Configuring Control Center to work with Kafka ACLs
Before attempting to create and use ACLs, you should familiarize yourself with ACL concepts.
Doing so can help you avoid common pitfalls that can occur when creating and using
ACLs to manage access to components and cluster data.
Standard Apache Kafka® authorization and encryption options are available for
PRINCIPAL if you have already defined the JAAS properties or
user certificates. Also, you must create the Kafka ACLs before starting Control Center.
You must then configure Control Center to authenticate to Kafka as the principal
that is specified for the ACL.
Use the following script to create the ACLs that are required by Control Center
to operate on an authorized cluster. The script creates ACLs on specific topics
and consumer groups, and grants permission to the user identified here as the principal.
You must run this script before you start Control Center:
The principal specified above is the Kafka user, the same as specified in
For each Kafka topic that Confluent Control Center creates, ACLs are created to grant the specified principal
the following privileges:
The following ACLs are created to grant the specified principal privileges for the
consumer group related to the Confluent Control Center Streams application:
ACLs granting the following privileges are also created for the cluster:
You must export a Control Center JAAS config before starting Control Center.
Deleting Control Center ACLs
There may be instances where you execute
control-center-set-acls with the wrong
Control Center principal. To revert this action, run the script again using the
--delete option. This deletes Control Center ACLs only for the same topics
and consumer groups in which the principal was originally specified.
To delete a Control Center ACL:
bin/control-center-set-acls config/control-center.properties --delete