This page describes the ACLs that need to be configured on your Kafka Cluster if ACLs are enabled, for Lenses to function.
When your Kafka cluster is configured with an authorizer which enforces ACLs, Lenses will need a set of permissions to function correctly.
Common practice is to give Lenses superuser status or the complete list of available operations for all resources. The fine-grained permission model of Lenses can then be used to restrict the access level per user.
The agent needs permission to manage and access their own internal Kafka topics:
__topology
__topology__metrics
It also needs to read and describe permissions for the consumer offsets and Kafka Connect topics —if enabled:
__consumer_offsets
connect-configs
connect-offsets
This same set of permissions is required for any topic that the agent must have read access.
Additional permissions are needed to produce topics or manage them.
Permission to at least read and describe consumer groups is required to take advantage of the Consumer Groups' monitoring capabilities.
Additional permissions are needed to manage groups.
To manage ACLs, permission to the cluster is required:
kafka-acls \
--bootstrap-server [broker.url:9092] --command-config [client.properties] \
--add \
--allow-principal [User:Lenses] \
--allow-host [lenses.host] \
--operation All \
--topic * \
--group * \
--delegation-token * \
--clusterconnect-statuskafka-acls \
--bootstrap-server [broker.url:9092] --command-config [client.properties] \
--add \
--allow-principal [User:Lenses] \
--allow-host [lenses.host] \
--operation All \
--topic [topic]kafka-acls \
--bootstrap-server [broker.url:9092] --command-config [client.properties] \
--add \
--allow-principal [User:Lenses] \
--allow-host [lenses.host] \
--operation Describe \
--operation DescribeConfigs \
--operation Read \
--topic [topic]kafka-acls \
--bootstrap-server [broker.url:9092] --command-config [client.properties] \
--add \
--allow-principal [User:Lenses] \
--allow-host [lenses.host] \
--operation Describe \
--operation DescribeConfigs \
--operation Read \
--topic *kafka-acls \
--bootstrap-server [broker.url:9092] --command-config [client.properties] \
--add \
--allow-principal [User:Lenses] \
--allow-host [lenses.host] \
--operation Describe \
--operation Read \
--group *kafka-acls \
--bootstrap-server [broker.url:9092] --command-config [client.properties] \
--add \
--allow-principal [User:Lenses] \
--allow-host [lenses.host] \
--operation Describe \
--operation DescribeConfigs \
--operation Alter \
--cluster