Cloud

rpk security acl create

Create ACLs. Following the multiplying effect of combining flags, the create command works on a straightforward basis: every ACL combination is a created ACL.

If no host is specified, an allowed principal is allowed access from all hosts. The wildcard principal * allows all principals. At least one principal, one host, one resource, and one operation is required to create a single ACL.

Usage

rpk security acl create [flags]
The schema migration examples above are Schema Registry ACLs only. You also require Kafka ACLs for topics, consumer groups, and cluster operations. See Configure Access Control Lists.

Examples

This section provides examples of how to use rpk security acl create.

User ACLs

Allow all permissions to user bar on topic foo and group g

rpk security acl create --allow-principal bar --operation all --topic foo --group g

Allow read permissions to all users on topics biz and baz

rpk security acl create --allow-principal '*' --operation read --topic biz,baz

Allow write permissions to user buzz to transactional ID txn

rpk security acl create --allow-principal User:buzz --operation write --transactional-id txn

Role ACLs

Allow all permissions to role bar on topic foo and group g

rpk security acl create --allow-role bar --operation all --topic foo --group g

Schema Registry ACLs

Allow read permissions to user panda on topic bar and schema registry subject bar-value

rpk security acl create --allow-principal panda --operation read --topic bar --registry-subject bar-value

Schema migration permissions

Source cluster (read-only) for schema migration

rpk security acl create --allow-principal User:migrator-user --operation read,describe --registry-global --brokers <source-brokers>

Target cluster (read-write) for schema migration

rpk security acl create --allow-principal User:migrator-user --operation write,describe,alter_configs,describe_configs --registry-global --brokers <target-brokers>

Flags

Value Type Description

--allow-host

stringSlice

Hosts from which access will be granted (repeatable).

--allow-principal

stringSlice

Principal to allow. Format: User:name or Group:name. Can be specified multiple times.

--allow-role

stringSlice

Roles for which these permissions will be granted (repeatable).

--cluster

bool

Whether to grant ACLs to the cluster.

--deny-host

stringSlice

Hosts from from access will be denied (repeatable).

--deny-principal

stringSlice

Principal to deny. Format: User:name or Group:name. Can be specified multiple times.

--deny-role

stringSlice

Role for which these permissions will be denied (repeatable).

--group

stringSlice

Group to grant ACLs for (repeatable).

--operation

stringSlice

Operation to allow or deny: all, read, write, create, delete, alter, describe, clusteraction, describeconfigs, alterconfigs, idempotentwrite.

--registry-global

bool

Whether to grant ACLs for the schema registry.

--registry-subject

stringSlice

Schema Registry subjects to grant ACLs for (repeatable).

--resource-pattern-type

string

Pattern type: literal (exact match), prefixed (prefix match), match (either literal or prefixed), any.

--topic

stringSlice

Topic to grant ACLs for (repeatable).

--transactional-id

stringSlice

Transactional IDs to grant ACLs for (repeatable).

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.

Suggested reading