Common Migration Issues

Resolve common issues encountered during a ZooKeeper to KRaft migration using the following steps.

Issue: Kafka cluster ID mismatch between Kafka or KRaft CR status and the cluster

After a configuration change, the cluster ID shown in the Kafka and KRaft CR status: and in the CR spec: don’t match.

Workaround:

The first recommended workaround is an automatic fix with an upgrade to CFK a release 2.11.0, 2.10.1, or 2.9.5.

If the upgrade isn’t possible, take the following steps to patch the status objects of KRaft and Kafka.

1. Verify if you have mismatching cluster IDs.

   1. Fetch the clusterID value from the Kafka status:

      kubectl get kafka <kafka-cr-name> -n <namespace> -oyaml | grep "clusterID"
      

   2. Fetch the correct cluster ID from the Kafka pod. For example:

      1. Exec into one of the Kafka pods.

      2. Fetch the cluster ID from meta.properties:

         cat /mnt/data/data0/logs/meta.properties
         

      3. Retrieve the cluster.id value from the output:

         #Wed Mar 05 12:55:23 GMT 2025
         node.id=1
         directory.id=pMP24m7YPMhy_F0e9ag_Wg
         version=1
         cluster.id=f66a6843-54f1-4af8-b3Q
         

2. If the cluster ID from the Kafka status is different from the cluster ID in meta.properties, use the correct cluster ID in meta.properties to set the cluster ID in the status.

   1. Apply the block reconcile annotation:

      kubectl annotate kraftcontroller <kraftcontroller-cr-name> \
        -n <namespace> platform.confluent.io/block-reconcile=true
      

      kubectl annotate kafka <kafka-cr-name> \
        -n <namespace> platform.confluent.io/block-reconcile=true
      

   2. Patch the status field:

      kubectl patch kraftcontroller <kraftcontroller-cr-name> \
        -n <namespace> --type=merge --subresource status \
        --patch 'status: {clusterID: <Correct-cluster-id-here>}'
      

      kubectl patch kafka  <kafka-cr-name> \
        -n <namespace> --type=merge --subresource status \
        --patch 'status: {clusterID: <Correct-cluster-id-here>}'
      

   3. Remove the block reconcile:

      kubectl annotate kraftcontroller <kraftcontroller-cr-name>  \
        -n <namespace> platform.confluent.io/block-reconcile-
      

      kubectl annotate kafka  <kafka-cr-name> \
        -n <namespace> platform.confluent.io/block-reconcile-
      

Fixed Versions: Upgrade to CFK 2.11.0, 2.10.1, or 2.9.5, which fixes this issue.

Issue: Request CREATE_ACLS is not authorized errors after KRaft migration

After migrating to KRaft, principals with the SystemAdmin role might see Request CREATE_ACLS is not authorized errors even when they have valid RBAC role bindings.

This happens when you set confluent.metadata.* properties under spec.configOverrides.server on the KRaftController CR. These overrides overwrite the auto-generated Metadata Service (MDS) configuration and break authorization after migration.

Solution:

Configure the KRaftController’s connection to MDS only through the dependencies.mdsKafkaCluster block. Remove any confluent.metadata.* properties from spec.configOverrides.server on the KRaftController CR.

See also

• For ZooKeeper to KRaft migration troubleshooting, see Troubleshoot ZooKeeper to KRaft Migration Issues.

• For migrating from Confluent Operator or from on-premises deployments, see Migrate to Confluent for Kubernetes and Migrate From an Existing Confluent Platform Deployment to Confluent for Kubernetes.