From e8e4e0b6dba77837d7fd97821e10dbee46a4e16e Mon Sep 17 00:00:00 2001 From: KTKTK-HZ <56449555+KTKTK-HZ@users.noreply.github.com> Date: Thu, 17 Jul 2025 16:35:46 +0800 Subject: [PATCH] KAFKA-19377:Update /streams/developer-guide/security.html for KIP-1071 (#20084) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added required ACLs for new streams operations: - STREAMS_GROUP_HEARTBEAT (88) requires: • READ on Group • DESCRIBE on Topics • [Conditional] CREATE on Cluster or Topics - STREAMS_GROUP_DESCRIBE (89) requires: • DESCRIBE on Group • DESCRIBE on Topic Here is the rendering of the modified document. Reviewers: Lucas Brutschy Co-authored-by: Lucas Brutschy --- docs/streams/developer-guide/security.html | 61 +++++++++++++++++++++- 1 file changed, 60 insertions(+), 1 deletion(-) diff --git a/docs/streams/developer-guide/security.html b/docs/streams/developer-guide/security.html index 13e671fa931..bae4d90b8b2 100644 --- a/docs/streams/developer-guide/security.html +++ b/docs/streams/developer-guide/security.html @@ -70,7 +70,65 @@ the ACL set so that the application has the permissions to create, read and write internal topics.

-

To avoid providing this permission to your application, you can create the required internal topics manually. +

+

If the streams rebalance protocol is enabled by setting group.protocol=streams, the following ACLs are required on the topic and group resources:

+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
API PROTOCOLOPERATIONResourceNotes
STREAMS_GROUP_HEARTBEATReadGroupRequired for the application's streams group
STREAMS_GROUP_HEARTBEATCreateCluster or Topic + Required only if auto-creating internal topics.
+ • Create on Cluster resource
+ • or Create on all topics in StateChangelogTopics and RepartitionSourceTopics
+ Not required if internal topics are pre-created +
STREAMS_GROUP_HEARTBEATDescribeTopicRequired for all topics used in the application's topology, when first joining.
STREAMS_GROUP_DESCRIBEDescribeGroupRequired for the application's streams group
STREAMS_GROUP_DESCRIBEDescribeTopicRequired for all topics used in the group's topology
+ +

As mentioned earlier, Kafka Streams applications need appropriate ACLs to create internal topics when running against a secured Kafka cluster. + To avoid providing this permission to your application, you can create the required internal topics manually. If the internal topics exist, Kafka Streams will not try to recreate them. Note, that the internal repartition and changelog topics must be created with the correct number of partitions—otherwise, Kafka Streams will fail on startup. The topics must be created with the same number of partitions as your input topic, or if there are multiple topics, the maximum number of partitions across all input topics. @@ -89,6 +147,7 @@ and KIP-290 for details).

+

Security example

The purpose is to configure a Kafka Streams application to enable client authentication and encrypt data-in-transit when