Supported Operations and Schema Registry Resources¶
The Schema Registry security plugin provides authorization for operations on schemas for subjects, which correspond to Kafka topics.
The supported operations and corresponding Schema Registry URIs are listed here. These apply to both role-based access control (RBAC) and ACL authorization.
You can use both RBAC and ACLs together or independently. Both methods of access control have their strengths and use cases. To learn more, see RBAC and ACLs in the RBAC overview.
|SCHEMA REGISTRY OPERATION||RESOURCE|
For more information on these operations, see the Schema Registry API.
Example ACL Setups¶
Any “one size fits all” recommendation for Schema Registry ACL configurations will not make sense, but here are a few prosaic examples that may provide a starting point as you plan your deployment.
- One permissive setup might be to provide all READ-ACLs to all clients, including ANONYMOUS. If you adhere to the need-to-know principle more closely, you may want to limit READ operations.
- An autonomous team would need all the SUBJECT ACLs: READ, WRITE, DELETE, COMPATIBILTY_WRITE and COMPATIBILTY_READ. The exact configuration depends on the autonomy of the team and the desired level of control over the Schema Registry. A CD/CI system would get the same ACLs for all relevant subjects.
- An admin team may additionally set up the
To learn more about defining ACLs, see Schema Registry ACL Authorizer.