Permission to read audit log topic

[povigg]

Hi there,
I'm planning to start using kafbat-ui and having a few problems regarding audit logs topic reading.
Currently i have audit logs enabled for one kafka clusters in my local test environment using docker. Docker compose file contains env. var. to add cluster and enable audit logs (unfortunately i was not able to get audit logs working as per example):

  environment:
      KAFKA_CLUSTERS_0_NAME: exp-kafka
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: <exp.kafka.server>
      KAFKA_CLUSTERS_0_AUDIT_TOPICAUDITENABLED: true
      KAFKA_CLUSTERS_0_AUDIT_CONSOLEAUDITENABLED: true
      KAFKA_CLUSTERS_0_AUDIT_TOPIC: kui-audit-log-test
      KAFKA_CLUSTERS_0_AUDIT_LEVEL: ALL

And a separate config.yml file which contains auth and rbac config:

auth:
  type: OAUTH2
  oauth2:
    client:
      okta:
        provider: okta
        clientId: "xxxxxxx"
        issuerUri: "https://test-okta.com/oauth2/xxxxxx"
        redirect-uri: http://localhost:8080/login/oauth2/code/okta
        user-name-attribute: email
        scope: [ 'openid' , 'email' , 'profile' , 'groups' ]
        clientSecret: "xxxxxxxxxxxxxx"
        custom-params:
          type: oauth
          roles-field: groups

rbac:
  roles:
    - name: "admin"
      clusters:
        - exp-kafka
      subjects:
        - provider: oauth
          type: user
          value: "[email protected]"
      permissions:
        - resource: applicationconfig
          actions: all
        - resource: clusterconfig
          actions: all
        - resource: topic
          value: ".*"
          actions: all
        - resource: audit
          actions: all
        - resource: consumer
          value: ".*"
          actions: all
        - resource: schema
          value: ".*"
          actions: all
        - resource: connect
          value: ".*"
          actions: all
        - resource: ksql
          actions: all
        - resource: acl
          actions: all

After some research i found a file which lets to add 'VIEW' permissions for audit via rbac (i have tried either 'view' or 'all' for the action), however i'm still not able to read the topic:

- resource: audit
  actions: all

Once reading audit topic fails error message appears in the console which is being spammed every second:

kafbat-ui  | 2024-10-08 10:49:39,307 INFO  [reactor-http-epoll-5] audit: {"timestamp":"2024-10-08T10:49:39.307397543Z","username":"[email protected]","clusterName":"exp-kafka","resources":[{"type":"TOPIC","id":"kui-audit-log-test","alter":false,"accessType":["MESSAGES_READ"]},{"type":"AUDIT","alter":false,"accessType":["VIEW"]}],"operation":"getTopicMessages","result":{"success":false,"error":"ACCESS_DENIED"}}

Funny enough this spam does not stop even after closing the topic and navigating anywhere else in kafbat-ui.

Please advise me on:

1. What is the correct way to enable read permissions for audit logs topic via rbac (or any other way)
2. How can i stop error message spam after unauthorised person tries to open messages in audit log topic? (I will be using very specific rbac rules so only certain person will be able to see audit log topic)

Hope my question was clear enough and thanks in advance.
Regards,
Povilas

[Haarolean]

Hi,

1. see this
2. we'd need to investigate

[povigg]

Thank you for quick response and apologies for missing to see that issue.
Seems like work around is not working for me, probably because audit is enabled via env. vars. so will try to enable in the way as per documentation.
Regards.