KIP-1298 — Per-Resource-Type Authorization for LIST_CONFIG_RESOURCES

Discussion Kafka 4.5 SecurityAdmin

Refines the authorization model for the LIST_CONFIG_RESOURCES RPC (introduced by KIP-1142) so that permission checks are scoped per resource type rather than requiring DESCRIBE_CONFIGS on the CLUSTER resource for all types. The current all-or-nothing CLUSTER-level gate is inconsistent with finer-grained RPCs like LIST_GROUPS, which only requires DESCRIBE on the CLUSTER resource.

Protocol Impact

ListConfigResources

Details