anchor.diff:  * Create
   * AlterConfigs
   * DescribeConfigs
  -+
  -NOTE: Not every operation can be combined with every resource.
  -
  -`host`:: Specifies a remote host from which is the rule allowed or denied.
  -Use `\*` to allow or deny the operation from all hosts.
  -The `host` field is optional and when not specified, the value `*` will be used as default.
  -
  -`resource`:: Specifies the resource for which the rule applies.
  -Simple Authorization supports four different resource types:
  -+
  -* Topics
  -* Consumer Groups
  -* Clusters
  -* Transactional IDs
  -+
  -The resource type can be specified in the `type` property.
  -Use `topic` for Topics, `group` for Consumer Groups, `cluster` for clusters, and `transactionalId` for Transactional IDs.
  -+
  -Additionally, Topic, Group, and Transactional ID resources allow you to specify the name of the resource for which the rule applies.
  -The name can be specified in the `name` property.
  -The name can be either specified as literal or as a prefix.
  -To specify the name as literal, set the `patternType` property to the value `literal`.
  -Literal names will be taken exactly as they are specified in the `name` field.
  -To specify the name as a prefix, set the `patternType` property to the value `prefix`.
  -Prefix type names will use the value from the `name` only a prefix and will apply the rule to all resources with names starting with the value.
  -The cluster type resources have no name.
  -
  -For more details about `SimpleAclAuthorizer`, its ACL rules and the allowed combinations of resources and operations, see link:http://kafka.apache.org/documentation/#security_authz[Authorization and ACLs^].
  +--
  ++
  +Only certain operations work with each resource.
  ++
  +For more details about `SimpleAclAuthorizer`, ACLs and supported combinations of resources and operations, see link:http://kafka.apache.org/documentation/#security_authz[Authorization and ACLs^].
  +
  +`host`:: The `host` property specifies a remote host from which the rule is allowed or denied.
  ++
  +Use an asterisk (`\*`) to allow or deny the operation from all hosts.
  +The `host` field is optional. If `host` is unspecified, the `*` value is used by default.
   
   For more information about the `AclRule` object, see xref:type-AclRule-reference[`AclRule` schema reference].
   
  
positive.code: == Authorization
  
  Authorization is configured using the `authorization` property in `KafkaUser.spec`.
  The authorization type enabled for this user will be specified using the `type` field.
  Currently, the only supported authorization type is the Simple authorization.
  
  When no authorization is specified, the User Operator will not provision any access rights for the user.
  
  === Simple Authorization
  
  To use Simple Authorization, set the `type` property to `simple`.
  Simple authorization uses the `SimpleAclAuthorizer` plugin.
  `SimpleAclAuthorizer` is the default authorization plugin which is part of Apache Kafka.
  Simple Authorization allows you to specify list of ACL rules in the `acls` property.
  
  The `acls` property should contain a list of `AclRule` objects.
  `AclRule` specifies the access rights whcih will be granted to the user.
  The `AclRule` object contains following properties:
  
  `type`::
  Specifies the type of the ACL rule.
  The type can be either `allow` or `deny`.
  The `type` field is optional and when not specified, the ACL rule will be treated as `allow` rule.
  
  `operation`:: Specifies the operation which will be allowed or denied.
  Following operations are supported:
  +
  * Read
  * Write
  * Delete
  
negative.code:         operation: Read
  ----
  
  === Super user access to Kafka brokers
  
  If a user is added to a list of super users in a Kafka broker configuration, the user is allowed unlimited access to the cluster regardless of any authorization constraints defined in ACLs.
  
  For more information on configuring super users, see xref:assembly-kafka-authentication-and-authorization-deployment-configuration-kafka[authentication and authorization] of Kafka brokers.
  
  == Additional resources
  
  * For more information about the `KafkaUser` object, see xref:type-KafkaUser-reference[`KafkaUser` schema reference].
  