KIP-55 — Secure Quotas for Authenticated Users

Accepted SecurityBroker

Extends the Kafka quota system to support per-user and per-user-per-client-id quota bindings enforced by the broker based on the authenticated principal, in addition to the existing per-client-id quotas. Prior to this, quotas were enforced by client-id alone, which is an unauthenticated field any client can forge, making it impossible to enforce fair resource allocation in multi-tenant secure clusters.

Details