KIP-277 — Fine Grained ACL for CreateTopics API

Accepted Kafka 2.0 SecurityAdmin

Changes CreateTopics ACL checks from requiring Describe+Create on the Cluster resource to requiring Create permission on the specific Topic resource being created, enabling per-topic create ACLs. The cluster-level ACL for topic creation was asymmetric with DeleteTopics (which used topic-level ACLs) and prevented granting users the ability to manage only their own topic namespace.

Protocol Impact

CreateTopics · DeleteTopics

Details