This is an automated email from the ASF dual-hosted git repository. guozhang pushed a commit to branch trunk in repository https://gitbox.apache.org/repos/asf/kafka.git The following commit(s) were added to refs/heads/trunk by this push: new a205551 HOTFIX: update Streams security docs a205551 is described below commit a20555102bf1c0a216fe9d3e2fa59edfb6091b1b Author: Guozhang Wang AuthorDate: Tue Jun 26 18:53:06 2018 -0700 HOTFIX: update Streams security docs --- docs/streams/developer-guide/security.html | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/docs/streams/developer-guide/security.html b/docs/streams/developer-guide/security.html index 9c49456..e196e14 100644 --- a/docs/streams/developer-guide/security.html +++ b/docs/streams/developer-guide/security.html @@ -64,17 +64,20 @@

For more information about the security features in Apache Kafka, see Kafka Security.

Required ACL setting for secure Kafka clusters

-

When applications are run against a secured Kafka cluster, the principal running the application must have the ACL +

Kafka clusters can use ACLs to control access to resources (like the ability to create topics), and for such clusters each client, + including Kafka Streams, is required to authenticate as a particular user in order to be authorized with appropriate access. + In particular, when Streams applications are run against a secured Kafka cluster, the principal running the application must have + the ACL --cluster --operation Create set so that the application has the permissions to create internal topics.

-

To avoid providing this permission to your application, you can create the required internal topics manually. - If the internal topics exist, Kafka Streams will not try to recreate them. - Note, that the internal repartition and changelog topics must be created with the correct number of partitions—otherwise, Kafka Streams will fail on startup. - The topics must be created with the same number of partitions as your input topic, or if there are multiple topics, the maximum number of partitions across all input topics. - Additionally, changelog topics must be created with log compaction enabled—otherwise, your application might lose data. - You can find out more about the names of the required internal topics via Topology#describe(). - All internal topics follow the naming pattern <application.id>-<operatorName>-<suffix> where the suffix is either repartition or changelog. - Note, that there is no guarantee about this naming pattern in future releases—it's not part of the public API.

+ +

Since all internal topics as well as the embedded consumer group name are prefixed with the application id, + it is recommended to use ACLs on prefixed resource pattern + to configure control lists to allow client to manage all topics and consumer groups started with this prefix + (see KIP-277 + and KIP-290 for details). + For example, given the following setup of your Streams application: +

Security example