Configuring Control Center to work with Kafka ACLs¶
Before attempting to create and use ACLs, you should familiarize yourself with ACL concepts. Doing so can help you avoid common pitfalls that can occur when creating and using ACLs to manage access to components and cluster data.
Standard Apache Kafka® authorization and encryption options are available for control center and interceptors.
PRINCIPAL if you have already defined the JAAS properties or
user certificates. Also, you must create the Kafka ACLs before starting Control Center.
You must then configure Control Center to authenticate to Kafka as the principal
that is specified for the ACL.
You can use this script to create the ACLs that are required by Control Center to operate on an authorized cluster. You must run this script before you start Control Center:
export PRINCIPAL=User:username export CONTROL_CENTER_OPTS="-Djava.security.auth.login.config=<path-to-kafka-jaas.conf>" bin/control-center-set-acls config/control-center.properties
The principal specified here is the Kafka user, the same as specified in Kafka Broker.
For each Kafka topic that Confluent Control Center creates, ACLs are created to grant the specified principal the following privileges:
The following ACLs are created to grant the specified principal privileges for the consumer group related to the Confluent Control Center Streams application:
ACLs granting the following privileges are also created for the cluster:
You must export a Control Center JAAS config before starting Control Center.
export CONTROL_CENTER_OPTS='-Djava.security.auth.login.config=<path-to-c3-jaas.conf>' bin/control-center-start config/control-center.properties