DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
Source cluster permissions (mirror principal):
RPC | Component | ACL Operation | ACL Resource | Purpose |
| Fetch | MFT | Read | Topic | Data replication |
| Metadata | MMM | Describe | Topic | Topic discovery and leader tracking |
| DescribeConfigs | MMM | Describe | Topic | Topic configuration sync |
| ListGroups | MMM | Describe | Group | Consumer group offset sync |
| OffsetFetch | MMM | Describe | Group | Consumer group offset sync |
| DescribeAcls | MMM | Describe | Cluster | ACL synchronization |
| LastMirroredOffsets | MMM | ClusterAction | Cluster | Log truncation during failback |
| ApiVersions | MMM | Feature negotiation | ||
| ListOffsets | MFT | Describe | Topic | Offset bounds discovery |
| OffsetsForLeaderEpoch | MFT | Describe | Topic | Leader epoch validation for truncation |
Destination cluster permissions:
RPC | Component | ACL Operation | ACL Resource | Purpose |
| CreateMirror | Controller | Create | ClusterMirror | Create a new cluster mirror |
| AddTopicsToMirror | Controller | Alter | ClusterMirror | Add topics to an existing mirror |
| RemoveTopicsFromMirror | Controller | Alter | ClusterMirror | Remove topics from a mirror (failover) |
| PauseMirrorTopics | Controller | Alter | ClusterMirror | Pause replication for topics |
| ResumeMirrorTopics | Controller | Alter | ClusterMirror | Resume replication for topics |
| ListMirrors | Broker | Describe | ClusterMirror | List configured mirrors |
| DescribeMirrors | Broker | Describe | ClusterMirror | Describe mirror state and lag |
| DescribeConfigs | Broker | DescribeConfigs | ClusterMirror | Describe mirror configuration |
| IncrementalAlterConfigs | Controller | AlterConfigs | ClusterMirror | Modify mirror configuration |
| WriteMirrorStates | MC | ClusterAction | Cluster | Persist partition state to coordinator |
| ReadMirrorStates | MC | ClusterAction | Cluster | Read partition state from coordinator |
| LastMirroredOffsets | Broker | ClusterAction | Cluster | Query last mirrored offset for truncation |
| FindCoordinator | Broker | ClusterAction | Cluster | Locate mirror coordinator for a partition |
| CreatePartitions | MMM | inter-broker principal | implicit | Scale partitions to match source |
| OffsetCommit | MMM | inter-broker principal | implicit | Sync consumer group offsets |
| CreateAcls | MMM | inter-broker principal | implicit | Sync ACLs from source |
| DeleteAcls | MMM | inter-broker principal | implicit | Remove stale ACLs |
An operator can grant ClusterMirror:*:CREATE,ALTER,DESCRIBE for full mirror management, or scope it to specific mirrors like ClusterMirror:prod-dr:DESCRIBE for read-only monitoring of a single mirror, without granting any broker-level privileges. Inter-broker coordinator RPCs (WriteMirrorStates, ReadMirrorStates, LastMirroredOffsets, FindCoordinator with CoordinatorType.MIRROR) require CLUSTER_ACTION on the Cluster resource, as they are only issued by the broker service account. MMM issues CreatePartitions, OffsetCommit, CreateAcls, DeleteAcls locally using the inter-broker principal, bypassing normal ACL checks. This is by design but means the mirror feature implicitly holds ALTER on topics, groups, and ACLs within the destination cluster.
...
A new entity type is added for in the message generator to provide schema-level type validation for mirror name fields:
| Code Block |
|---|
public enum EntityType {
// ... existing types ...
@JsonProperty("mirrorName")
MIRROR_NAME(FieldType.StringFieldType.INSTANCE); // New type
} |
ResourceType
A new resource type is added to the ResourceType enum to enable per-mirror authorization:
| Code Block |
|---|
public enum ResourceType {
// ... existing types ...
/**
* A cluster mirror.
*/
CLUSTER_MIRROR((byte) 8); // New type |
CreateMirror
Allows users to create a mirror and supply its configuration. When the broker receives the request, it validates that the mirror name is not already in use, contains only permitted characters, and does not end with the ".removed" suffix. Once validated, the request is forwarded to the controller, which persists the configuration in the metadata log.
...