Christopher L. Shannon created KAFKA-12916:
----------------------------------------------
Summary: Add new AUTO_CREATE ACL for auto topic creation
Key: KAFKA-12916
URL: https://issues.apache.org/jira/browse/KAFKA-12916
Project: Kafka
Issue Type: Improvement
Components: core
Affects Versions: 2.8.0
Reporter: Christopher L. Shannon
Currently Kafka supports creation new topics through a CreateTopicsRequest or
by auto creation during a topic MetadataRequest (if enabled on the cluster).
Kafka supports ACLs for creation but currently the CREATE acl is used to grant
access to both types of topic creations. This is problematic because it may be
desirable to allow a user to auto create topics but not to be able to submit a
create topic request. The difference is that auto creation will use the cluster
defaults for the new topic settings but a topic creation request would allow
the user to have control to configure all of the different topic settings which
may not be what was intended.
The proposed change is to create a new ACL operation called AUTO_CREATE that
will be checked to see if a user is authorized to auto create topics instead of
using the existing CREATE operation. This new operation will apply both cluster
wide (allowed to create a topic of any name) or topic wide (will validate by
topic name or prefix). The CREATE operation will still be used for the existing
CreateTopicsRequest command. Going forward this will allow an administrator to
grant permission to auto create topics with cluster defaults but not to
explicitly create topics.
This change will be fully backwards compatible and will not break existing
users. The AclAuthorizer class will be updated so that any user that is granted
the CREATE operation will also imply AUTO_CREATE. This means that any existing
configurations that grant CREATE will still work because when the new check is
done for AUTO_CREATE the CREATE operation will be implied and return true.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
