Apache Kafka AclDelete
CertifiedDelete Kafka ACLs matching a filter
Apache Kafka AclDelete
Delete Kafka ACLs matching a filter
Deletes every ACL matching the given filter using the Kafka AdminClient. This operation is destructive and cannot be undone.
Unset filter fields match any value, so a filter with nothing set would match every ACL on the cluster — this task refuses to run in that case unless deleteAll is set to true.
type: io.kestra.plugin.kafka.AclDeleteExamples
Revoke every ACL granted to a decommissioned tenant service account
id: kafka_acl_delete
namespace: company.team
tasks:
- id: delete_acls
type: io.kestra.plugin.kafka.AclDelete
properties:
bootstrap.servers: localhost:9092
principal: "User:tenant-acme-svc"
Properties
properties *object
Kafka AdminClient properties
Must include bootstrap.servers; accepts any Kafka AdminClient config. Provide base64-encoded content for ssl.keystore.location and ssl.truststore.location when using SSL.
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150callTimeout string
PT30SAdminClient call timeout
Maximum duration to wait for each AdminClient operation to complete before failing the task. Defaults to PT30S (30 seconds). Distinct from the task-level timeout, which lets the worker kill the task without retrying it.
deleteAll booleanstring
falseConfirm deleting every ACL on the cluster
Required opt-in when every filter field is unset (or renders empty), which would otherwise match — and delete — every ACL on the cluster. Defaults to false.
host string
Host filter
Matches any host when unset.
operation string
ALLREADWRITECREATEDELETEALTERDESCRIBECLUSTER_ACTIONDESCRIBE_CONFIGSALTER_CONFIGSIDEMPOTENT_WRITEOperation filter
Matches any operation when unset.
patternType string
LITERALPREFIXEDMATCHResource pattern type filter
Matches any pattern type when unset.
permissionType string
ALLOWDENYPermission type filter
Matches any permission type when unset.
principal string
Principal filter
For example User: alice. Matches any principal when unset.
resourceName string
Resource name filter
Matches any resource name when unset.
resourceType string
TOPICGROUPCLUSTERTRANSACTIONAL_IDDELEGATION_TOKENUSERResource type filter
Matches any resource type when unset.
Outputs
deletedAcls array
Deleted ACLs
Each entry contains resourceType, resourceName, patternType, principal, host, operation and permissionType.
