4.3

Kafka ACLs

When the Kafka cluster is configured with an authorizer which enforces ACLs, Lenses might need a set of permissions to function correctly. If the default Kafka authorizer (kafka.security.auth.SimpleAclAuthorizer) is used, Lenses can be used to manage ACLs.

The common practice is to give to the Lenses Kafka client superuser status, or, alternatively, the complete list of available operations for all resources. The fine grained permission model of Lenses can then be used to restrict the access level per user.

kafka-acls \
    --bootstrap-server [broker.url:9092] --command-config [client.properties] \
    --add \
    --allow-principal [User:Lenses] \
    --allow-host [lenses.host] \
    --operation All \
    --topic * \
    --group * \
    --delegation-token * \
    --cluster

Minimal Permissions 

Topics 

Lenses needs permission to manage and access its own internal Kafka topics :

  • __topology
  • __topology__metrics
  • _kafka_lenses_metrics
kafka-acls \
    --bootstrap-server [broker.url:9092] --command-config [client.properties] \
    --add \
    --allow-principal [User:Lenses] \
    --allow-host [lenses.host] \
    --operation All \
    --topic [topic]

It also needs read and describe permissions for the consumer offsets and Kafka Connect topics —if enabled:

  • __consumer_offsets
  • connect-configs
  • connect-offsets
  • connect-status
kafka-acls \
    --bootstrap-server [broker.url:9092] --command-config [client.properties] \
    --add \
    --allow-principal [User:Lenses] \
    --allow-host [lenses.host] \
    --operation Describe \
    --operation DescribeConfigs \
    --operation Read \
    --topic [topic]

This same set of permissions is required for any topic that Lenses must have read access.

kafka-acls \
    --bootstrap-server [broker.url:9092] --command-config [client.properties] \
    --add \
    --allow-principal [User:Lenses] \
    --allow-host [lenses.host] \
    --operation Describe \
    --operation DescribeConfigs \
    --operation Read \
    --topic *

Additional permissions are needed to produce to topics, or manage them.

Consumer Groups 

To take advantage of the Consumer Groups monitoring capabilities, permissions to at least read and describe consumer groups is required.

kafka-acls \
    --bootstrap-server [broker.url:9092] --command-config [client.properties] \
    --add \
    --allow-principal [User:Lenses] \
    --allow-host [lenses.host] \
    --operation Describe \
    --operation Read \
    --group *

Additional permissions are needed to manage groups.

ACLs 

To manage ACLs, permission to the cluster is required:

kafka-acls \
    --bootstrap-server [broker.url:9092] --command-config [client.properties] \
    --add \
    --allow-principal [User:Lenses] \
    --allow-host [lenses.host] \
    --operation Describe \
    --operation DescribeConfigs \
    --operation Alter \
    --cluster