Apache Kafka AclCreate

Apache Kafka AclCreate

Certified

Create a Kafka ACL

Grants (or denies) an operation on a resource to a principal using the Kafka AdminClient. Use patternType: PREFIXED to authorize an entire per-tenant namespace (for example all topics starting with tenant_acme_) with a single ACL.

yaml
type: io.kestra.plugin.kafka.AclCreate

Authorize a tenant service account to produce to its own topic namespace

yaml
id: kafka_acl_create
namespace: company.team

tasks:
  - id: create_acl
    type: io.kestra.plugin.kafka.AclCreate
    properties:
      bootstrap.servers: localhost:9092
    resourceType: TOPIC
    resourceName: tenant_acme_
    patternType: PREFIXED
    principal: "User:tenant-acme-svc"
    host: "*"
    operation: WRITE
    permissionType: ALLOW
Properties
Possible Values
ALLREADWRITECREATEDELETEALTERDESCRIBECLUSTER_ACTIONDESCRIBE_CONFIGSALTER_CONFIGSIDEMPOTENT_WRITE

Operation

For example READ, WRITE, CREATE, DELETE, ALTER, DESCRIBE, ALL.

Possible Values
ALLOWDENY

Permission type

ALLOW or DENY.

Principal

For example User: alice.

Kafka AdminClient properties

Must include bootstrap.servers; accepts any Kafka AdminClient config. Provide base64-encoded content for ssl.keystore.location and ssl.truststore.location when using SSL.

Resource name

Exact name for LITERAL, or the namespace prefix for PREFIXED.

Possible Values
TOPICGROUPCLUSTERTRANSACTIONAL_IDDELEGATION_TOKENUSER

Resource type

For example TOPIC, GROUP, CLUSTER, TRANSACTIONAL_ID, DELEGATION_TOKEN, USER.

Default*

Host

Defaults to * (any host).

DefaultLITERAL
Possible Values
LITERALPREFIXEDMATCH

Resource pattern type

LITERAL matches the resource name exactly (default). PREFIXED matches every resource whose name starts with resourceName — the standard way to authorize a whole per-tenant namespace with one ACL. MATCH matches wildcard and prefixed patterns as well as literal ones.

Reference (ref) of the pluginDefaults to apply to this task.

DefaultPT30S

AdminClient call timeout

Maximum duration to wait for each AdminClient operation to complete before failing the task. Defaults to PT30S (30 seconds).

Host

Possible Values
ALLREADWRITECREATEDELETEALTERDESCRIBECLUSTER_ACTIONDESCRIBE_CONFIGSALTER_CONFIGSIDEMPOTENT_WRITE

Operation

Possible Values
LITERALPREFIXEDMATCH

Resource pattern type

Possible Values
ALLOWDENY

Permission type

Principal

Resource name

Possible Values
TOPICGROUPCLUSTERTRANSACTIONAL_IDDELEGATION_TOKENUSER

Resource type

More Plugins in this Category

Liquibase
Liquibase

Tasks that run Liquibase change management commands.

Data

2 tasks

6 blueprints

PostgreSQL
PostgreSQL

Tasks that connect to PostgreSQL via JDBC to run queries and loads.

Data

6 tasks

25 blueprints