<a id="co-troubleshoot-migration"></a>

# Common Migration Issues

Resolve common issues encountered during a ZooKeeper to KRaft migration using
the following steps.

## Issue: Kafka cluster ID mismatch between Kafka or KRaft CR status and the cluster

After a configuration change, the cluster ID shown in the Kafka and KRaft CR
`status:` and in the CR `spec:` don’t match.

**Workaround:**

The first recommended workaround is an automatic fix with an upgrade to CFK a
release 2.11.0, 2.10.1, or 2.9.5.

If the upgrade isn’t possible, take the following steps to patch the
status objects of KRaft and Kafka.

1. Verify if you have mismatching cluster IDs.
   1. Fetch the `clusterID` value from the Kafka status:
      ```bash
      kubectl get kafka <kafka-cr-name> -n <namespace> -oyaml | grep "clusterID"
      ```
   2. Fetch the correct cluster ID from the Kafka pod. For example:
      1. Exec into one of the Kafka pods.
      2. Fetch the cluster ID from `meta.properties`:
         ```bash
         cat /mnt/data/data0/logs/meta.properties
         ```
      3. Retrieve the `cluster.id` value from the output:
         ```text
         #Wed Mar 05 12:55:23 GMT 2025
         node.id=1
         directory.id=pMP24m7YPMhy_F0e9ag_Wg
         version=1
         cluster.id=f66a6843-54f1-4af8-b3Q
         ```
2. If the cluster ID from the Kafka status is different from the cluster ID in
   `meta.properties`, use the correct cluster ID in `meta.properties` to
   set the cluster ID in the status.
   1. Apply the block reconcile annotation:
      ```bash
      kubectl annotate kraftcontroller <kraftcontroller-cr-name> \
        -n <namespace> platform.confluent.io/block-reconcile=true
      ```

      ```bash
      kubectl annotate kafka <kafka-cr-name> \
        -n <namespace> platform.confluent.io/block-reconcile=true
      ```
   2. Patch the status field:
      ```bash
      kubectl patch kraftcontroller <kraftcontroller-cr-name> \
        -n <namespace> --type=merge --subresource status \
        --patch 'status: {clusterID: <Correct-cluster-id-here>}'
      ```

      ```bash
      kubectl patch kafka  <kafka-cr-name> \
        -n <namespace> --type=merge --subresource status \
        --patch 'status: {clusterID: <Correct-cluster-id-here>}'
      ```
   3. Remove the block reconcile:
      ```bash
      kubectl annotate kraftcontroller <kraftcontroller-cr-name>  \
        -n <namespace> platform.confluent.io/block-reconcile-
      ```

      ```bash
      kubectl annotate kafka  <kafka-cr-name> \
        -n <namespace> platform.confluent.io/block-reconcile-
      ```

**Fixed Versions:** Upgrade to CFK 2.11.0, 2.10.1, or 2.9.5, which fixes
this issue.

<a id="co-kraft-mds-config-override"></a>

## Issue: `Request CREATE_ACLS is not authorized` errors after KRaft migration

After migrating to KRaft, principals with the `SystemAdmin` role might see
`Request CREATE_ACLS is not authorized` errors even when they have valid
RBAC role bindings.

This happens when you set `confluent.metadata.*` properties under
`spec.configOverrides.server` on the KRaftController CR. These overrides
overwrite the auto-generated Metadata Service (MDS) configuration and break authorization
after migration.

**Solution:**

Configure the KRaftController’s connection to MDS only through the
`dependencies.mdsKafkaCluster` block. Remove any `confluent.metadata.*`
properties from `spec.configOverrides.server` on the KRaftController CR.

#### SEE ALSO
- For ZooKeeper to KRaft migration troubleshooting, see [Troubleshoot ZooKeeper to KRaft Migration Issues](co-migrate-kraft-troubleshooting.md#co-migrate-kraft-troubleshoot).
- For migrating from Confluent Operator or from on-premises deployments, see
  [Migrate to Confluent for Kubernetes](co-migration.md#co-migration) and [Migrate From an Existing Confluent Platform Deployment to Confluent for Kubernetes](co-migrate-onprem.md#co-migrate-onprem).