Chapter 107. AclRule schema reference
Chapter 107. AclRule schema reference Used in: KafkaUserAuthorizationSimple Full list of AclRule schema properties Configures access control rules for a KafkaUser when brokers are using the AclAuthorizer . Example KafkaUser configuration with authorization apiVersion: kafka.strimzi.io/v1beta2 kind: KafkaUser metadata: name: my-user labels: strimzi.io/cluster: my-cluster spec: # ... authorization: type: simple acls: - resource: type: topic name: my-topic patternType: literal operations: - Read - Describe - resource: type: group name: my-group patternType: prefix operations: - Read 107.1. resource Use the resource property to specify the resource that the rule applies to. Simple authorization supports four resource types, which are specified in the type property: Topics ( topic ) Consumer Groups ( group ) Clusters ( cluster ) Transactional IDs ( transactionalId ) For Topic, Group, and Transactional ID resources you can specify the name of the resource the rule applies to in the name property. Cluster type resources have no name. A name is specified as a literal or a prefix using the patternType property. Literal names are taken exactly as they are specified in the name field. Prefix names use the name value as a prefix and then apply the rule to all resources with names starting with that value. When patternType is set as literal , you can set the name to * to indicate that the rule applies to all resources. Example ACL rule that allows the user to read messages from all topics acls: - resource: type: topic name: "*" patternType: literal operations: - Read 107.2. type The type of rule, which is to allow or deny (not currently supported) an operations. The type field is optional. If type is unspecified, the ACL rule is treated as an allow rule. 107.3. operations Specify a list of operations for the rule to allow or deny. The following operations are supported: Read Write Delete Alter Describe All IdempotentWrite ClusterAction Create AlterConfigs DescribeConfigs Only certain operations work with each resource. For more details about AclAuthorizer , ACLs and supported combinations of resources and operations, see Authorization and ACLs . 107.4. host Use the host property to specify a remote host from which the rule is allowed or denied. Use an asterisk ( * ) to allow or deny the operation from all hosts. The host field is optional. If host is unspecified, the * value is used by default. 107.5. AclRule schema properties Property Description host The host from which the action described in the ACL rule is allowed or denied. string operation The operation property has been deprecated, and should now be configured using spec.authorization.acls[*].operations . Operation which will be allowed or denied. Supported operations are: Read, Write, Create, Delete, Alter, Describe, ClusterAction, AlterConfigs, DescribeConfigs, IdempotentWrite and All. string (one of [Read, Write, Delete, Alter, Describe, All, IdempotentWrite, ClusterAction, Create, AlterConfigs, DescribeConfigs]) operations List of operations which will be allowed or denied. Supported operations are: Read, Write, Create, Delete, Alter, Describe, ClusterAction, AlterConfigs, DescribeConfigs, IdempotentWrite and All. string (one or more of [Read, Write, Delete, Alter, Describe, All, IdempotentWrite, ClusterAction, Create, AlterConfigs, DescribeConfigs]) array resource Indicates the resource for which given ACL rule applies. The type depends on the value of the resource.type property within the given object, which must be one of [topic, group, cluster, transactionalId]. AclRuleTopicResource , AclRuleGroupResource , AclRuleClusterResource , AclRuleTransactionalIdResource type The type of the rule. Currently the only supported type is allow . ACL rules with type allow are used to allow user to execute the specified operations. Default value is allow . string (one of [allow, deny])
apiVersion: kafka.strimzi.io/v1beta2 kind: KafkaUser metadata: name: my-user labels: strimzi.io/cluster: my-cluster spec: # authorization: type: simple acls: - resource: type: topic name: my-topic patternType: literal operations: - Read - Describe - resource: type: group name: my-group patternType: prefix operations: - Read acls: - resource: type: topic name: "*" patternType: literal operations: - Read