0

On a couple of my clusters I'm seeing a discrepancy between the list of topics returned by zookeeper as compared to the broker i.e the following commands return different (fewer in the case of the broker) results

kafka-topics.sh --zookeeper $zookeeper --list
kafka-topics.sh --bootstrap-server $broker --command-config $clientProperties --list

I've seen this behaviour with multiple client versions which leads me to assume that the issue is on the server side, but I have no idea what the root cause is or how to fix it.

It causes an issue for me because I'm using some code that uses the brokers for GET operations like listing topics, and zookeeper for SET operations (create/updating topics). If the broker doesn't return a topic in a listing, then the code path leads to a CREATE action against zookeeper and that will be rejected (it will fail). Unfortunately, I don't control the code so I can't apply a fix there.

Nonetheless, surely the list of topics in zookeeper should be identical to the list in the broker?

I'm using Kafka (Amazon MSK) version 2.2.1

JustCatchingRye
  • 11
  • 3
  • Are you giving the appropriate zookeeper url? Is the zookeeper url that you gave correspond to the Kafka broker or cluster that you are finding a discrepancy against? – JavaTechnical Jun 19 '20 at 15:08
  • Yes, I'm using the correct URL's in both cases. A subset of the topics seen in zookeeper (which returns the correct list) are seen in the broker listing – JustCatchingRye Jun 19 '20 at 15:20
  • Maybe try restating the kafka controller node, where the topic list metadata request goes – OneCricketeer Jun 20 '20 at 04:24

1 Answers1

1

Thanks for the suggestions in this post. This is the explanation and solution:

The command "kafka-topics.sh --zookeeper" and "kafka-topics.sh --bootstrap-server" return two different outputs because the latter takes into account the configured ACLs which, in this case, prevent access to the topic metadata. Hence, the command through zookeeper provides the full list of topics, whereas the command through the broker provides only the topics for which ACLs are not configured.

In order to ensure the second command works as expected, you need to explicitly add to the ACL list of the affected topics access to the "DESCRIBE" operation

(^^ kudos to AWS Support for figuring this out)

JustCatchingRye
  • 11
  • 3