Apache Kafka comes with a pluggable authorizer known as Kafka Authorization Command Line (ACL) Interface, which is used for defining users and allowing or denying them to access its various APIs. The default behavior is that only a superuser is allowed to access all the resources of the Kafka cluster, and no other user can access those resources if no proper ACL is defined for those users. The general format in which Kafka ACL is defined is as follows:
Principal P is Allowed OR Denied Operation O From Host H On Resource R.
The terms used in this definition are as follows:
- Principal is the user who can access Kafka
- Operation is read, write, describe, delete, and so on
- Host is an IP of the Kafka client that is trying to connect to the broker
- Resource refers to Kafka resources such as topic, group, cluster
Let's discuss a few common ACL...
