apache/skywalking

Configuring kafka-fetcher to use the SASL_SSL security mode results in a failure when starting OAP.

Open

#13,849 建立於 2026年4月27日

在 GitHub 查看
 (4 留言) (0 反應) (0 負責人)Java (24,794 star) (6,648 fork)batch import
bugdependenciesgood first issue

描述

Search before asking

  • I had searched in the issues and found no similar issues.

Apache SkyWalking Component

OAP server (apache/skywalking)

What happened

\n "index": 0,\n "description": "```\nat java.base/java.lang.Thread.run(Unknown Source)\n\njava.io.IOException: Channel could not be created for socket java.nio.channels.SocketChannel[closed]\n at org.apache.kafka.common.network.Selector.buildAndAttachKafkaChannel(Selector.java:239)\n at org.apache.kafka.common.network.Selector.connect(Selector.java:256)\n at org.apache.kafka.common.network.Selector.init(Selector.java:992)\n at org.apache.kafka.clients.NetworkClient.(NetworkClient.java:301)\n at org.apache.kafka.clients.admin.KafkaAdminClient.(KafkaAdminClient.java:1141)\n at org.apache.kafka.clients.admin.KafkaAdminClient.(KafkaAdminClient.java:1401)\n at java.base/java.lang.Thread.run(Unknown Source)\nCaused by: org.apache.kafka.common.KafkaException: Failed to configure SaslClientAuthenticator\n at org.apache.kafka.common.errors.SaslAuthenticationException: Failed to configure SaslClientAuthenticator\n at org.apache.kafka.common.network.Selector.buildAndAttachKafkaChannel(Selector.java:338)\n ... 8 more\nCaused by: java.lang.UnsupportedOperationException: SubSubject is not supported\n at java.base/java.lang.Subject.getSubject(Unknown Source)\n at org.apache.kafka.common.security.sasl.SaslClientAuthenticator.(SaslClientAuthenticatorImpl.java:140)\n at java.security.sasl/com.sun.security.sasl.ClientFactoryImpl.createSaslClient(Unknown Source)\n at org.apache.kafka.common.security.sasl.SaslClientAuthenticator.lambda$createSaslClient$0(SaslClientAuthenticator.java:219)\n at org.apache.kafka.common.security.sasl.SaslClientAuthenticator.withoutAuthenticator(Unknown Source)\n at java.base/jdk.internal.vm.Scope$ScopeValueContainer.call(Unknown Source)\n at java.base/jdk.internal.vm.Scope.withScope(Unknown Source)\n at java.base/javax.security.auth.Subject.calls(Unknown Source)\n

What you expected to happen

It is possible to start pulling metrics and trace data from Kafak normally.

How to reproduce

The skywalking10.4.0 version encounters an error when starting up because the kafka-fetcher is set to the SASL_SSL security mode. However, this issue does not occur with the 10.1.0 version.

Anything else

No response

Are you willing to submit a pull request to fix on your own?

  • Yes I am willing to submit a pull request on my own!

Code of Conduct

貢獻者指南

技術棧
java
領域
backendobservability
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-2 days
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
fresh
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
mostly clear
前置要求
Kafka basicsSASL authenticationSkyWalking OAP architecture
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
30
研究方向
Investigate the error stack trace, focusing on the `SubSubject is not supported` exception in `javax.security.auth.Subject.getSubject`. Compare the Kafka client library version and Java version used in SkyWalking 10.4.0 versus 10.1.0. Determine if a Java upgrade or Kafka client change introduced incompatibility with SASL SSL. Look at `org.apache.kafka.common.security.sasl.SaslClientAuthenticator` and the `Subject` usage. Check if any OAP configuration changes can work around the issue.