Hello Community,
I'm facing an unexpected situation while working with Kafka ACLs. Despite
having provided only read access permissions to the user "rbactest22sep," I've
noticed that this user is still able to add ACLs for Kafka topics. Here are the
details:
User: rbactest22sep
Current Permissions: Principal=User:rbactest22sep, Host=*, Operation=READ,
PermissionType=ALLOW
I attempted to add an ACL for topic creation using the following command:
kafka-acls.sh --bootstrap-server broker1:9095,broker2:9095,broker3:9095
--command-config /bitnami/kafka/config/rbacuser.properties --add
--allow-principal User:rbactest22sep --operation create --topic '*'
Adding ACLs for resource `ResourcePattern(resourceType=TOPIC, name=*,
patternType=LITERAL)`:
(principal=User:rbactest22sep, host=*, operation=CREATE,
permissionType=ALLOW)
Where content of /bitnami/kafka/config/rbacuser.properties as below:
security.protocol=SASL_SSL
sasl.mechanism=SCRAM-SHA-256
sasl.jaas.config=org.apache.kafka.common.security.scram.ScramLoginModule
required username="rbactest22sep" password="mypass";
ssl.truststore.type=JKS
ssl.truststore.location=/opt/bitnami/kafka/config/certs/kafka.truststore.jks
# Uncomment this line if your client truststore is password protected
ssl.truststore.password=trustpass.com
The command executed successfully, and the user gained the ability to create
topics.
I'm puzzled by this behavior and would appreciate your insights into why this
might be happening. Could this be related to Kafka configuration, ACL
inheritance, or a misunderstanding of the permissions model?
Also, I'm under the assumption that we need to explicitly give the following
permissions to a user to manage ACLs:
DESCRIBE_ACLS (29) Describe Cluster
CREATE_ACLS (30) Alter Cluster
DELETE_ACLS (31) Alter Cluster
Any guidance on how to troubleshoot and resolve this issue, as well as any
clarifications on the necessary permissions for managing ACLs, would be greatly
appreciated.
Thank you for your help!
--------------------------------------
Thanks,
Bharath Achar
IT Infrastructure and DevOps Engineer
Intel India pvt ltd, Bangalore.
Cell :: + 91 7259670196
[email protected]<mailto:[email protected]>
--------------------------------------
