2616356] 1620807906.324125: Processing preauth types: PA-ETYPE-INFO2 (19)
[2616356] 1620807906.324126: Selected etype info: etype aes256-cts,salt "PETERSBURG.EPAM.COMPavel_Alexeev",params ""
[2616356] 1620807906.324127: Produced preauth for next request: (empty)
[2616356] 1620807906.324128: AS key determined by preauth: aes256-cts/83C9
[2616356] 1620807906.324129: Decrypted AS reply; session key is: aes256-cts/CCEB
[2616356] 1620807906.324130: FAST negotiation: unavailable
[2616356] 1620807906.324131: Initializing FILE:/tmp/krb5cc_1000 with default princ Pavel_Alexeev@PETERSBURG.EPAM.COM
[2616356] 1620807906.324132: Storing Pavel_Alexeev@PETERSBURG.EPAM.COM -> krbtgt/PETERSBURG.EPAM.COM@PETERSBURG.EPAM.COM in FILE:/tmp/krb5cc_1000
[2616356] 1620807906.324133: Storing config in FILE:/tmp/krb5cc_1000 for krbtgt/PETERSBURG.EPAM.COM@PETERSBURG.EPAM.COM: pa_type: 2
[2616356] 1620807906.324134: Storing Pavel_Alexeev@PETERSBURG.EPAM.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/PETERSBURG.EPAM.COM\@PETERSBURG.EPAM.COM@X-CACHECONF: in FILE:/tmp/krb5cc_1000
%5|1620807906.993|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 1
[2616353] 1620807906.996539: ccselect can't find appropriate cache for server principal kafka/kafka-int.epm-eco.projects.epam.com@EPAM.COM
[2616353] 1620807906.996540: Getting credentials Pavel_Alexeev@PETERSBURG.EPAM.COM -> kafka/kafka-int.epm-eco.projects.epam.com@EPAM.COM using ccache FILE:/tmp/krb5cc_1000
[2616353] 1620807906.996541: Retrieving Pavel_Alexeev@PETERSBURG.EPAM.COM -> kafka/kafka-int.epm-eco.projects.epam.com@EPAM.COM from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[2616353] 1620807906.996542: Retrieving Pavel_Alexeev@PETERSBURG.EPAM.COM -> krbtgt/EPAM.COM@EPAM.COM from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[2616353] 1620807906.996543: Retrieving Pavel_Alexeev@PETERSBURG.EPAM.COM -> krbtgt/PETERSBURG.EPAM.COM@PETERSBURG.EPAM.COM from FILE:/tmp/krb5cc_1000 with result: 0/Success
[2616353] 1620807906.996544: Starting with TGT for client realm: Pavel_Alexeev@PETERSBURG.EPAM.COM -> krbtgt/PETERSBURG.EPAM.COM@PETERSBURG.EPAM.COM
[2616353] 1620807906.996545: Retrieving Pavel_Alexeev@PETERSBURG.EPAM.COM -> krbtgt/EPAM.COM@EPAM.COM from FILE:/tmp/krb5cc_1000 with result: -1765328243/Matching credential not found (filename: /tmp/krb5cc_1000)
[2616353] 1620807906.996546: Requesting TGT krbtgt/EPAM.COM@PETERSBURG.EPAM.COM using TGT krbtgt/PETERSBURG.EPAM.COM@PETERSBURG.EPAM.COM
[2616353] 1620807906.996547: Generated subkey for TGS request: aes256-cts/69EE
[2616353] 1620807906.996548: etypes requested in TGS request: aes256-cts,aes128-cts,aes256-sha2,aes128-sha2,rc4-hmac,camellia128-cts,camellia256-cts
[2616353] 1620807906.996550: Encoding request body and padata into FAST request
[2616353] 1620807906.996551: Sending request (4611 bytes) to PETERSBURG.EPAM.COM
[2616353] 1620807906.996552: Sending DNS URI query for _kerberos.PETERSBURG.EPAM.COM.
[2616353] 1620807907.003430: No URI records found
[2616353] 1620807907.003431: Sending DNS SRV query for _kerberos._udp.PETERSBURG.EPAM.COM.
[2616353] 1620807907.003432: SRV answer: 0 100 88 "evrupetsa0007.petersburg.epam.com."
[2616353] 1620807907.003433: SRV answer: 0 100 88 "evrupetsa0001.petersburg.epam.com."
[2616353] 1620807907.003434: SRV answer: 0 100 88 "evusprisa0049.petersburg.epam.com."
[2616353] 1620807907.003435: SRV answer: 0 100 88 "evhubudsa0001.petersburg.epam.com."
[2616353] 1620807907.003436: SRV answer: 0 100 88 "evbyminsa0007.petersburg.epam.com."
[2616353] 1620807907.003437: Sending DNS SRV query for _kerberos._tcp.PETERSBURG.EPAM.COM.
[2616353] 1620807907.003438: SRV answer: 0 100 88 "evrupetsa0007.petersburg.epam.com."
[2616353] 1620807907.003439: SRV answer: 0 100 88 "evbyminsa0007.petersburg.epam.com."
[2616353] 1620807907.003440: SRV answer: 0 100 88 "evusprisa0049.petersburg.epam.com."
[2616353] 1620807907.003441: SRV answer: 0 100 88 "evhubudsa0001.petersburg.epam.com."
[2616353] 1620807907.003442: SRV answer: 0 100 88 "evrupetsa0001.petersburg.epam.com."
[2616353] 1620807907.003443: Resolving hostname evrupetsa0007.petersburg.epam.com.
[2616353] 1620807907.003444: Resolving hostname evrupetsa0001.petersburg.epam.com.
[2616353] 1620807907.003445: Resolving hostname evusprisa0049.petersburg.epam.com.
[2616353] 1620807907.003446: Resolving hostname evhubudsa0001.petersburg.epam.com.
[2616353] 1620807907.003447: Resolving hostname evbyminsa0007.petersburg.epam.com.
[2616353] 1620807907.003448: Resolving hostname evrupetsa0007.petersburg.epam.com.
[2616353] 1620807907.003449: Initiating TCP connection to stream 10.66.110.17:88
[2616353] 1620807907.003450: Sending TCP request to stream 10.66.110.17:88
[2616353] 1620807907.003451: Received answer (4542 bytes) from stream 10.66.110.17:88
[2616353] 1620807907.003452: Terminating TCP connection to stream 10.66.110.17:88
[2616353] 1620807907.003453: Sending DNS URI query for _kerberos.PETERSBURG.EPAM.COM.
[2616353] 1620807907.003454: No URI records found
[2616353] 1620807907.003455: Sending DNS SRV query for _kerberos-master._tcp.PETERSBURG.EPAM.COM.
[2616353] 1620807907.003456: No SRV records found
[2616353] 1620807907.003457: Response was not from master KDC
[2616353] 1620807907.003458: Decoding FAST response
[2616353] 1620807907.003459: FAST reply key: aes256-cts/9007
[2616353] 1620807907.003460: TGS reply is for Pavel_Alexeev@PETERSBURG.EPAM.COM -> krbtgt/EPAM.COM@PETERSBURG.EPAM.COM with session key rc4-hmac/7459
[2616353] 1620807907.003461: TGS request result: 0/Success
[2616353] 1620807907.003462: Storing Pavel_Alexeev@PETERSBURG.EPAM.COM -> krbtgt/EPAM.COM@PETERSBURG.EPAM.COM in FILE:/tmp/krb5cc_1000
[2616353] 1620807907.003463: Received TGT for service realm: krbtgt/EPAM.COM@PETERSBURG.EPAM.COM
[2616353] 1620807907.003464: Requesting tickets for kafka/kafka-int.epm-eco.projects.epam.com@EPAM.COM,referrals on
[2616353] 1620807907.003465: Generated subkey for TGS request: rc4-hmac/F9B4
[2616353] 1620807907.003466: etypes requested in TGS request: aes256-cts,camellia256-cts
[2616353] 1620807907.003468: Encoding request body and padata into FAST request
[2616353] 1620807907.003469: Sending request (4615 bytes) to EPAM.COM
[2616353] 1620807907.003470: Sending DNS URI query for _kerberos.EPAM.COM.
[2616353] 1620807907.003471: No URI records found
[2616353] 1620807907.003472: Sending DNS SRV query for _kerberos._udp.EPAM.COM.
[2616353] 1620807907.003473: SRV answer: 0 100 88 "evusbossa0000.epam.com."
[2616353] 1620807907.003474: SRV answer: 0 100 88 "evkzastsa0000.epam.com."
...
[2616353] 1620807907.003762: Resolving hostname EVUAVINSA0000.epam.com.
[2616353] 1620807907.003763: Resolving hostname EVUSCONSA0000.epam.com.
[2616353] 1620807907.003764: Initiating TCP connection to stream 10.22.128.2:88
[2616353] 1620807907.003765: Sending TCP request to stream 10.22.128.2:88
[2616353] 1620807908.732538: Received answer (4631 bytes) from stream 10.22.128.2:88
[2616353] 1620807908.732539: Terminating TCP connection to stream 10.22.128.2:88
[2616353] 1620807908.732540: Sending DNS URI query for _kerberos.EPAM.COM.
[2616353] 1620807908.732541: No URI records found
[2616353] 1620807908.732542: Sending DNS SRV query for _kerberos-master._tcp.EPAM.COM.
[2616353] 1620807908.732543: No SRV records found
[2616353] 1620807908.732544: Response was not from master KDC
[2616353] 1620807908.732545: Decoding FAST response
[2616353] 1620807908.732546: FAST reply key: rc4-hmac/2A6B
[2616353] 1620807908.732547: TGS reply is for Pavel_Alexeev@PETERSBURG.EPAM.COM -> kafka/kafka-int.epm-eco.projects.epam.com@EPAM.COM with session key aes256-cts/F35A
[2616353] 1620807908.732548: TGS request result: 0/Success
[2616353] 1620807908.732549: Received creds for desired service kafka/kafka-int.epm-eco.projects.epam.com@EPAM.COM
[2616353] 1620807908.732550: Storing Pavel_Alexeev@PETERSBURG.EPAM.COM -> kafka/kafka-int.epm-eco.projects.epam.com@EPAM.COM in FILE:/tmp/krb5cc_1000
[2616353] 1620807908.732552: Creating authenticator for Pavel_Alexeev@PETERSBURG.EPAM.COM -> kafka/kafka-int.epm-eco.projects.epam.com@EPAM.COM,seqnum 691537013,subkey aes256-cts/A6FD,session key aes256-cts/F35A
%5|1620807908.873|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 1

如果 alpine 容器 (full log) 出现错误：

[4] 1620808362.090471: Sending DNS URI query for _kerberos.PETERSBURG.EPAM.COM.
[4] 1620808362.090472: No URI records found
[4] 1620808362.090473: Sending DNS SRV query for _kerberos._tcp.PETERSBURG.EPAM.COM.
[4] 1620808362.090474: SRV answer: 0 100 88 "evusprisa0049.petersburg.epam.com."
[4] 1620808362.090475: SRV answer: 0 100 88 "evhubudsa0001.petersburg.epam.com."
[4] 1620808362.090476: SRV answer: 0 100 88 "evrupetsa0001.petersburg.epam.com."
[4] 1620808362.090477: SRV answer: 0 100 88 "evrupetsa0007.petersburg.epam.com."
[4] 1620808362.090478: SRV answer: 0 100 88 "evbyminsa0007.petersburg.epam.com."
[4] 1620808362.090479: Resolving hostname evusprisa0049.petersburg.epam.com.
[4] 1620808362.090480: Initiating TCP connection to stream 10.244.110.7:88
[4] 1620808362.090481: Sending TCP request to stream 10.244.110.7:88
[4] 1620808362.090482: Received answer (4491 bytes) from stream 10.244.110.7:88
[4] 1620808362.090483: Terminating TCP connection to stream 10.244.110.7:88
[4] 1620808362.090484: Sending DNS URI query for _kerberos.PETERSBURG.EPAM.COM.
[4] 1620808362.090485: No URI records found
[4] 1620808362.090486: Sending DNS SRV query for _kerberos-master._tcp.PETERSBURG.EPAM.COM.
[4] 1620808362.090487: No SRV records found
[4] 1620808362.090488: Response was not from master KDC
[4] 1620808362.090489: Processing preauth types: PA-ETYPE-INFO2 (19)
[4] 1620808362.090490: Selected etype info: etype aes256-cts,params ""
[4] 1620808362.090491: Produced preauth for next request: (empty)
[4] 1620808362.090492: AS key determined by preauth: aes256-cts/83C9
[4] 1620808362.090493: Decrypted AS reply; session key is: aes256-cts/9506
[4] 1620808362.090494: FAST negotiation: unavailable
[4] 1620808362.090495: Initializing FILE:/tmp/krb5cc_0 with default princ Pavel_Alexeev@PETERSBURG.EPAM.COM
[4] 1620808362.090496: Storing Pavel_Alexeev@PETERSBURG.EPAM.COM -> krbtgt/PETERSBURG.EPAM.COM@PETERSBURG.EPAM.COM in FILE:/tmp/krb5cc_0
[4] 1620808362.090497: Storing config in FILE:/tmp/krb5cc_0 for krbtgt/PETERSBURG.EPAM.COM@PETERSBURG.EPAM.COM: pa_type: 2
[4] 1620808362.090498: Storing Pavel_Alexeev@PETERSBURG.EPAM.COM -> krb5_ccache_conf_data/pa_type/krbtgt\/PETERSBURG.EPAM.COM\@PETERSBURG.EPAM.COM@X-CACHECONF: in FILE:/tmp/krb5cc_0
%5|1620808363.004|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI client step 1
%2|1620808363.250|LIBSASL|rdkafka#producer-1| [thrd:sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap]: sasl_ssl://kafka-int.epm-eco.projects.epam.com:9095/bootstrap: GSSAPI Error:  Miscellaneous failure (see text) (Matching credential (kafka/ecsc00a09ead.epam.com@EPAM.COM) not found)

在我看来也非常有趣和奇怪的东西，在 kafkacat 执行后一切正常的主机上 klist 向我展示 3 张票：

$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: Pavel_Alexeev@PETERSBURG.EPAM.COM

Valid starting     Expires            Service principal
12/05/21 19:53:26  13/05/21 03:53:26  krbtgt/PETERSBURG.EPAM.COM@PETERSBURG.EPAM.COM
        renew until 19/05/21 19:53:26
12/05/21 19:53:27  13/05/21 03:53:26  krbtgt/EPAM.COM@PETERSBURG.EPAM.COM
        renew until 19/05/21 19:53:26
12/05/21 19:53:28  13/05/21 03:53:26  kafka/kafka-int.epm-eco.projects.epam.com@EPAM.COM
        renew until 13/05/21 05:53:28

但同时，如果我更改参数 '-Xsasl.kerberos.kinit.cmd=/usr/bin/kinit --use-referrals --password-file=/conf/paswd Pavel_Alexeev@PETERSBURG.EPAM。 COM; klist' 我看到只有一张票！例如：

$ podman run --rm -it --name kafkacat-DEV \
        -v$(pwd)/conf/integration:/conf -v$(pwd)/conf/integration/krb5.conf:/etc/krb5.conf \
        localhost/kafkacat_gssapi_heimdal:3 \
                kafkacat \
                        -b kafka-int.epm-eco.projects.epam.com:9095 \
                                -Xssl.ca.location=/conf/epm-eco-int.ca.crt \
                                -Xsecurity.protocol=SASL_SSL \
                                -Xsasl.mechanisms=GSSAPI \
                                '-Xsasl.kerberos.kinit.cmd=/usr/bin/kinit --use-referrals --password-file=/conf/paswd Pavel_Alexeev@PETERSBURG.EPAM.COM; klist' \
                                -Xsasl.kerberos.service.name=kafka \
                                        -m30 -L
...
Credentials cache: FILE:/tmp/krb5cc_0
        Principal: Pavel_Alexeev@PETERSBURG.EPAM.COM

  Issued                Expires               Principal
May 12 18:54:50 2021  May 13 02:54:49 2021  krbtgt/PETERSBURG.EPAM.COM@PETERSBURG.EPAM.COM
...

所以我不明白另外两个来自哪里

在容器中执行 kafkacat 后的列表也仅显示一个主体。

将不胜感激任何帮助。

附言也将其报告为 cyrus-sasl issue

解决方法

非常奇怪的问题，老实说我说不出为什么，但添加到 krb5.conf 中：

[libdefaults]
dns_canonicalize_hostname = false

解决问题。

附言我已将其发布为解决方案，因为它开始工作了。但是，如果有人可以在评论中解释为什么这是解决方案，尤其是如何从提供的日志中理解这一点，那将非常有帮助。

apache-kafkagssapikafkacatkerberossasl