Discover Identifiers for Clusters¶
Important
This feature is available as a preview feature. A preview feature is a component of Confluent Platform that is being introduced to gain early feedback from developers. This feature can be used for evaluation and non-production testing purposes or to provide feedback to Confluent.
When you assign user roles by using the Confluent CLI, you need the identifiers for the clusters in your Confluent Platform deployment.
For example, the following command assigns the DeveloperRead
role on a
topic in the Kafka cluster identified by <kafka-id>.
# Grant read-only access for a user to a topic.
confluent iam rolebinding create \
--principal User:<user-name> \
--role DeveloperRead \
--resource Topic:<topic-name> \
--kafka-cluster-id <kafka-id>
When creating role bindings for Schema Registry, KSQL, and Connect you must
provide two identifiers: the Kafka cluster identifier and an additional component
cluster identifier. For example, the following command assigns the DeveloperWrite
role on a topic in a Schema Registry cluster:
# Grant write access for a user to a topic in Schema Registry.
confluent iam rolebinding create \
--principal User:<user-name> \
--role DeveloperWrite \
--resource Topic:<topic-name> \
--kafka-cluster-id <kafka-id>
--schema-registry-cluster-id <schema-registry-cluster-id>
There are different endpoints to query for cluster identifiers in your Confluent Platform deployment. The following table summarizes how you get cluster IDs.
Service | How to get the cluster ID | CLI option for cluster ID | Use to grant access to |
---|---|---|---|
Kafka | query ZooKeeper | kafka-cluster-id |
Topics and consumer groups |
Schema Registry | query /permissions endpoint | schema-registry-cluster-id |
Schemas |
Connect | query /permissions endpoint | connect-cluster-id |
Connectors |
KSQL | query /info endpoint | ksql-cluster-id |
KSQL streams and tables |
Get the Kafka cluster ID¶
Use the zookeeper-shell
command to get the Kafka cluster ID.
$CONFLUENT_HOME/bin/zookeeper-shell localhost:2181 get /cluster/id
Your output should resemble:
Connecting to localhost:2181
WATCHER::
WatchedEvent state:SyncConnected type:None path:null
{"version":"1","id":"xrx5mUMWTvaWbk157wFDKw"}
cZxid = 0x17
...
In this example, the Kafka cluster ID is xrx5mUMWTvaWbk157wFDKw
.
Use the Kafka cluster ID with the kafka-cluster-id
option when you assign
a role to a user. The following Confluent CLI command shows how to grant the
DeveloperRead
role on this cluster.
# Grant read-only access for a user to a topic.
confluent iam rolebinding create \
--principal User:<user-name> \
--role DeveloperRead \
--resource Topic:<topic-name> \
--kafka-cluster-id xrx5mUMWTvaWbk157wFDKw
Get the KSQL cluster ID¶
Get the KSQL cluster ID from the ksql.service.id
setting in the
ksql-server.properties
file.
Also, you can query the /info
endpoint on the KSQL Server.
curl -u <user>:<password> "http://<ksql-server-hostname>:8088/info" | jq '.'
Your output should resemble:
{
"KsqlServerInfo": {
"version": "5.3.0",
"kafkaClusterId": "xrx5mUMWTvaWbk157wFDKw",
"ksqlServiceId": "default_"
}
}
In this example, the KSQL service ID is default_
.
Use the KSQL service ID with the kafka-cluster-id
option when you assign
a role to a user. The following Confluent CLI command shows how to grant the
ResourceOwner
role on this cluster.
confluent iam rolebinding create \
--principal User:<user-name> \
--role ResourceOwner \
--kafka-cluster-id xrx5mUMWTvaWbk157wFDKw \
--ksql-cluster-id default_ \
--resource KsqlCluster:ksql-cluster
Get the Schema Registry cluster ID¶
When RBAC is enabled, query the /permissions
endpoint on the Schema Registry server.
curl -u <sr-user>:<sr-password> http://<sr-hostname>:8081/permissions
Your output should resemble:
{"permissions":{},"scope":{"path":[],"clusters":{"kafka-cluster":"xrx5mUMWTvaWbk157wFDKw","schema-registry-cluster":"schema-registry"}}}
In this example, the Schema Registry cluster ID is schema-registry
.
The following Confluent CLI command shows how to grant the
DeveloperRead
role on a Schema Registry cluster that has the default cluster ID.
confluent iam rolebinding create \
--principal User:<user-name>
--role DeveloperRead
--schema-registry-cluster-id schema-registry
--kafka-cluster-id xrx5mUMWTvaWbk157wFDKw
The Schema Registry cluster ID is the schema.registry.group.id
configuration setting
in the schema-registry.properties
file. The default value is schema-registry
.
Assign the ID by using the schema-registry-cluster-id
option in the
confluent iam rolebinding create
command.
Use the cluster ID of the Kafka cluster that stores schemas. This cluster is
configured with the kafkastore.boostrap.servers
property. If the
kafkastore.boostrap.servers
property isn’t set, use the cluster that has
ZooKeeper configured with the kafkastore.connection.url
property. For more
information, see Schema Registry Single Datacenter Setup.
Get the Connect cluster ID¶
When RBAC is enabled, query the /permissions
endpoint on the Connect
server.
curl -u <connect-user>:<connect-password> http://<connect-hostname>:8083/permissions
Your output should resemble:
{"permissions":{},"scope":{"path":[],"clusters":{"kafka-cluster":"xrx5mUMWTvaWbk157wFDKw","connect-cluster":"ydfk"}}}
In this example, the Connect cluster ID is ydfk
.
The following Confluent CLI command shows how to grant the
DeveloperRead
role on the ydfk
Connect cluster.
confluent iam rolebinding create \
--principal User:<user-name> \
--role DeveloperRead \
--connect-cluster-id ydfk
--kafka-cluster-id xrx5mUMWTvaWbk157wFDKw
The Connect cluster ID is the group.id
setting from your worker
configuration file. Assign the ID by using the connect-cluster-id
option in the confluent iam rolebinding create
command.
Use the cluster ID of the Kafka cluster that stores connector configuration,
status, and offset information. This cluster is configured in the Connect
worker file that has the bootstrap.servers
property. For more information,
see Distributed Worker Configuration.
Note
If running in standalone mode, the connect-cluster-id
is STANDALONE
,
in all capital letters.