pulumi-kafka 3.11.0a1753336924__py3-none-any.whl → 3.11.0a1753501206__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_kafka/__init__.py +3 -1
- pulumi_kafka/acl.py +326 -99
- pulumi_kafka/config/__init__.py +1 -1
- pulumi_kafka/config/__init__.pyi +1 -2
- pulumi_kafka/config/vars.py +29 -30
- pulumi_kafka/get_topic.py +13 -14
- pulumi_kafka/get_topics.py +85 -0
- pulumi_kafka/outputs.py +71 -0
- pulumi_kafka/provider.py +268 -269
- pulumi_kafka/pulumi-plugin.json +1 -1
- pulumi_kafka/quota.py +296 -55
- pulumi_kafka/topic.py +293 -72
- pulumi_kafka/user_scram_credential.py +145 -86
- {pulumi_kafka-3.11.0a1753336924.dist-info → pulumi_kafka-3.11.0a1753501206.dist-info}/METADATA +1 -1
- pulumi_kafka-3.11.0a1753501206.dist-info/RECORD +19 -0
- pulumi_kafka-3.11.0a1753336924.dist-info/RECORD +0 -17
- {pulumi_kafka-3.11.0a1753336924.dist-info → pulumi_kafka-3.11.0a1753501206.dist-info}/WHEEL +0 -0
- {pulumi_kafka-3.11.0a1753336924.dist-info → pulumi_kafka-3.11.0a1753501206.dist-info}/top_level.txt +0 -0
pulumi_kafka/__init__.py
CHANGED
@@ -2,16 +2,18 @@
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
4
4
|
|
5
|
-
import builtins
|
5
|
+
import builtins as _builtins
|
6
6
|
from . import _utilities
|
7
7
|
import typing
|
8
8
|
# Export this package's modules as members:
|
9
9
|
from .acl import *
|
10
10
|
from .get_topic import *
|
11
|
+
from .get_topics import *
|
11
12
|
from .provider import *
|
12
13
|
from .quota import *
|
13
14
|
from .topic import *
|
14
15
|
from .user_scram_credential import *
|
16
|
+
from . import outputs
|
15
17
|
|
16
18
|
# Make subpackages available:
|
17
19
|
if typing.TYPE_CHECKING:
|
pulumi_kafka/acl.py
CHANGED
@@ -2,8 +2,7 @@
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
4
4
|
|
5
|
-
import builtins
|
6
|
-
import copy
|
5
|
+
import builtins as _builtins
|
7
6
|
import warnings
|
8
7
|
import sys
|
9
8
|
import pulumi
|
@@ -20,16 +19,16 @@ __all__ = ['AclArgs', 'Acl']
|
|
20
19
|
@pulumi.input_type
|
21
20
|
class AclArgs:
|
22
21
|
def __init__(__self__, *,
|
23
|
-
acl_host: pulumi.Input[
|
24
|
-
acl_operation: pulumi.Input[
|
25
|
-
acl_permission_type: pulumi.Input[
|
26
|
-
acl_principal: pulumi.Input[
|
27
|
-
acl_resource_name: pulumi.Input[
|
28
|
-
acl_resource_type: pulumi.Input[
|
29
|
-
resource_pattern_type_filter: Optional[pulumi.Input[
|
22
|
+
acl_host: pulumi.Input[_builtins.str],
|
23
|
+
acl_operation: pulumi.Input[_builtins.str],
|
24
|
+
acl_permission_type: pulumi.Input[_builtins.str],
|
25
|
+
acl_principal: pulumi.Input[_builtins.str],
|
26
|
+
acl_resource_name: pulumi.Input[_builtins.str],
|
27
|
+
acl_resource_type: pulumi.Input[_builtins.str],
|
28
|
+
resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None):
|
30
29
|
"""
|
31
30
|
The set of arguments for constructing a Acl resource.
|
32
|
-
:param pulumi.Input[
|
31
|
+
:param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
|
33
32
|
"""
|
34
33
|
pulumi.set(__self__, "acl_host", acl_host)
|
35
34
|
pulumi.set(__self__, "acl_operation", acl_operation)
|
@@ -40,86 +39,86 @@ class AclArgs:
|
|
40
39
|
if resource_pattern_type_filter is not None:
|
41
40
|
pulumi.set(__self__, "resource_pattern_type_filter", resource_pattern_type_filter)
|
42
41
|
|
43
|
-
@property
|
42
|
+
@_builtins.property
|
44
43
|
@pulumi.getter(name="aclHost")
|
45
|
-
def acl_host(self) -> pulumi.Input[
|
44
|
+
def acl_host(self) -> pulumi.Input[_builtins.str]:
|
46
45
|
return pulumi.get(self, "acl_host")
|
47
46
|
|
48
47
|
@acl_host.setter
|
49
|
-
def acl_host(self, value: pulumi.Input[
|
48
|
+
def acl_host(self, value: pulumi.Input[_builtins.str]):
|
50
49
|
pulumi.set(self, "acl_host", value)
|
51
50
|
|
52
|
-
@property
|
51
|
+
@_builtins.property
|
53
52
|
@pulumi.getter(name="aclOperation")
|
54
|
-
def acl_operation(self) -> pulumi.Input[
|
53
|
+
def acl_operation(self) -> pulumi.Input[_builtins.str]:
|
55
54
|
return pulumi.get(self, "acl_operation")
|
56
55
|
|
57
56
|
@acl_operation.setter
|
58
|
-
def acl_operation(self, value: pulumi.Input[
|
57
|
+
def acl_operation(self, value: pulumi.Input[_builtins.str]):
|
59
58
|
pulumi.set(self, "acl_operation", value)
|
60
59
|
|
61
|
-
@property
|
60
|
+
@_builtins.property
|
62
61
|
@pulumi.getter(name="aclPermissionType")
|
63
|
-
def acl_permission_type(self) -> pulumi.Input[
|
62
|
+
def acl_permission_type(self) -> pulumi.Input[_builtins.str]:
|
64
63
|
return pulumi.get(self, "acl_permission_type")
|
65
64
|
|
66
65
|
@acl_permission_type.setter
|
67
|
-
def acl_permission_type(self, value: pulumi.Input[
|
66
|
+
def acl_permission_type(self, value: pulumi.Input[_builtins.str]):
|
68
67
|
pulumi.set(self, "acl_permission_type", value)
|
69
68
|
|
70
|
-
@property
|
69
|
+
@_builtins.property
|
71
70
|
@pulumi.getter(name="aclPrincipal")
|
72
|
-
def acl_principal(self) -> pulumi.Input[
|
71
|
+
def acl_principal(self) -> pulumi.Input[_builtins.str]:
|
73
72
|
return pulumi.get(self, "acl_principal")
|
74
73
|
|
75
74
|
@acl_principal.setter
|
76
|
-
def acl_principal(self, value: pulumi.Input[
|
75
|
+
def acl_principal(self, value: pulumi.Input[_builtins.str]):
|
77
76
|
pulumi.set(self, "acl_principal", value)
|
78
77
|
|
79
|
-
@property
|
78
|
+
@_builtins.property
|
80
79
|
@pulumi.getter(name="aclResourceName")
|
81
|
-
def acl_resource_name(self) -> pulumi.Input[
|
80
|
+
def acl_resource_name(self) -> pulumi.Input[_builtins.str]:
|
82
81
|
"""
|
83
82
|
The name of the resource
|
84
83
|
"""
|
85
84
|
return pulumi.get(self, "acl_resource_name")
|
86
85
|
|
87
86
|
@acl_resource_name.setter
|
88
|
-
def acl_resource_name(self, value: pulumi.Input[
|
87
|
+
def acl_resource_name(self, value: pulumi.Input[_builtins.str]):
|
89
88
|
pulumi.set(self, "acl_resource_name", value)
|
90
89
|
|
91
|
-
@property
|
90
|
+
@_builtins.property
|
92
91
|
@pulumi.getter(name="aclResourceType")
|
93
|
-
def acl_resource_type(self) -> pulumi.Input[
|
92
|
+
def acl_resource_type(self) -> pulumi.Input[_builtins.str]:
|
94
93
|
return pulumi.get(self, "acl_resource_type")
|
95
94
|
|
96
95
|
@acl_resource_type.setter
|
97
|
-
def acl_resource_type(self, value: pulumi.Input[
|
96
|
+
def acl_resource_type(self, value: pulumi.Input[_builtins.str]):
|
98
97
|
pulumi.set(self, "acl_resource_type", value)
|
99
98
|
|
100
|
-
@property
|
99
|
+
@_builtins.property
|
101
100
|
@pulumi.getter(name="resourcePatternTypeFilter")
|
102
|
-
def resource_pattern_type_filter(self) -> Optional[pulumi.Input[
|
101
|
+
def resource_pattern_type_filter(self) -> Optional[pulumi.Input[_builtins.str]]:
|
103
102
|
return pulumi.get(self, "resource_pattern_type_filter")
|
104
103
|
|
105
104
|
@resource_pattern_type_filter.setter
|
106
|
-
def resource_pattern_type_filter(self, value: Optional[pulumi.Input[
|
105
|
+
def resource_pattern_type_filter(self, value: Optional[pulumi.Input[_builtins.str]]):
|
107
106
|
pulumi.set(self, "resource_pattern_type_filter", value)
|
108
107
|
|
109
108
|
|
110
109
|
@pulumi.input_type
|
111
110
|
class _AclState:
|
112
111
|
def __init__(__self__, *,
|
113
|
-
acl_host: Optional[pulumi.Input[
|
114
|
-
acl_operation: Optional[pulumi.Input[
|
115
|
-
acl_permission_type: Optional[pulumi.Input[
|
116
|
-
acl_principal: Optional[pulumi.Input[
|
117
|
-
acl_resource_name: Optional[pulumi.Input[
|
118
|
-
acl_resource_type: Optional[pulumi.Input[
|
119
|
-
resource_pattern_type_filter: Optional[pulumi.Input[
|
112
|
+
acl_host: Optional[pulumi.Input[_builtins.str]] = None,
|
113
|
+
acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
|
114
|
+
acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
|
115
|
+
acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
|
116
|
+
acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
|
117
|
+
acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
|
118
|
+
resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None):
|
120
119
|
"""
|
121
120
|
Input properties used for looking up and filtering Acl resources.
|
122
|
-
:param pulumi.Input[
|
121
|
+
:param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
|
123
122
|
"""
|
124
123
|
if acl_host is not None:
|
125
124
|
pulumi.set(__self__, "acl_host", acl_host)
|
@@ -136,70 +135,70 @@ class _AclState:
|
|
136
135
|
if resource_pattern_type_filter is not None:
|
137
136
|
pulumi.set(__self__, "resource_pattern_type_filter", resource_pattern_type_filter)
|
138
137
|
|
139
|
-
@property
|
138
|
+
@_builtins.property
|
140
139
|
@pulumi.getter(name="aclHost")
|
141
|
-
def acl_host(self) -> Optional[pulumi.Input[
|
140
|
+
def acl_host(self) -> Optional[pulumi.Input[_builtins.str]]:
|
142
141
|
return pulumi.get(self, "acl_host")
|
143
142
|
|
144
143
|
@acl_host.setter
|
145
|
-
def acl_host(self, value: Optional[pulumi.Input[
|
144
|
+
def acl_host(self, value: Optional[pulumi.Input[_builtins.str]]):
|
146
145
|
pulumi.set(self, "acl_host", value)
|
147
146
|
|
148
|
-
@property
|
147
|
+
@_builtins.property
|
149
148
|
@pulumi.getter(name="aclOperation")
|
150
|
-
def acl_operation(self) -> Optional[pulumi.Input[
|
149
|
+
def acl_operation(self) -> Optional[pulumi.Input[_builtins.str]]:
|
151
150
|
return pulumi.get(self, "acl_operation")
|
152
151
|
|
153
152
|
@acl_operation.setter
|
154
|
-
def acl_operation(self, value: Optional[pulumi.Input[
|
153
|
+
def acl_operation(self, value: Optional[pulumi.Input[_builtins.str]]):
|
155
154
|
pulumi.set(self, "acl_operation", value)
|
156
155
|
|
157
|
-
@property
|
156
|
+
@_builtins.property
|
158
157
|
@pulumi.getter(name="aclPermissionType")
|
159
|
-
def acl_permission_type(self) -> Optional[pulumi.Input[
|
158
|
+
def acl_permission_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
160
159
|
return pulumi.get(self, "acl_permission_type")
|
161
160
|
|
162
161
|
@acl_permission_type.setter
|
163
|
-
def acl_permission_type(self, value: Optional[pulumi.Input[
|
162
|
+
def acl_permission_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
164
163
|
pulumi.set(self, "acl_permission_type", value)
|
165
164
|
|
166
|
-
@property
|
165
|
+
@_builtins.property
|
167
166
|
@pulumi.getter(name="aclPrincipal")
|
168
|
-
def acl_principal(self) -> Optional[pulumi.Input[
|
167
|
+
def acl_principal(self) -> Optional[pulumi.Input[_builtins.str]]:
|
169
168
|
return pulumi.get(self, "acl_principal")
|
170
169
|
|
171
170
|
@acl_principal.setter
|
172
|
-
def acl_principal(self, value: Optional[pulumi.Input[
|
171
|
+
def acl_principal(self, value: Optional[pulumi.Input[_builtins.str]]):
|
173
172
|
pulumi.set(self, "acl_principal", value)
|
174
173
|
|
175
|
-
@property
|
174
|
+
@_builtins.property
|
176
175
|
@pulumi.getter(name="aclResourceName")
|
177
|
-
def acl_resource_name(self) -> Optional[pulumi.Input[
|
176
|
+
def acl_resource_name(self) -> Optional[pulumi.Input[_builtins.str]]:
|
178
177
|
"""
|
179
178
|
The name of the resource
|
180
179
|
"""
|
181
180
|
return pulumi.get(self, "acl_resource_name")
|
182
181
|
|
183
182
|
@acl_resource_name.setter
|
184
|
-
def acl_resource_name(self, value: Optional[pulumi.Input[
|
183
|
+
def acl_resource_name(self, value: Optional[pulumi.Input[_builtins.str]]):
|
185
184
|
pulumi.set(self, "acl_resource_name", value)
|
186
185
|
|
187
|
-
@property
|
186
|
+
@_builtins.property
|
188
187
|
@pulumi.getter(name="aclResourceType")
|
189
|
-
def acl_resource_type(self) -> Optional[pulumi.Input[
|
188
|
+
def acl_resource_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
190
189
|
return pulumi.get(self, "acl_resource_type")
|
191
190
|
|
192
191
|
@acl_resource_type.setter
|
193
|
-
def acl_resource_type(self, value: Optional[pulumi.Input[
|
192
|
+
def acl_resource_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
194
193
|
pulumi.set(self, "acl_resource_type", value)
|
195
194
|
|
196
|
-
@property
|
195
|
+
@_builtins.property
|
197
196
|
@pulumi.getter(name="resourcePatternTypeFilter")
|
198
|
-
def resource_pattern_type_filter(self) -> Optional[pulumi.Input[
|
197
|
+
def resource_pattern_type_filter(self) -> Optional[pulumi.Input[_builtins.str]]:
|
199
198
|
return pulumi.get(self, "resource_pattern_type_filter")
|
200
199
|
|
201
200
|
@resource_pattern_type_filter.setter
|
202
|
-
def resource_pattern_type_filter(self, value: Optional[pulumi.Input[
|
201
|
+
def resource_pattern_type_filter(self, value: Optional[pulumi.Input[_builtins.str]]):
|
203
202
|
pulumi.set(self, "resource_pattern_type_filter", value)
|
204
203
|
|
205
204
|
|
@@ -209,19 +208,133 @@ class Acl(pulumi.CustomResource):
|
|
209
208
|
def __init__(__self__,
|
210
209
|
resource_name: str,
|
211
210
|
opts: Optional[pulumi.ResourceOptions] = None,
|
212
|
-
acl_host: Optional[pulumi.Input[
|
213
|
-
acl_operation: Optional[pulumi.Input[
|
214
|
-
acl_permission_type: Optional[pulumi.Input[
|
215
|
-
acl_principal: Optional[pulumi.Input[
|
216
|
-
acl_resource_name: Optional[pulumi.Input[
|
217
|
-
acl_resource_type: Optional[pulumi.Input[
|
218
|
-
resource_pattern_type_filter: Optional[pulumi.Input[
|
211
|
+
acl_host: Optional[pulumi.Input[_builtins.str]] = None,
|
212
|
+
acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
|
213
|
+
acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
|
214
|
+
acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
|
215
|
+
acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
|
216
|
+
acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
|
217
|
+
resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None,
|
219
218
|
__props__=None):
|
220
219
|
"""
|
221
|
-
|
220
|
+
The `Acl` resource manages Apache Kafka Access Control Lists (ACLs). ACLs control access to Kafka resources like topics, consumer groups, and clusters by defining which principals (users or services) can perform specific operations on these resources.
|
221
|
+
|
222
|
+
## Example Usage
|
223
|
+
|
224
|
+
### Allow Producer Access to Topic
|
225
|
+
|
226
|
+
```python
|
227
|
+
import pulumi
|
228
|
+
import pulumi_kafka as kafka
|
229
|
+
|
230
|
+
producer = kafka.Acl("producer",
|
231
|
+
acl_resource_name="orders",
|
232
|
+
acl_resource_type="Topic",
|
233
|
+
acl_principal="User:producer-service",
|
234
|
+
acl_host="*",
|
235
|
+
acl_operation="Write",
|
236
|
+
acl_permission_type="Allow")
|
237
|
+
# Also grant describe permission for producers
|
238
|
+
producer_describe = kafka.Acl("producer_describe",
|
239
|
+
acl_resource_name="orders",
|
240
|
+
acl_resource_type="Topic",
|
241
|
+
acl_principal="User:producer-service",
|
242
|
+
acl_host="*",
|
243
|
+
acl_operation="Describe",
|
244
|
+
acl_permission_type="Allow")
|
245
|
+
```
|
246
|
+
|
247
|
+
### Allow Consumer Group Access
|
248
|
+
|
249
|
+
```python
|
250
|
+
import pulumi
|
251
|
+
import pulumi_kafka as kafka
|
252
|
+
|
253
|
+
# Allow read access to topic
|
254
|
+
consumer_read = kafka.Acl("consumer_read",
|
255
|
+
acl_resource_name="orders",
|
256
|
+
acl_resource_type="Topic",
|
257
|
+
acl_principal="User:consumer-service",
|
258
|
+
acl_host="*",
|
259
|
+
acl_operation="Read",
|
260
|
+
acl_permission_type="Allow")
|
261
|
+
# Allow access to consumer group
|
262
|
+
consumer_group = kafka.Acl("consumer_group",
|
263
|
+
acl_resource_name="order-processors",
|
264
|
+
acl_resource_type="Group",
|
265
|
+
acl_principal="User:consumer-service",
|
266
|
+
acl_host="*",
|
267
|
+
acl_operation="Read",
|
268
|
+
acl_permission_type="Allow")
|
269
|
+
```
|
270
|
+
|
271
|
+
### Prefix-Based Access Control
|
272
|
+
|
273
|
+
```python
|
274
|
+
import pulumi
|
275
|
+
import pulumi_kafka as kafka
|
276
|
+
|
277
|
+
# Grant access to all topics with prefix "logs-"
|
278
|
+
logs_access = kafka.Acl("logs_access",
|
279
|
+
acl_resource_name="logs-",
|
280
|
+
acl_resource_type="Topic",
|
281
|
+
resource_pattern_type_filter="Prefixed",
|
282
|
+
acl_principal="User:log-aggregator",
|
283
|
+
acl_host="*",
|
284
|
+
acl_operation="Read",
|
285
|
+
acl_permission_type="Allow")
|
286
|
+
```
|
287
|
+
|
288
|
+
### Admin User with Full Access
|
289
|
+
|
290
|
+
```python
|
291
|
+
import pulumi
|
292
|
+
import pulumi_kafka as kafka
|
293
|
+
|
294
|
+
# Grant cluster-level admin access
|
295
|
+
admin_cluster = kafka.Acl("admin_cluster",
|
296
|
+
acl_resource_name="kafka-cluster",
|
297
|
+
acl_resource_type="Cluster",
|
298
|
+
acl_principal="User:admin",
|
299
|
+
acl_host="*",
|
300
|
+
acl_operation="All",
|
301
|
+
acl_permission_type="Allow")
|
302
|
+
```
|
303
|
+
|
304
|
+
## Common ACL Patterns
|
305
|
+
|
306
|
+
### Producer ACLs
|
307
|
+
Producers typically need:
|
308
|
+
- `Write` and `Describe` on topics
|
309
|
+
- `Write` on `TransactionalID` (for transactional producers)
|
310
|
+
- `IdempotentWrite` on `Cluster` (for idempotent producers)
|
311
|
+
|
312
|
+
### Consumer ACLs
|
313
|
+
Consumers typically need:
|
314
|
+
- `Read` on topics
|
315
|
+
- `Read` on consumer groups
|
316
|
+
- `Describe` on topics (optional, for metadata)
|
317
|
+
|
318
|
+
### Admin ACLs
|
319
|
+
Administrators typically need:
|
320
|
+
- `All` on `Cluster`
|
321
|
+
- Or specific operations like `Alter`, `AlterConfigs`, `Create`, `Delete`
|
322
|
+
|
323
|
+
> **Warning:** Be cautious with `Deny` ACLs as they take precedence over `Allow` ACLs. A deny rule will block access even if an allow rule exists.
|
324
|
+
|
325
|
+
## Import
|
326
|
+
|
327
|
+
Kafka ACLs can be imported using a pipe-delimited string containing all ACL properties:
|
328
|
+
|
329
|
+
Format: ${acl_principal}|${acl_host}|${acl_operation}|${acl_permission_type}|${resource_type}|${resource_name}|${resource_pattern_type_filter}
|
330
|
+
|
331
|
+
```sh
|
332
|
+
$ pulumi import kafka:index/acl:Acl example 'User:producer|*|Write|Allow|Topic|orders|Literal'
|
333
|
+
```
|
334
|
+
|
222
335
|
:param str resource_name: The name of the resource.
|
223
336
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
224
|
-
:param pulumi.Input[
|
337
|
+
:param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
|
225
338
|
"""
|
226
339
|
...
|
227
340
|
@overload
|
@@ -230,7 +343,121 @@ class Acl(pulumi.CustomResource):
|
|
230
343
|
args: AclArgs,
|
231
344
|
opts: Optional[pulumi.ResourceOptions] = None):
|
232
345
|
"""
|
233
|
-
|
346
|
+
The `Acl` resource manages Apache Kafka Access Control Lists (ACLs). ACLs control access to Kafka resources like topics, consumer groups, and clusters by defining which principals (users or services) can perform specific operations on these resources.
|
347
|
+
|
348
|
+
## Example Usage
|
349
|
+
|
350
|
+
### Allow Producer Access to Topic
|
351
|
+
|
352
|
+
```python
|
353
|
+
import pulumi
|
354
|
+
import pulumi_kafka as kafka
|
355
|
+
|
356
|
+
producer = kafka.Acl("producer",
|
357
|
+
acl_resource_name="orders",
|
358
|
+
acl_resource_type="Topic",
|
359
|
+
acl_principal="User:producer-service",
|
360
|
+
acl_host="*",
|
361
|
+
acl_operation="Write",
|
362
|
+
acl_permission_type="Allow")
|
363
|
+
# Also grant describe permission for producers
|
364
|
+
producer_describe = kafka.Acl("producer_describe",
|
365
|
+
acl_resource_name="orders",
|
366
|
+
acl_resource_type="Topic",
|
367
|
+
acl_principal="User:producer-service",
|
368
|
+
acl_host="*",
|
369
|
+
acl_operation="Describe",
|
370
|
+
acl_permission_type="Allow")
|
371
|
+
```
|
372
|
+
|
373
|
+
### Allow Consumer Group Access
|
374
|
+
|
375
|
+
```python
|
376
|
+
import pulumi
|
377
|
+
import pulumi_kafka as kafka
|
378
|
+
|
379
|
+
# Allow read access to topic
|
380
|
+
consumer_read = kafka.Acl("consumer_read",
|
381
|
+
acl_resource_name="orders",
|
382
|
+
acl_resource_type="Topic",
|
383
|
+
acl_principal="User:consumer-service",
|
384
|
+
acl_host="*",
|
385
|
+
acl_operation="Read",
|
386
|
+
acl_permission_type="Allow")
|
387
|
+
# Allow access to consumer group
|
388
|
+
consumer_group = kafka.Acl("consumer_group",
|
389
|
+
acl_resource_name="order-processors",
|
390
|
+
acl_resource_type="Group",
|
391
|
+
acl_principal="User:consumer-service",
|
392
|
+
acl_host="*",
|
393
|
+
acl_operation="Read",
|
394
|
+
acl_permission_type="Allow")
|
395
|
+
```
|
396
|
+
|
397
|
+
### Prefix-Based Access Control
|
398
|
+
|
399
|
+
```python
|
400
|
+
import pulumi
|
401
|
+
import pulumi_kafka as kafka
|
402
|
+
|
403
|
+
# Grant access to all topics with prefix "logs-"
|
404
|
+
logs_access = kafka.Acl("logs_access",
|
405
|
+
acl_resource_name="logs-",
|
406
|
+
acl_resource_type="Topic",
|
407
|
+
resource_pattern_type_filter="Prefixed",
|
408
|
+
acl_principal="User:log-aggregator",
|
409
|
+
acl_host="*",
|
410
|
+
acl_operation="Read",
|
411
|
+
acl_permission_type="Allow")
|
412
|
+
```
|
413
|
+
|
414
|
+
### Admin User with Full Access
|
415
|
+
|
416
|
+
```python
|
417
|
+
import pulumi
|
418
|
+
import pulumi_kafka as kafka
|
419
|
+
|
420
|
+
# Grant cluster-level admin access
|
421
|
+
admin_cluster = kafka.Acl("admin_cluster",
|
422
|
+
acl_resource_name="kafka-cluster",
|
423
|
+
acl_resource_type="Cluster",
|
424
|
+
acl_principal="User:admin",
|
425
|
+
acl_host="*",
|
426
|
+
acl_operation="All",
|
427
|
+
acl_permission_type="Allow")
|
428
|
+
```
|
429
|
+
|
430
|
+
## Common ACL Patterns
|
431
|
+
|
432
|
+
### Producer ACLs
|
433
|
+
Producers typically need:
|
434
|
+
- `Write` and `Describe` on topics
|
435
|
+
- `Write` on `TransactionalID` (for transactional producers)
|
436
|
+
- `IdempotentWrite` on `Cluster` (for idempotent producers)
|
437
|
+
|
438
|
+
### Consumer ACLs
|
439
|
+
Consumers typically need:
|
440
|
+
- `Read` on topics
|
441
|
+
- `Read` on consumer groups
|
442
|
+
- `Describe` on topics (optional, for metadata)
|
443
|
+
|
444
|
+
### Admin ACLs
|
445
|
+
Administrators typically need:
|
446
|
+
- `All` on `Cluster`
|
447
|
+
- Or specific operations like `Alter`, `AlterConfigs`, `Create`, `Delete`
|
448
|
+
|
449
|
+
> **Warning:** Be cautious with `Deny` ACLs as they take precedence over `Allow` ACLs. A deny rule will block access even if an allow rule exists.
|
450
|
+
|
451
|
+
## Import
|
452
|
+
|
453
|
+
Kafka ACLs can be imported using a pipe-delimited string containing all ACL properties:
|
454
|
+
|
455
|
+
Format: ${acl_principal}|${acl_host}|${acl_operation}|${acl_permission_type}|${resource_type}|${resource_name}|${resource_pattern_type_filter}
|
456
|
+
|
457
|
+
```sh
|
458
|
+
$ pulumi import kafka:index/acl:Acl example 'User:producer|*|Write|Allow|Topic|orders|Literal'
|
459
|
+
```
|
460
|
+
|
234
461
|
:param str resource_name: The name of the resource.
|
235
462
|
:param AclArgs args: The arguments to use to populate this resource's properties.
|
236
463
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
@@ -246,13 +473,13 @@ class Acl(pulumi.CustomResource):
|
|
246
473
|
def _internal_init(__self__,
|
247
474
|
resource_name: str,
|
248
475
|
opts: Optional[pulumi.ResourceOptions] = None,
|
249
|
-
acl_host: Optional[pulumi.Input[
|
250
|
-
acl_operation: Optional[pulumi.Input[
|
251
|
-
acl_permission_type: Optional[pulumi.Input[
|
252
|
-
acl_principal: Optional[pulumi.Input[
|
253
|
-
acl_resource_name: Optional[pulumi.Input[
|
254
|
-
acl_resource_type: Optional[pulumi.Input[
|
255
|
-
resource_pattern_type_filter: Optional[pulumi.Input[
|
476
|
+
acl_host: Optional[pulumi.Input[_builtins.str]] = None,
|
477
|
+
acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
|
478
|
+
acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
|
479
|
+
acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
|
480
|
+
acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
|
481
|
+
acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
|
482
|
+
resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None,
|
256
483
|
__props__=None):
|
257
484
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
258
485
|
if not isinstance(opts, pulumi.ResourceOptions):
|
@@ -291,13 +518,13 @@ class Acl(pulumi.CustomResource):
|
|
291
518
|
def get(resource_name: str,
|
292
519
|
id: pulumi.Input[str],
|
293
520
|
opts: Optional[pulumi.ResourceOptions] = None,
|
294
|
-
acl_host: Optional[pulumi.Input[
|
295
|
-
acl_operation: Optional[pulumi.Input[
|
296
|
-
acl_permission_type: Optional[pulumi.Input[
|
297
|
-
acl_principal: Optional[pulumi.Input[
|
298
|
-
acl_resource_name: Optional[pulumi.Input[
|
299
|
-
acl_resource_type: Optional[pulumi.Input[
|
300
|
-
resource_pattern_type_filter: Optional[pulumi.Input[
|
521
|
+
acl_host: Optional[pulumi.Input[_builtins.str]] = None,
|
522
|
+
acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
|
523
|
+
acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
|
524
|
+
acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
|
525
|
+
acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
|
526
|
+
acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
|
527
|
+
resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None) -> 'Acl':
|
301
528
|
"""
|
302
529
|
Get an existing Acl resource's state with the given name, id, and optional extra
|
303
530
|
properties used to qualify the lookup.
|
@@ -305,7 +532,7 @@ class Acl(pulumi.CustomResource):
|
|
305
532
|
:param str resource_name: The unique name of the resulting resource.
|
306
533
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
307
534
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
308
|
-
:param pulumi.Input[
|
535
|
+
:param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
|
309
536
|
"""
|
310
537
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
311
538
|
|
@@ -320,41 +547,41 @@ class Acl(pulumi.CustomResource):
|
|
320
547
|
__props__.__dict__["resource_pattern_type_filter"] = resource_pattern_type_filter
|
321
548
|
return Acl(resource_name, opts=opts, __props__=__props__)
|
322
549
|
|
323
|
-
@property
|
550
|
+
@_builtins.property
|
324
551
|
@pulumi.getter(name="aclHost")
|
325
|
-
def acl_host(self) -> pulumi.Output[
|
552
|
+
def acl_host(self) -> pulumi.Output[_builtins.str]:
|
326
553
|
return pulumi.get(self, "acl_host")
|
327
554
|
|
328
|
-
@property
|
555
|
+
@_builtins.property
|
329
556
|
@pulumi.getter(name="aclOperation")
|
330
|
-
def acl_operation(self) -> pulumi.Output[
|
557
|
+
def acl_operation(self) -> pulumi.Output[_builtins.str]:
|
331
558
|
return pulumi.get(self, "acl_operation")
|
332
559
|
|
333
|
-
@property
|
560
|
+
@_builtins.property
|
334
561
|
@pulumi.getter(name="aclPermissionType")
|
335
|
-
def acl_permission_type(self) -> pulumi.Output[
|
562
|
+
def acl_permission_type(self) -> pulumi.Output[_builtins.str]:
|
336
563
|
return pulumi.get(self, "acl_permission_type")
|
337
564
|
|
338
|
-
@property
|
565
|
+
@_builtins.property
|
339
566
|
@pulumi.getter(name="aclPrincipal")
|
340
|
-
def acl_principal(self) -> pulumi.Output[
|
567
|
+
def acl_principal(self) -> pulumi.Output[_builtins.str]:
|
341
568
|
return pulumi.get(self, "acl_principal")
|
342
569
|
|
343
|
-
@property
|
570
|
+
@_builtins.property
|
344
571
|
@pulumi.getter(name="aclResourceName")
|
345
|
-
def acl_resource_name(self) -> pulumi.Output[
|
572
|
+
def acl_resource_name(self) -> pulumi.Output[_builtins.str]:
|
346
573
|
"""
|
347
574
|
The name of the resource
|
348
575
|
"""
|
349
576
|
return pulumi.get(self, "acl_resource_name")
|
350
577
|
|
351
|
-
@property
|
578
|
+
@_builtins.property
|
352
579
|
@pulumi.getter(name="aclResourceType")
|
353
|
-
def acl_resource_type(self) -> pulumi.Output[
|
580
|
+
def acl_resource_type(self) -> pulumi.Output[_builtins.str]:
|
354
581
|
return pulumi.get(self, "acl_resource_type")
|
355
582
|
|
356
|
-
@property
|
583
|
+
@_builtins.property
|
357
584
|
@pulumi.getter(name="resourcePatternTypeFilter")
|
358
|
-
def resource_pattern_type_filter(self) -> pulumi.Output[Optional[
|
585
|
+
def resource_pattern_type_filter(self) -> pulumi.Output[Optional[_builtins.str]]:
|
359
586
|
return pulumi.get(self, "resource_pattern_type_filter")
|
360
587
|
|
pulumi_kafka/config/__init__.py
CHANGED
pulumi_kafka/config/__init__.pyi
CHANGED
@@ -2,8 +2,7 @@
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
4
4
|
|
5
|
-
import builtins
|
6
|
-
import copy
|
5
|
+
import builtins as _builtins
|
7
6
|
import warnings
|
8
7
|
import sys
|
9
8
|
import pulumi
|