我正在尝试设置我的Kafka集群接受SASL_SSL / SCRAM认证。首先，一切都在实际工作，客户端使用SASL_SSL / GSSAPI连接。我的Zk服务器也配置为SASL认证和TLS。
我使用的是Kafka和Zk的融合的 Docker 形象：

• 汇合/cp-kafka：6.0.1
• 汇合/cp-动物饲养员：5.5.3-3

所以我修改了我的设置，允许Kafka中的SCRAM-SHA-512：KAFKA_SASL_ENABLED_MECHANISMS=GSSAPI,SCRAM-SHA-512
在these instructions之后，我现在想在Zk中添加用户，这是问题开始的地方（从Kafka节点开始）：

[root@kafka1 [RCI] ~]# /usr/bin/podman exec kafka kafka-configs --zk-tls-config-file /etc/kafka/secrets/zk-ssl.properties --zookeeper Zk:3181 --alter --entity-type topics --entity-name test_jerome --add-config 'retention.ms=1'
Warning: --zookeeper is deprecated and will be removed in a future version of Kafka.
Use --bootstrap-server instead to specify a broker to connect to.
[2021-01-21 17:44:14,807] WARN zookeeper.ssl.keyStore.location not specified (org.apache.zookeeper.common.X509Util)
Error while executing config command with args '--zk-tls-config-file /etc/kafka/secrets/zk-ssl.properties --zookeeper Zk:3181 --alter --entity-type topics --entity-name test_jerome --add-config retention.ms=1'
org.apache.zookeeper.KeeperException$InvalidACLException: KeeperErrorCode = InvalidACL for /config/changes
    at org.apache.zookeeper.KeeperException.create(KeeperException.java:128)
    at org.apache.zookeeper.KeeperException.create(KeeperException.java:54)
    at kafka.zookeeper.AsyncResponse.maybeThrow(ZooKeeperClient.scala:564)
    at kafka.zk.KafkaZkClient.createRecursive(KafkaZkClient.scala:1646)
    at kafka.zk.KafkaZkClient.makeSurePersistentPathExists(KafkaZkClient.scala:1568)
    at kafka.zk.KafkaZkClient.createConfigChangeNotification(KafkaZkClient.scala:395)
    at kafka.zk.AdminZkClient.changeEntityConfig(AdminZkClient.scala:385)
    at kafka.zk.AdminZkClient.changeTopicConfig(AdminZkClient.scala:342)
    at kafka.zk.AdminZkClient.changeConfigs(AdminZkClient.scala:278)
    at kafka.admin.ConfigCommand$.alterConfigWithZk(ConfigCommand.scala:167)
    at kafka.admin.ConfigCommand$.processCommandWithZk(ConfigCommand.scala:118)
    at kafka.admin.ConfigCommand$.main(ConfigCommand.scala:92)
    at kafka.admin.ConfigCommand.main(ConfigCommand.scala)
Error: non zero exit code: 1: OCI runtime error

ZK日志实际上没有什么帮助：

[2021-01-21 17:58:08,333] INFO Successfully authenticated client: authenticationID=admin;  authorizationID=admin. (org.apache.zookeeper.server.auth.SaslServerCallbackHandler)
[2021-01-21 17:58:08,333] INFO Successfully authenticated client: authenticationID=admin;  authorizationID=admin. (org.apache.zookeeper.server.auth.SaslServerCallbackHandler)
[2021-01-21 17:58:08,333] INFO Setting authorizedID: admin (org.apache.zookeeper.server.auth.SaslServerCallbackHandler)
[2021-01-21 17:58:08,333] INFO Setting authorizedID: admin (org.apache.zookeeper.server.auth.SaslServerCallbackHandler)
[2021-01-21 17:58:08,334] INFO adding SASL authorization for authorizationID: admin (org.apache.zookeeper.server.ZooKeeperServer)
[2021-01-21 17:58:08,334] INFO adding SASL authorization for authorizationID: admin (org.apache.zookeeper.server.ZooKeeperServer)

正如您所看到的，SASL身份验证正常工作，并且管理员用户被很好地识别。
如果我登录到Zk shell（从Zk节点），您可以看到acl是完全打开的：

getAcl /config/users
'world,'anyone
: cdrwa
getAcl /config
'world,'anyone
: cdrwa
getAcl /
'world,'anyone
: cdrwa

如果我在Zk shell中创建目录（从Zk节点），它将工作：

create /config/users/topicctl
Created /config/users/topicctl

当我这样做时，Zk服务器上没有日志，因为我没有进行身份验证。
我现在花了一个下午的时间在这个问题上没有任何进展。
请问有什么问题吗？