OnPrem Nussknacker instance with Azure Event Hub & Azure Schema Registry

[sridharanss]

How to configure the OnPrem Nussknacker instance with Azure Event Hub. I was following the QuickStart guide with FLink.

I was able to install the Nussknacker OnPrem instance in Docker by pointing to my external Kafka instance, it working fine.

Can't found any sample (Yaml file) to configure OnPrem Nussknacker instance with Azure Event Hub and Azure Schema Registry. I changed the config to pointing Azure Event Hub, and also changed the Schema registry to pointing Azure Schema Registry by following [https://techcommunity.microsoft.com/t5/azure-paas-blog/how-to-migrate-schema-registry-from-confluent-to-azure-event-hub/ba-p/3565403](Microsoft Link). But its throwing error as below.

[2024-02-10 08:21:34,906] WARN [AdminClient clientId=adminclient-1] Connection to node -1 (xxxxxx.servicebus.windows.net/xx.yy.zz.19:9093) terminated during authentication. This may happen due to any of the following reasons: (1) Authentication failed due to invalid credentials with brokers older than 1.0.0, (2) Firewall blocking Kafka TLS traffic (eg it may only allow HTTPS traffic), (3) Transient network issue. (org.apache.kafka.clients.NetworkClient)

AKHQ is working fine after updating it to latest image, but still the schema registry is not working with azure event hub.

Can you please share some sample for configuring the OnPrem Instance with Azure Event Hub and Azure Schema Registry ?

Also, my requirement is to connect multiple Event Hubs with OnPrem Instance.

Nussknacker Config
components.kafka { config: { kakf1.kafkaProperties { #we want to pass earliest in benchmarks, it's not easy to override it in a different way "auto.offset.reset": ${KAFKA_AUTO_OFFSET_RESET} "bootstrap.servers": "xxxxxxx.servicebus.windows.net:9093" "security.protocol": "SASL_SSL" "sasl.mechanism": "PLAIN" "sasl.jaas.config": "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"$ConnectionString\" password=\"Endpoint=sb://xxxxxxx.servicebus.windows.net/;SharedAccessKeyName=SendAndListen;SharedAccessKey=xxxxxxx\";" } schemaRegistryCacheConfig { availableSchemasExpirationTime: ${AVAILABLE_SCHEMAS_EXPIRATION_TIME} } } }

Schema Registry (through .env file)
SCHEMA_REGISTRY_HOST_NAME = schemaregistry SCHEMA_REGISTRY_KAFKASTORE_BOOTSTRAP_SERVERS = xxxxxxxx.servicebus.windows.net:9093 SCHEMA_REGISTRY_KAFKASTORE_SECURITY_PROTOCOL = SASL_SSL SCHEMA_REGISTRY_KAFKASTORE_SASL_MECHANISM = PLAIN SCHEMA_REGISTRY_KAFKASTORE_SASL_JAAS_CONFIG = org.apache.kafka.common.security.plain.PlainLoginModule required username="$ConnectionString" password="Endpoint=sb://xxxxxx.servicebus.windows.net/;SharedAccessKeyName=SendAndListen;SharedAccessKey=xxxxxxxxxx";

[arkadius]

Hi, have you read this: https://nussknacker.io/documentation/docs/integration/KafkaIntegration/#azure-based-schema-registry---connection-and-authentication documentation section?
How do you provide credentials? Via azure.tenant.id, azure.client.id and azure.client.secret properties or Azure CLI / Azure PowerShell?
I don't have the exact sample of configuration for the on premises but this tutorial: https://nussknacker.io/documentation/cloud/azure/ contains the most important part with kafkaProperties.

Regarding multiple event hubs. What do you exactly mean by that? Because in Azure terminology event hub is something like Kafka topic, so multiple event hubs is just a typical situation when you configure connection once and new topics just appear in the Nussknacker designer instanly when they are available. Do yo mean multiple event hub namespaces? If so, you can achieve that by configuring multiple component provider using the same providerType = kafka but with a different Azure Event Hubs configuration. See https://nussknacker.io/documentation/docs/installation_configuration_guide/model/ModelConfiguration/#configuration-of-component-providers

With regards to pasted configs:

1. kakf1.kafkaProperties <- what was the idea with this kakf1?
2. I can't see entries with credentials. See my question on the beginning.
3. If you use Azure's shema registry, you should remove the schema registry entry from docker-compose and instead add a schema.registry.url and schema.group entries in the nussknacker configuration as presented in the tutorial for the cloud.

[sridharanss]

Thank you for Response @arkadius

I corrected the error in my configuration and my current situation is,

I configured the OnPrem Nussknacker with Azure Event Hub and Azure Schema Registry. By providing the tenant id, client id, username & password, based on Microsoft Document

I'm getting following error in designer console, I have configured ClientId, TenantId, UserName & Password (EnvironmentCredentials) but designer is treating that as WorkloadIdentityCredential and its failing.

Is there any additional parameter needs to be passed to make it working with EnvironmentCredentials?

properties in config file
kafkaProperties { #we want to pass earliest in benchmarks, it's not easy to override it in a different way "auto.offset.reset": ${KAFKA_AUTO_OFFSET_RESET} "bootstrap.servers": "xxxxxxx.servicebus.windows.net:9093" "security.protocol": "SASL_SSL" "sasl.mechanism": "PLAIN" "sasl.jaas.config": "org.apache.kafka.common.security.plain.PlainLoginModule required username=\"$ConnectionString\" password=\"Endpoint=sb://xxxxxxx.servicebus.windows.net/;SharedAccessKeyName=accesskey;SharedAccessKey=xxx\";" "schema.registry.url" : "https://xxxxxxx.servicebus.windows.net" "schema.group" : "Testing" "azure.tenant.id" : "123123xsfdsdf" "azure.client.id" : "xxxxxyyyyyyxxxxxyyyyxxyy" "azure.username" : "zxzxzxzxzxzzxzxzxz" "azure.password" : "zxzxzxzxzxzzxzxzxz" }

Error Log
2024-02-13 06:54:39.192 [parallel-2] INFO c.a.identity.ChainedTokenCredential - Azure Identity => Attempted credential EnvironmentCredential is unavailable. 2024-02-13 06:54:39.192 [parallel-2] ERROR c.a.i.WorkloadIdentityCredential - WorkloadIdentityCredential authentication unavailable. The workload options are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/java/identity/workloadidentitycredential/troubleshoot 2024-02-13 06:54:39.192 [parallel-2] INFO c.a.identity.ChainedTokenCredential - Azure Identity => Attempted credential WorkloadIdentityCredential is unavailable. 2024-02-13 06:54:39.694 [ForkJoinPool.commonPool-worker-7] INFO c.a.identity.ChainedTokenCredential - Azure Identity => Attempted credential ManagedIdentityCredential is unavailable. 2024-02-13 06:54:39.697 [ForkJoinPool.commonPool-worker-7] INFO c.a.identity.ChainedTokenCredential - Azure Identity => Attempted credential AzureDeveloperCliCredential is unavailable. 2024-02-13 06:54:39.698 [ForkJoinPool.commonPool-worker-3] INFO c.a.identity.ChainedTokenCredential - Azure Identity => Attempted credential SharedTokenCacheCredential is unavailable. 2024-02-13 06:54:39.699 [ForkJoinPool.commonPool-worker-3] INFO c.a.identity.ChainedTokenCredential - Azure Identity => Attempted credential IntelliJCredential is unavailable. 2024-02-13 06:54:39.701 [ForkJoinPool.commonPool-worker-3] INFO c.a.identity.ChainedTokenCredential - Azure Identity => Attempted credential AzureCliCredential is unavailable. 2024-02-13 06:54:39.703 [ForkJoinPool.commonPool-worker-7] INFO c.a.identity.ChainedTokenCredential - Azure Identity => Attempted credential AzurePowerShellCredential is unavailable. 2024-02-13 06:54:39.704 [ForkJoinPool.commonPool-worker-7] INFO c.a.identity.ChainedTokenCredential - Azure Identity => Attempted credential DefaultAzureCredential is unavailable. 2024-02-13 06:54:39.704 [ForkJoinPool.commonPool-worker-7] ERROR c.a.c.i.AccessTokenCache - {"az.sdk.message":"Failed to acquire a new access token.","exception":"EnvironmentCredential authentication unavailable. Environment variables are not fully configured.To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/java/identity/environmentcredential/troubleshoot\r\nWorkloadIdentityCredential authentication unavailable. The workload options are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/java/identity/workloadidentitycredential/troubleshoot\r\nManaged Identity authentication is not available.\r\nAzureDeveloperCliCredential authentication unavailable. Azure Developer CLI not installed.To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/java/identity/azdevclicredential/troubleshoot\r\nSharedTokenCacheCredential authentication unavailable. No accounts were found in the cache.\r\nIntelliJ Authentication not available. Please log in with Azure Tools for IntelliJ plugin in the IDE.\r\nAzureCliCredential authentication unavailable. Azure CLI not installed.To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/java/identity/azclicredential/troubleshoot\r\nUnable to execute PowerShell. Please make sure that it is installed in your systemTo mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azure-identity-java-default-azure-credential-troubleshoot"} 2024-02-13 06:54:39.705 [ForkJoinPool.commonPool-worker-7] ERROR c.azure.core.http.policy.RetryPolicy - {"az.sdk.message":"Retry attempts have been exhausted.","exception":"EnvironmentCredential authentication unavailable. Environment variables are not fully configured.To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/java/identity/environmentcredential/troubleshoot\r\nWorkloadIdentityCredential authentication unavailable. The workload options are not fully configured. See the troubleshooting guide for more information. https://aka.ms/azsdk/java/identity/workloadidentitycredential/troubleshoot\r\nManaged Identity authentication is not available.\r\nAzureDeveloperCliCredential authentication unavailable. Azure Developer CLI not installed.To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/java/identity/azdevclicredential/troubleshoot\r\nSharedTokenCacheCredential authentication unavailable. No accounts were found in the cache.\r\nIntelliJ Authentication not available. Please log in with Azure Tools for IntelliJ plugin in the IDE.\r\nAzureCliCredential authentication unavailable. Azure CLI not installed.To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azsdk/java/identity/azclicredential/troubleshoot\r\nUnable to execute PowerShell. Please make sure that it is installed in your systemTo mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azure-identity-java-default-azure-credential-troubleshoot","tryCount":3}

[arkadius]

Hi, is this issue still valid? I see in another discussion (#5538) that you have some progress in this area

[sridharanss]

Thank you for your response.

I was able to progress by using client secret, but just wondering why it is considering "EnvironmentCredentials" as "WorkloadIdentityCredential" and trying to authenticating using "WorkloadIdentityCredential" flow.

[arkadius]

We use the default Azure's authentication chain (https://github.com/Azure/azure-sdk-for-java/wiki/Azure-Identity-Examples#authenticating-with-defaultazurecredential) enriched only with custom authentication using properties that I send. TBH it is a kind of magic for me, probable Azure had some bug. I could try to bump azure-identity library that is used under the hood. We currently use 1.9.0 and 1.11.2 is available. Here is the changelog: https://github.com/Azure/azure-sdk-for-net/blob/main/sdk/identity/Azure.Identity/CHANGELOG.md Can you see something that could match your case there?