ACL for Aiven Schema Registry
The SchemaRegistryAclEntry resources are used to manage the Access Control Lists in Aiven for Schema Registry. A
SchemaRegistryAclEntry resource defines the permission to be granted to a user for one or more Schema Registry
Subjects.
SchemaRegistryAclEntry
Specification
Here is the resource definition file for defining a SchemaRegistryAclEntry.
---
apiVersion: "kafka.aiven.io/v1beta1" # The api version (required)
kind: "SchemaRegistryAclEntry" # The resource kind (required)
metadata:
labels: { }
annotations: { }
spec:
permission: <> # The permission. Accepted values are: READ, WRITE
username: <> # The username
resource: <> # The Schema Registry ACL entry resource name pattern
NOTE: The resource name pattern should be Config: or Subject:<subject_name> where subject_name must consist of
alpha-numeric characters, underscores, dashes, dots and glob characters * and ?.
Example
Here is an example that shows how to define a simple ACL entry using
the SchemaRegistryAclEntry resource type.
file: schema-registry-acl-entry.yaml
---
apiVersion: "kafka.aiven.io/v1beta1"
kind: "SchemaRegistryAclEntry"
spec:
permission: "READ"
username: "Alice"
resource: "Subject:*"
SchemaRegistryAclEntryList
If you need to define multiple ACL entries (e.g. using a template), it may be easier to use
a SchemaRegistryAclEntryList resource.
Specification
Here the resource definition file for defining a SchemaRegistryAclEntryList.
---
apiVersion: "kafka.aiven.io/v1beta1" # The api version (required)
kind: "SchemaRegistryAclEntryList" # The resource kind (required)
metadata: # (optional)
labels: { }
annotations: { }
items: [ ] # An array of SchemaRegistryAclEntry
Example
Here is a simple example that shows how to define a single YAML file containing two ACL entry definitions using
the SchemaRegistryAclEntryList resource type.
---
apiVersion: "kafka.aiven.io/v1beta1"
kind: "SchemaRegistryAclEntryList"
items:
- spec:
permission: "READ"
username: "alice"
resource: "Config:"
- spec:
permission: "WRITE"
username: "alice"
resource: "Subject:*"