Doc 1196: Document Feature - Schema Registry Authorization #1224
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the ✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
✅ Deploy Preview for redpanda-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Feediver1
changed the title
Feediver1
requested review from
a team,
BenPope,
hcoyote,
mattschumpert,
r-vasquez and
vuldin
treevon
left a comment
treevon
left a comment
There was a problem hiding this comment.
Looks good, only change that needs to happen is the license expiration behavior. Right now it just describes what SR AuthZ does rather than the operations that are prohibited without a valid license.
| === schema_registry_enable_authorization | ||
|
|
||
| Enables ACL-based authorization for Schema Registry requests. When `true`, Schema Registry | ||
| uses ACL-based authorization instead of the default (`false`) `public/user/superuser` authorization model. Requires authentication to be enabled using the `schema_registry_api.authn_method`. |
There was a problem hiding this comment.
Might be worth linking to the broker property schema_registry_api.authn_method.
There was a problem hiding this comment.
once our automation adds that property, I will link to it.
| | `/security/acls` | ||
| | `GET` | ||
| | `describe` | ||
| | `cluster_action` |
There was a problem hiding this comment.
@Feediver1 similarly here, I don't think 'cluster_action' is the true resource name within redpanda. IIUC the resource is 'CLUSTER' and the action 'DESCRIBE'.
But I guess rpk uses a flag called --cluster_action @r-vasquez ?? @treevon .
There was a problem hiding this comment.
rpk has --cluster, AFAIU cluster_action is a valid kafka API operation. But I thought we wouldn't support this in schema registry.
@BenPope I see this in the RFC but I also see other thread where we mention:
CLUSTER_ACTION, CREATE, IDEMPOTENT_WRITE are supported operations on the kafka api but don't apply to the SR "subject" and "registry" resources.
So maybe this is something that I don't entirely understand, sorry
There was a problem hiding this comment.
@BenPope I only have 20 min before I have to merge this. I'm going with cluster as the resource here. We can revise later if this is wrong.
There was a problem hiding this comment.
rpk names the resource --cluster for creatting and CLUSTER when reporting
cluster works well.
| ==== | ||
| endif::[] | ||
|
|
||
| You can use ACLs to control access to Schema Registry resources. You can define fine-grained access on a global level, for example, to allow a principal to read all schemas, or on a per-subject basis; for example, to read and write to only the schemas of a specific subject. |
There was a problem hiding this comment.
| You can use ACLs to control access to Schema Registry resources. You can define fine-grained access on a global level, for example, to allow a principal to read all schemas, or on a per-subject basis; for example, to read and write to only the schemas of a specific subject. | |
| You can use ACLs to control access to Schema Registry resources. You can define fine-grained access on a global level, for example, to allow a principal to read all schemas, or on a per-subject basis, for example, to read and write to only the schemas of a specific subject. |
or you could make it into 2 bullets?
Co-authored-by: Michele Cyran <michele@redpanda.com>
Co-authored-by: kbatuigas <36839689+kbatuigas@users.noreply.github.com> Co-authored-by: Ben Pope <BenPope@users.noreply.github.com> Co-authored-by: Michele Cyran <michele@redpanda.com>
Description
This pull request introduces Schema Registry Authorization, a new feature in Redpanda version 25.2, which provides fine-grained access control for Schema Registry operations using ACLs. The changes include updates to documentation, new configuration options, and examples for managing Schema Registry ACLs. Below is a summary of the most important changes grouped by theme.
Schema Registry Authorization Feature
schema-reg-authorization.adocdetailing Schema Registry Authorization, including its functionality, supported operations, ACL resource types (REGISTRYandSUBJECT), and examples for managing ACLs.schema-reg-api.adocto include instructions and examples for managing Schema Registry ACLs, including creating ACLs for specific roles and subjects.Documentation Updates
nav.adocto include a link to the new Schema Registry Authorization page.acl.adocfile to document the new ACL resource types (REGISTRYandSUBJECT) and their associated operations, such asDESCRIBE_CONFIGSandALTER_CONFIGS. [1] [2]Release Notes and Licensing
redpanda.adocannouncing Schema Registry Authorization as a new enterprise feature, including its benefits and usage.overview.adocto include Schema Registry Authorization as an enterprise feature with details on its capabilities.These changes collectively introduce and document the new Schema Registry Authorization feature, enabling users to secure and manage access to Schema Registry resources effectively.
Resolves https://redpandadata.atlassian.net/browse/
Review deadline:
Page previews
What's New in Redpanda
Licensing/Redpanda enterprise features
Schema Registry Authorization
ACL resources
schema_registry_enable_authorization cluster property
Manage Schema Registry ACLs (Schema Registry API doc)
Checks