https://pulsar.apache.org/ logo
Join Slack
Powered by
This message was deleted.
# general
s
This message was deleted.
a
You can just set 
appVersion: "3.0.2"
in the Chart.yaml
b
I tried. Still doesn't work
I have the latest helm chart which already has v3.0.2 in the app version
a
What error do you encounter?
b
2024-01-12T140814,177+0000 [pulsar-client-io-1-3] ERROR org.apache.pulsar.client.impl.ClientCnx - [id: 0x3f3194a1, L/10.4.28.335442 - Rpre devops pulsar upgrade proxy.pulsar.svc.cluster.local/172.20.141.2556651] Close connection because received internal-server error {"errorMsg":"org.apache.pulsar.client.api.PulsarClientException: Connection already closed","reqId":2440157358230427765, "remote":"pre-devops-pulsar-upgrade-proxy.pulsar.svc.cluster.local/172.20.141.255:6651", "local":"/10.4.28.3:35442"}
@Alexander Preuß Above is the error I get when I try to create producer or consumer
a
Can you check the broker logs around the same timestamp if there is anything unusual in there?
b
@Alexander Preuß Found this there
Copy code
2024-01-15T13:43:36,638+0000 [pulsar-io-4-1] WARN  org.apache.pulsar.broker.authorization.AuthorizationService - [/10.4.38.117:54580] Illegal combination of role [broker-admin] and originalPrincipal [admin]: cannot specify originalPrincipal when connecting without valid proxy role.
2024-01-15T13:43:36,641+0000 [pulsar-io-4-1] INFO  org.apache.pulsar.broker.service.ServerCnx - Closed connection from /10.4.38.117:54580
a
Looks like your auth setup is incorrect, you can take a look here https://pulsar.apache.org/docs/3.1.x/security-authorization/#proxy-roles
b
Sure Thanks. I set this up according to the latest helm chart. I will go through the document and make changes on my end where possible.
Thank you @Alexander Preuß
l
@Bhavya This was a gap in the Apache Pulsar Helm chart. I have created a PR to have this covered. https://github.com/apache/pulsar-helm-chart/pull/430 I guess you found the workaround, which is to set 
proxyRoles: 'proxy-admin'
in 
broker.configData
.
b
Thanks @Lari Hotari. But the error in broker refers to the combination of 
broker-admin
and 
admin
nothing with proxy-admin. adding 
proxyRoles: 'proxy-admin'
still doesn't work
l
What does your auth.superUsers look like in 
helm get values -a -o yaml -n namespace deployment_name
b
Copy code
auth:
  authentication:
    enabled: true
    provider: "jwt"
    jwt:
      # Enable JWT authentication
      # If the token is generated by a secret key, set the usingSecretKey as true.
      # If the token is generated by a private key, set the usingSecretKey as false.
      usingSecretKey: false
  authorization:
    enabled: true
  superUsers:
    # broker to broker communication
    broker: "broker-admin"
    # proxy to broker communication
    proxy: "proxy-admin"
    # pulsar-admin client to broker/proxy communication
    client: "admin"
This is what I have
l
Where did you add the proxyRoles? In broker.configData?
Which role does your token have that you use to access the proxy?
b
yes, so my broker.conf has the following proxyRoles=proxy-admin superUserRoles=admin,broker-admin,proxy-admin
👍 1
l
I assume that you set them via the values file, under broker.configData key?
b
yes
I added just this part in there proxyRoles: "proxy-admin"
l
You might want to verify that it is effective, with a login shell inside the pod and checking 
grep Roles /pulsar/conf/broker.conf
b
yup, Thats where I got the values above
Copy code
I have no name!@pre-devops-pulsar-upgrade-broker-1:/pulsar/conf$ grep Roles /pulsar/conf/broker.conf
proxyRoles=proxy-admin
superUserRoles=admin,broker-admin,proxy-admin
@Lari Hotari Thanks for pointing me at the tokens. I just realized I was using broker token for proxy all along. And it was surprisingly working with older version
Apologies and Thank you so much for helping me out
l
@Bhavya Thanks for reporting the issue. It's great that the problem was resolved!
🙏 1
2 Views
Open in Slack
PreviousNext
Powered by