Description
When using Confluent Docker images with Confluent Platform 7.6+ and RBAC, the containers may not start with the following error:
java.lang.NoSuchMethodError: 'void org.apache.kafka.common.security.oauthbearer.internals.secured.JaasOptionsUtils.validateOAuthMechanismAndNonNullJaasConfig(java.lang.String, java.util.List)'
Full stack trace:
Error while running kafka-ready.
org.apache.kafka.common.KafkaException: Failed to create new KafkaAdminClient
at org.apache.kafka.clients.admin.KafkaAdminClient.createInternal(KafkaAdminClient.java:519)
at org.apache.kafka.clients.admin.Admin.create(Admin.java:144)
at org.apache.kafka.clients.admin.AdminClient.create(AdminClient.java:49)
at io.confluent.admin.utils.ClusterStatus.isKafkaReady(ClusterStatus.java:136)
at io.confluent.admin.utils.cli.KafkaReadyCommand.main(KafkaReadyCommand.java:149)
Caused by: org.apache.kafka.common.KafkaException: Failed to create new NetworkClient
at org.apache.kafka.clients.ClientUtils.createNetworkClient(ClientUtils.java:245)
at org.apache.kafka.clients.ClientUtils.createNetworkClient(ClientUtils.java:185)
at org.apache.kafka.clients.admin.KafkaAdminClient.createInternal(KafkaAdminClient.java:503)
... 4 more
Caused by: org.apache.kafka.common.KafkaException: java.lang.NoSuchMethodError: 'void org.apache.kafka.common.security.oauthbearer.internals.secured.JaasOptionsUtils.validateOAuthMechanismAndNonNullJaasConfig(java.lang.String, java.util.List)'
at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:184)
at org.apache.kafka.common.network.ChannelBuilders.create(ChannelBuilders.java:192)
at org.apache.kafka.common.network.ChannelBuilders.clientChannelBuilder(ChannelBuilders.java:81)
at org.apache.kafka.clients.ClientUtils.createChannelBuilder(ClientUtils.java:117)
at org.apache.kafka.clients.ClientUtils.createNetworkClient(ClientUtils.java:217)
... 6 more
Caused by: java.lang.NoSuchMethodError: 'void org.apache.kafka.common.security.oauthbearer.internals.secured.JaasOptionsUtils.validateOAuthMechanismAndNonNullJaasConfig(java.lang.String, java.util.List)'
at io.confluent.kafka.clients.plugins.auth.token.AbstractTokenLoginCallbackHandler.jaasConfigDef(AbstractTokenLoginCallbackHandler.java:118)
at io.confluent.kafka.clients.plugins.auth.token.AbstractTokenLoginCallbackHandler.configure(AbstractTokenLoginCallbackHandler.java:62)
at org.apache.kafka.common.security.authenticator.LoginManager.<init>(LoginManager.java:60)
at org.apache.kafka.common.security.authenticator.LoginManager.acquireLoginManager(LoginManager.java:105)
at org.apache.kafka.common.network.SaslChannelBuilder.configure(SaslChannelBuilder.java:170)
... 10 more
Applies To
Confluent Platform Docker images with CP 7.6+ and RBAC setup
Cause
In a RBAC setup, CUB_CLASSPATH environment variable (used by Confluent Platform Utility Belt (cub)) is required and the order of jars is now important
Resolution
Make sure that "/usr/share/java/cp-base-new/*" is last in the list of CUB_CLASSPATH environment variable.
Examples:
- connect
Put "/usr/share/java/kafka/*" at beginning:
CUB_CLASSPATH: '/usr/share/java/kafka/*:/etc/confluent/docker/docker-utils.jar:/usr/share/java/cp-base-new/*:/usr/share/java/confluent-security/connect/*:/usr/share/java/confluent-secret-registry/*'
- schema-registry
Put "/usr/share/java/confluent-security/schema-registry/*" at beginning:
CUB_CLASSPATH: '/usr/share/java/confluent-security/schema-registry/*:/usr/share/java/schema-registry/*:/etc/confluent/docker/docker-utils.jar:/usr/share/java/cp-base-new/*'
- ksqlDB
Put "/usr/share/java/confluent-security/ksql/*" at beginning:
CUB_CLASSPATH: '/usr/share/java/confluent-security/ksql/*:/usr/share/java/ksqldb-server/*:/usr/share/java/cp-base-new/*'
- control-center
Put "/usr/share/java/confluent-control-center/*" at beginning:
CUB_CLASSPATH: '/usr/share/java/confluent-control-center/*:/usr/share/java/rest-utils/*:/usr/share/java/confluent-common/*:/etc/confluent/docker/docker-utils.jar:/usr/share/java/cp-base-new/*'