Strimzi-kafka-operator: Allowing addition of User:ANONYMOUS and/or more generic ACLs

[skbly7]

I was looking to launch a hybrid authentication Kafka cluster with configuration something like:
plain: {} external: authentication: type: tls

There are k8s filebeat pods which wish to write to Kafka topicA and these logs aren't sensitive per se. So we were looking to push without tls/auth to plain port.

While there is another workload which generate sensitive logs topicB are we are looking to push with external tls auth.

So I was trying to make:

• unauthenticated persons can push & fetch logs from topicA and not topicB
• while only authenticated (username: xyz) can topicB

The ideal configuration in non-operator world.

• allow.everyone.if.no.acl.found: false
• adding User:xyz with permission over topicB
• granting User:ANONYMOUS permission to topicA

Possible Solutions:

1. Making User:ANONYMOUS crd possible, if yes other authorization can work as expected for other users. Currently only lower case usernames are allowed. (ANONYMOUS is Kafka's implementation)
2. Making custom kafka-acls.sh commands possible after Zookeeper are up, this can make topic level ACLs addition possible as well.

Quick Chat link on Slack for context.

[skbly7]

Something like topicName in KafkaTopic CRD is also a viable solution for KafkaUser as well.

[scholzj]

TBH, I think the topicName in KafkaTopic is rather unfortunate. It adds a lot of complexity and issues (you need to map the CR names against the names inside the spec, ou need to deal with duplicates etc.). So I would probably try to avoid it. What I was thinking about was to modify the User Operator so that it gives User:ANONYMOUS a special treatment and does not delete the ACL rules when you delete them manually. That would allow you to set the rules using kafka_acls.sh directly in Zookeeper after you setup the cluster and use the anonymous users without being disturbed by the User Operator.

[skbly7]

Sure, that looks like workable solution as well and I am using the same in my fork. By doing this:

--- a/user-operator/src/main/java/io/strimzi/operator/user/operator/SimpleAclOperator.java
+++ b/user-operator/src/main/java/io/strimzi/operator/user/operator/SimpleAclOperator.java
@@ -248,7 +248,9 @@ public class SimpleAclOperator {
                         log.trace("Adding user {} to Set of users with ACLs", username);
                     }

-                    result.add(username);
+                    if (!"ANONYMOUS".equals(username)) {
+                        result.add(username);
+                    }
                 }
             }
         }

I can probably make this configurable and send pull request accordingly?

[scholzj]

I'm not sure I would make it configurable, but I would maybe create a set with the _ignored_ users so that it is easy to add more users in the future if needed. Anyway, if you can open a PR it would be great. Thanks

[itadventurer]

I have the use case that I want to allow an operation to all users.

Here is an example from the Kafka documentation

bin/kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 --add \
 --allow-principal User:'*' --allow-host '*' --deny-principal User:BadBob --deny-host 198.51.100.3 \
 --operation Read --topic test-topic

[scholzj]

@azapps @skbly7 I opened a PR for this: #1729