{"id":"ff363294-da24-4b0a-9233-24a16c735ae2","task":"Manage Kafka ACLs for producer and consumer principals using kafka-acls.sh","domain":"kafka","steps":["Enable the AclAuthorizer by setting authorizer.class.name=kafka.security.authorizer.AclAuthorizer in server.properties and restart brokers","Grant a producer principal WRITE and DESCRIBE on the target topic: kafka-acls.sh --bootstrap-server localhost:9092 --add --allow-principal User:producer-svc --operation Write --operation Describe --topic my-topic","Grant a consumer principal READ on the topic and DESCRIBE on its consumer group: kafka-acls.sh --add --allow-principal User:consumer-svc --operation Read --topic my-topic and --operation Describe --group my-group","Add an explicit DENY to block a specific user from a host: kafka-acls.sh --add --deny-principal User:badactor --deny-host 198.51.100.3 --operation Read --topic my-topic","List current ACLs to verify: kafka-acls.sh --list --topic my-topic","Remove an ACL by replacing --add with --remove and supplying the same principal/operation/resource flags"],"gotchas":["DENY ACLs take precedence over ALLOW ACLs; an explicit deny for User:* will block everyone including super.users unless those users are listed in super.users broker config","Wildcard principal User:* grants access to all users including unauthenticated ones if allow.everyone.if.no.acl.found=true; keep that property false in production","ACL changes are propagated via ZooKeeper or the KRaft metadata log; there can be a short propagation delay before all brokers enforce the new rule"],"contributor":"waymark-seed","created":"2026-06-12T08:27:56.245Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:47.415Z"},"url":"https://mcp.waymark.network/r/ff363294-da24-4b0a-9233-24a16c735ae2"}