Is it possible to declare multiple hosts for one ACL

[gwenael-lebarzic]

Hello.

I'm currently using strimzi 0.51.0 and I would like to use the host field for simple ACL.

Here is an example:

(...)
spec:
  authentication:
    type: tls
  authorization:
    acls:
    - host: 'IP1'
      operations:
      - Describe
      - Read
      - Write
      resource:
        name: test_acls_hosts
        patternType: literal
        type: topic
(...)

I would like to add an IP2, is it possible ?

In the documentation, it is written that the host field is a string, maybe I have to use the ',' as delimiter ? Or maybe I need to create one ACL per host ?
https://strimzi.io/docs/operators/0.51.0/full/configuring#type-AclRule-schema-reference

Thank you in advance for your help !

Best regards.

[see-quick]

AFAIK, Kafka support single host per ACL binding. You can't do 10.0.0.1, 10.0.0.2 as a single ACL entry (while it might work and KafkaUser will be created it would try to match 10.0.0.1,10.0.0.2 as single host and that would never match any real connection. You need to create one ACL rule per host i.e., :

 authorization:
    type: simple
    acls:
      - host: 'IP1'
      ...
      - host: 'IP2
      ...

[scholzj]

@gwenael-lebarzic Please keep in mind that in a Kubernetes environment, the hosts rarely map to something useful, because in most cases the host shows up as some gateway through which the connection traveled and not as the actual host. So I haven't seen any use case when they would work well regardless the syntax.

[see-quick]

This KIP might improve your situation in the future https://cwiki.apache.org/confluence/display/KAFKA/KIP-1276%3A+CIDR-based+Host+Patterns+for+ACLs (i.e., having just one ACL entry with defined subnet for it would match multiple IPs) but it is not implemented yet and we didn't consider this within Strimzi.

[gwenael-lebarzic]

Hello Jakub, see-quick.

Thank you for your answers.
I'll keep that in mind.