Mailing-List: contact jira-help@kafka.apache.org; run by ezmlm
Precedence: bulk
Reply-To: jira@kafka.apache.org
Date: Fri, 21 Jul 2017 01:19:00 +0000 (UTC)
From: "zhu fangbo (JIRA)" <jira@apache.org>
To: jira@kafka.apache.org
Message-ID: <JIRA.13088689.1500544222000.298391.1500599940177@Atlassian.JIRA>
In-Reply-To: <JIRA.13088689.1500544222000@Atlassian.JIRA>
References: <JIRA.13088689.1500544222000@Atlassian.JIRA> <JIRA.13088689.1500544222844@jira-lw-us.apache.org>
Subject: [jira] [Updated] (KAFKA-5616) unable perform a rolling upgrade from
 a non-secure to a secure Kafka cluster
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Fri, 21 Jul 2017 01:19:06 -0000


     [ https://issues.apache.org/jira/browse/KAFKA-5616?page=3Dcom.atlassia=
n.jira.plugin.system.issuetabpanels:all-tabpanel ]

zhu fangbo updated KAFKA-5616:
------------------------------
    Description:=20
I want to upgrade my unsecure kafka cluster to a secure one whitch support =
SASL_PLAINT protocol, but I failed to perfrom rolling upgrade. The only way=
 I found to upgrade is to shutdown all brokers first and then restart all b=
rokers with inter-broker security configured

h3. Before upgrade
Here is the secure configuration of broker 1=EF=BC=9A
{quote}listeners=3DPLAINTEXT://10.45.4.9:9092,SASL_PLAINTEXT://10.45.4.9:90=
99
sasl.enabled.mechanisms=3DPLAIN
authorizer.class.name =3D kafka.security.auth.SimpleAclAuthorizer
super.users=3DUser:admin{quote}
I want to setup a cluster support both unsecure and secure client-broker co=
nnect, so i add a new endpoint to listeners with port  =3D 9099

h3. Start rolling upgrade
First, I restart broker-1 which is not the controller. below is part of  se=
rver.log shows start complete:
!http://olt6kofv9.bkt.clouddn.com/17-7-20/25775149.jpg|height=3D200,width=
=3D800,hspace=3D1,vspace=3D4!

seemed well, but there are no log print to show the replicamanger was start=
ed,and broker1 not go back to the ISR
!http://olt6kofv9.bkt.clouddn.com/17-7-20/55734691.jpg|align=3Dleft, height=
=3D200,width=3D800!

Besides, the preferred replica leader election was also failed
!http://olt6kofv9.bkt.clouddn.com/17-7-20/94837206.jpg|align=3Dleft, height=
=3D200,width=3D800!

h3. After rolling upgrade for all brokers
 After upgrade all brokers, it seems each broker can not connect to other b=
rokers
!http://olt6kofv9.bkt.clouddn.com/17-7-20/84863343.jpg|align=3Dleft, height=
=3D200,width=3D800!

I restart broker 2 at last which is the controller, then broker 3 came to b=
e controller, and it also failed to perform preferred replica leader electi=
on
!http://olt6kofv9.bkt.clouddn.com/17-7-20/70680876.jpg|align=3Dleft, height=
=3D200,width=3D800!

h3. Shutdown all and restart=20
The cluster works well when  I shutdown all brokers and restart all with in=
ter-broker security configurations like this:
{quote}listeners=3DPLAINTEXT://10.45.4.9:9092,SASL_PLAINTEXT://10.45.4.9:90=
99
#advertised.listeners=3DSASL_PLAINTEXT://10.45.4.9:9099
security.inter.broker.protocol=3DSASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol=3DPLAIN{quote}

replica fetch thread was started
!http://olt6kofv9.bkt.clouddn.com/17-7-20/98186199.jpg|align=3Dleft, height=
=3D200,width=3D800!

and ISR was normal
!http://olt6kofv9.bkt.clouddn.com/17-7-20/13606263.jpg|align=3Dleft, height=
=3D200,width=3D800!


  was:
I want to upgrade my unsecure kafka cluster to a secure one whitch support =
SASL_PLAINT protocol, but I failed to perfrom rolling upgrade. The only way=
 I found to upgrade is to shutdown all brokers first and then restart all b=
rokers with inter-broker security configured

h3. Before upgrade
Here is the secure configuration of broker 1=EF=BC=9A
{quote}listeners=3DPLAINTEXT://10.45.4.9:9092,SASL_PLAINTEXT://10.45.4.9:90=
99
sasl.enabled.mechanisms=3DPLAIN
authorizer.class.name =3D kafka.security.auth.SimpleAclAuthorizer
super.users=3DUser:admin{quote}
I want to setup a cluster support both unsecure and secure client-broker co=
nnect, so i add a new endpoint to listeners with port  =3D 9099

h3. Start rolling upgrade
First, I restart broker-1 which is not the controller. below is part of  se=
rver.log shows start complete:
!http://olt6kofv9.bkt.clouddn.com/17-7-20/25775149.jpg|align=3Dleft, height=
=3D200,width=3D800,hspace=3D1,vspace=3D4!

seemed well, but there are no log print to show the replicamanger was start=
ed,and broker1 not go back to the ISR
!http://olt6kofv9.bkt.clouddn.com/17-7-20/55734691.jpg|align=3Dleft, height=
=3D200,width=3D800!

Besides, the preferred replica leader election was also failed
!http://olt6kofv9.bkt.clouddn.com/17-7-20/94837206.jpg|align=3Dleft, height=
=3D200,width=3D800!

h3. After rolling upgrade for all brokers
 After upgrade all brokers, it seems each broker can not connect to other b=
rokers
!http://olt6kofv9.bkt.clouddn.com/17-7-20/84863343.jpg|align=3Dleft, height=
=3D200,width=3D800!

I restart broker 2 at last which is the controller, then broker 3 came to b=
e controller, and it also failed to perform preferred replica leader electi=
on
!http://olt6kofv9.bkt.clouddn.com/17-7-20/70680876.jpg|align=3Dleft, height=
=3D200,width=3D800!

h3. Shutdown all and restart=20
The cluster works well when  I shutdown all brokers and restart all with in=
ter-broker security configurations like this:
{quote}listeners=3DPLAINTEXT://10.45.4.9:9092,SASL_PLAINTEXT://10.45.4.9:90=
99
#advertised.listeners=3DSASL_PLAINTEXT://10.45.4.9:9099
security.inter.broker.protocol=3DSASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol=3DPLAIN{quote}

replica fetch thread was started
!http://olt6kofv9.bkt.clouddn.com/17-7-20/98186199.jpg|align=3Dleft, height=
=3D200,width=3D800!

and ISR was normal
!http://olt6kofv9.bkt.clouddn.com/17-7-20/13606263.jpg|align=3Dleft, height=
=3D200,width=3D800!


> unable perform a rolling upgrade from a non-secure to a secure Kafka clus=
ter
> -------------------------------------------------------------------------=
---
>
>                 Key: KAFKA-5616
>                 URL: https://issues.apache.org/jira/browse/KAFKA-5616
>             Project: Kafka
>          Issue Type: Bug
>          Components: core
>    Affects Versions: 0.10.1.1
>            Reporter: zhu fangbo
>
> I want to upgrade my unsecure kafka cluster to a secure one whitch suppor=
t SASL_PLAINT protocol, but I failed to perfrom rolling upgrade. The only w=
ay I found to upgrade is to shutdown all brokers first and then restart all=
 brokers with inter-broker security configured
> h3. Before upgrade
> Here is the secure configuration of broker 1=EF=BC=9A
> {quote}listeners=3DPLAINTEXT://10.45.4.9:9092,SASL_PLAINTEXT://10.45.4.9:=
9099
> sasl.enabled.mechanisms=3DPLAIN
> authorizer.class.name =3D kafka.security.auth.SimpleAclAuthorizer
> super.users=3DUser:admin{quote}
> I want to setup a cluster support both unsecure and secure client-broker =
connect, so i add a new endpoint to listeners with port  =3D 9099
> h3. Start rolling upgrade
> First, I restart broker-1 which is not the controller. below is part of  =
server.log shows start complete:
> !http://olt6kofv9.bkt.clouddn.com/17-7-20/25775149.jpg|height=3D200,width=
=3D800,hspace=3D1,vspace=3D4!
> seemed well, but there are no log print to show the replicamanger was sta=
rted,and broker1 not go back to the ISR
> !http://olt6kofv9.bkt.clouddn.com/17-7-20/55734691.jpg|align=3Dleft, heig=
ht=3D200,width=3D800!
> Besides, the preferred replica leader election was also failed
> !http://olt6kofv9.bkt.clouddn.com/17-7-20/94837206.jpg|align=3Dleft, heig=
ht=3D200,width=3D800!
> h3. After rolling upgrade for all brokers
>  After upgrade all brokers, it seems each broker can not connect to other=
 brokers
> !http://olt6kofv9.bkt.clouddn.com/17-7-20/84863343.jpg|align=3Dleft, heig=
ht=3D200,width=3D800!
> I restart broker 2 at last which is the controller, then broker 3 came to=
 be controller, and it also failed to perform preferred replica leader elec=
tion
> !http://olt6kofv9.bkt.clouddn.com/17-7-20/70680876.jpg|align=3Dleft, heig=
ht=3D200,width=3D800!
> h3. Shutdown all and restart=20
> The cluster works well when  I shutdown all brokers and restart all with =
inter-broker security configurations like this:
> {quote}listeners=3DPLAINTEXT://10.45.4.9:9092,SASL_PLAINTEXT://10.45.4.9:=
9099
> #advertised.listeners=3DSASL_PLAINTEXT://10.45.4.9:9099
> security.inter.broker.protocol=3DSASL_PLAINTEXT
> sasl.mechanism.inter.broker.protocol=3DPLAIN{quote}
> replica fetch thread was started
> !http://olt6kofv9.bkt.clouddn.com/17-7-20/98186199.jpg|align=3Dleft, heig=
ht=3D200,width=3D800!
> and ISR was normal
> !http://olt6kofv9.bkt.clouddn.com/17-7-20/13606263.jpg|align=3Dleft, heig=
ht=3D200,width=3D800!


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)