Get Started With RBAC and Kafka Connect

RBAC uses roles and role mappings to provide different levels of access for a principal (user or service principal) to authenticate with Connect and Kafka.

See also

To get started, try the automated RBAC example that showcases the RBAC functionality in Confluent Platform.

Connect Role Mappings

The table below shows the permitted Connect operations for each RBAC role.

Roles [1]

Register Connect Cluster

Create Connector

Read Connector Configuration

Read Status

Pause/ Restart Connector

Scale Connector

Configure Connector

Manage Access

Delete

SystemAdmin

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

UserAdmin

No

No

No

No

No

No

No

Yes

No

ClusterAdmin

Yes

Yes

Yes

Yes

[2]

[2]

No

Yes

Yes

Operator

No

No

No

Yes

Yes

Yes

Yes

No

No

SecurityAdmin

No

No

No

No

No

No

No

No

No

ResourceOwner

No

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

DeveloperRead

No

No

Yes

Yes

No

No

No

No

No

DeveloperWrite

No

No

No

Yes

No

No

Yes

No

No

DeveloperManage

No

Yes

No

Yes

Yes

Yes

No

No

No

Table Notes:

[1] Review the following additional information about roles:

  • Each role has either a Cluster-level scope or a Resource-level scope. Yes means that the operation is permitted, but restricted to the role scope. See predefined roles for more information about role scoping.

    • Cluster-level roles: SystemAdmin, UserAdmin, ClusterAdmin, Operator, SecurityAdmin

    • Resource-level roles: ResourceOwner, DeveloperRead, DeveloperWrite, DeveloperManage

  • Read Connector Configuration: Yes means that read-access to both the connector and task configurations is allowed.

  • Read Status: Yes means that read-access is allowed for the task status.

  • Scale Connector: Yes means that the role can change the number of tasks.

  • Configure Connector: Yes means that the role can change any of the connector configuration parameters, except for tasks.max.

  • Delete: Yes means that the role can stop and delete connectors and the Connect cluster.

[2] Yes; but typically this is delegated to the Operator role.

Connect RBAC workflow

The following is a high-level workflow for configuring RBAC for a Connect cluster and connectors.

  1. Verify that you have a role that can complete the required operations. See confluent iam for information about using the CLI to list and describe roles and permissions for your environment.

  2. Configure RBAC for a Connect cluster.

  3. Configure RBAC for a Connect worker.

  4. Configure RBAC for a connector.