Page History

...

$ kafka-sentry -arg -r test -g test-group

Authorizable Resources

Authorizable resources are resources or entities in a Kafka cluster that require special permissions for a user to be able to perform some action on it. As of now Kafka has three authorizable resources.

• Cluster, this controls who can perform cluster level operations, like, creating a topic, deleting a topic, etc. This can only have one value kafka-cluster, as one Kafka cluster can not have more than one Cluster resources.
• Topic, this controls who can perform topic level operations, like, producing to topic, consuming from topic, etc. Its value must match exactly with the topic name in Kafka cluster.
• Consumergroup, this controls who can perfrom consumergroup level operations, like, join an existing consumergroup, querying offset for a partition, describe a consumergroup, etc. Its value must exactly match group.id of a consumer group.
• Host, this controls from where specific operations can be performed. It can be though of as a way to achieve IP filtering in Kafka. This can have a wildcard, *, as a value, which represents all hosts.

Authorized Actions

Each resource can have multiple actions that users can perform on them. Following operations are supported in Kafka, however not all actions are valid on all resources.

• ALL, this is a wildcard action, and represents all possible actions on a resource.
• read
• write
• create
• delete
• alter
• describe
• clusteraction

Authorizing Privileges

Privileges define what actions are allowed on a resource. A privilege is represented as a string in Sentry. Following are the criterias of a valid privilege.

• Can have at most one Host resource. If no Host resource is specified in a privilege string, Host=* is assumed.
• Must have exactly one non Host resource.
• Must have exactly one action specified at the end of privilege string.

Valid privilege strings

• Host=*->Topic=test->action=ALL
• Topic=test->action=ALL

Invalid privilege strings

• Host=*->Host=127.0.0.1->Topic=test->action=ALL, has multiple Host resources
• Cluster=kafka-cluster->Topic=test->action=ALL, has multiple non Host resources
• Topic=test->action=ALL->action=read, has multiple actions
• Cluster=cluster1->Topic=test->action=ALL, should only have kafka-cluster as Cluster value
• action=ALL->Topic=test, action must be specified at the end of privilege string

Granting privileges to a role

...