- Beat: All (Kafka output), Filebeat (Kafka input)
- Version: 7.x - current 8.x
Kerberos authentication for the Kafka input and output (currently in beta) has known issues with Microsoft Active Directory (a common Kerberos implementation). This usually results in the error "Client has run out of brokers to talk to" (Sarama, our Kafka library, doesn't currently surface more detailed errors during Kerberos authentication, and this is its generic fallback error which can indicate a wide variety of protocol and authentication failures). While we have seen the error in many deployments we haven't reproduced it on our own systems, so we can't yet trace the underlying cause.
In most cases where this problem is observed, the error arises immediately when authentication to Kafka is attempted. In rarer cases, the initial authentication seems to succeed but then arises while connecting to other nodes in the Kafka cluster. We don't have confirmation of any deployments that have successfully ingested to Kafka while authenticating via Active Directory.
Currently we do not know any workarounds.
Kerberos authentication for the Kafka input and output (currently in beta) has known issues with Microsoft Active Directory (a common Kerberos implementation). This usually results in the error "Client has run out of brokers to talk to" (Sarama, our Kafka library, doesn't currently surface more detailed errors during Kerberos authentication, and this is its generic fallback error which can indicate a wide variety of protocol and authentication failures). While we have seen the error in many deployments we haven't reproduced it on our own systems, so we can't yet trace the underlying cause.
In most cases where this problem is observed, the error arises immediately when authentication to Kafka is attempted. In rarer cases, the initial authentication seems to succeed but then arises while connecting to other nodes in the Kafka cluster. We don't have confirmation of any deployments that have successfully ingested to Kafka while authenticating via Active Directory.
Currently we do not know any workarounds.