DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
For programmatic use via the Admin Client, nothing changes in the API signatures. CIDR notation goes where a host would normally go:
| Code Block | ||
|---|---|---|
| ||
AclBinding binding = new AclBinding(
new ResourcePattern(ResourceType.TOPIC, "events", PatternType.LITERAL),
new AccessControlEntry("User:app", "10.0.0.0/8", AclOperation.READ, AclPermissionType.ALLOW)
);
adminClient.createAcls(Collections.singleton(binding)); |
...
Metadata Version Gating
Moreover, we propose adding a new metadata version to gate this feature. This is important because older brokers will not understand CIDR patterns, and we need to prevent users from creating ACLs that would break things during a rolling upgrade.
| Code Block | ||
|---|---|---|
| ||
// In MetadataVersion.java
IBP_4_X_IVZ(XX, "4.X", "IVZ", true),
public boolean isCidrAclSupported() {
return this.isAtLeast(IBP_4_X_IVZ);
} |
...
Attempting to create a CIDR ACL before the cluster is ready results in a clear error:
| Code Block | ||
|---|---|---|
| ||
org.apache.kafka.common.errors.UnsupportedVersionException:
CIDR-based ACL host patterns require metadata version IBP_4_X_IVZ or higher.
Current cluster metadata version: IBP_4_0_IV0 |
...
Proposed Changes
1. Host Matching Logic
...