Connector ACL GUI Guide

Purpose

The purpose of this guide describes the temporary GUI configuration that is required, in order to make connectors work securely at scale.

The configuration is required whenever an end user requests a service account and specifies that it is to be used in a connector or if a user requests an existing account to be also used with a connector.

Prerequisites

You must have a 'Kafka as a Service : KaaS Administrator' role, in order to configure RBAC on connectors in the UI.

If a service account already exists and the user just wants to update it, then skip prerequisites.

Additionally these steps should have been done by the requestor before reaching out to the platform team: 1. stakeholder initiates request for service accounts, stating it is to be used for a connector

1. Operations Team notifies Service Manager and Build Team that the request has come in

2. The Platform Support Team fulfills the service request by adding the service account configuration to the access-mgmgt-config-prod folder (branch and PR referencing RITM), with below configuration in the kafka-clients folder.

- serviceAccountName:   "<value>"
  serviceAccountDescription: "Kafka Connector service account"
  adGroupOwners:
    - group: "KaaS_<namespace>_Developer"
       environments: ["Development_eu1", "Test_eu1"]
    - group: "KaaS_<namespace>_Operator_ADM"   # wildcard ⇒ all envs
       environments: ["*"]
  roleAssignments:
    - namespace:       "<value>"
       roleAssignment:  "<value - example sa-kafka-client-producer>"
       singularTopic:   False

If needed after running the pipeline, reach out to the requester and engage to capture name and type, reminding that it must be created with the correct Service Account as credential owner.

1. The team configures their required Connectors.

Guide on ACLs

A Platform administrator should perform one of the 2 options listed below:

Confluent will list the needed ACLs for each connector; we have 2 options to add these permissions:

1) Platform Administrator goes to the Settings tab of the connector, and clicks "Edit" under the Kafka Credentials section. Then, you check the box "Add all required ACLs" and click Save/apply changes.

WARNING: Before you do this, click View ACLS and ensure the topic access being added matches the namespace prefix of the connector name.

2) If option 1 is not possible for some reason, then the Platform Administrator can check the Logical ID for the connector and note the required accesses (Tip: simulate creating it, to see what permissions are required. Kafka-cluster DESCRIBE is generally not necessary to add).

Simply add the equivalent RBAC instead, to match; for example READ ACL on a topic, we add "DeveloperRead" RBAC. For READ and WRITE on a topic, we add the same 3 RBAC permissions as we would do for a namespace topic: DeveloperRead, DeveloperWrite, DeveloperManage. This is to support doing this on the UI to make it quick to add these configurations, since ACLs cannot be added directly from the UI.

Configure the access on the service account from the 'accounts & access' menu. Remember to do it for service accounts across environments.

ACL config

Remember to update the Excel on Teams to reflect which connectors have been manually helped with ACLs.