gcloud beta managed-kafka acls create - create a Managed Service for Apache Kafka acl

gcloud beta managed-kafka acls create(ACL :--cluster=CLUSTER--location=LOCATION)(--acl-entries-from-file=PATH_TO_FILE    |--acl-entry=[host=HOST],[operation=OPERATION],[permission-type=PERMISSION-TYPE],[principal=PRINCIPAL])[GCLOUD_WIDE_FLAG …]

gcloudbetamanaged-kafkaaclscreatecluster--cluster=mycluster--location=us-central1--acl-entry=principal='User:admin@project.iam.gserviceaccount.com',operation=ALL,permission-type=ALLOW,host='*'--acl-entry=principal='User:reader@project.iam.gserviceaccount.com',operation=DESCRIBE,permission-type=ALLOW,host='*'--acl-entry=principal='User:reader@project.iam.gserviceaccount.com',operation=DESCRIBE_CONFIGS,permission-type=ALLOW,host='*'

This acl grants an "admin" service account access to ALL cluster-leveloperations, and grants a "reader" service account access to cluster-levelDESCRIBE and DESCRIBE_CONFIGS operations.

Acl resource - Identifies the name of the acl that this command creates.

The structure of the acl ID defines the Resource Pattern for which the aclentries apply in the Kafka cluster. The acl ID must be structured like one ofthe following:

Foraclsonthecluster:cluster

Foraclsonasingleresourcewithinthecluster:topic/{resource_name}consumerGroup/{resource_name}transactionalId/{resource_name}

Foraclsonallresourcesthatmatchaprefix:topicPrefixed/{resource_name}consumerGroupPrefixed/{resource_name}transactionalIdPrefixed/{resource_name}

Foraclsonallresourcesofagiventype(i.e.thewildcardliteral"*"):allTopics(representstopic/*)allConsumerGroups(representsconsumerGroup/*)allTransactionalIds(representstransactionalId/*)Theargumentsinthisgroupcanbeusedtospecifytheattributesofthisresource.(NOTE)Someattributesarenotgivenargumentsinthisgroupbutcanbesetinotherways.

To set theproject attribute:

• provide the argumentacl on the command line with a fully specifiedname;
• provide the argument--project on the command line;
• set the propertycore/project.

This must be specified.

ACL

ID of the acl or fully qualified identifier for the acl.

To set theacl attribute:

• provide the argumentacl on the command line.

This positional argument must be specified if any of the other arguments in thisgroup are specified.

--cluster=CLUSTER

The cluster name.To set thecluster attribute:

• provide the argumentacl on the command line with a fully specifiedname;
• provide the argument--cluster on the command line.

--location=LOCATION

ID of the location of the Managed Service for Apache Kafka resource. Seehttps://cloud.google.com/managed-service-for-apache-kafka/docs/locationsfor a list of supported locations.To set thelocation attribute:

• provide the argumentacl on the command line with a fully specifiedname;
• provide the argument--location on the command line.

Exactly one of these must be specified:

--acl-entries-from-file=PATH_TO_FILE

Path to a JSON or YAML file containing the acl entries to use in the acl. Use afull or relative path to a local file containing the value of acl_entries.

--acl-entry=[host=HOST],[operation=OPERATION],[permission-type=PERMISSION-TYPE],[principal=PRINCIPAL]

An acl entry that configures access for a principal, for a specific operation onthe acl's resource pattern. This flag can be repeated.

PRINCIPAL is the principal. Specified asGoogle Cloud account, with the Kafka StandardAuthorizer prefix "User:". Forexample: "User:admin@project.iam.gserviceaccount.com". Can be the wildcard"User:*" to refer to all users.

OPERATION is the operation type. Allowedvalues are: ALL, READ, WRITE, CREATE, DELETE, ALTER, DESCRIBE, CLUSTER_ACTION,DESCRIBE_CONFIGS, ALTER_CONFIGS, IDEMPOTENT_WRITE.

PERMISSION-TYPE is the permission type.Allowed values are: ALLOW, DENY.

HOST is the host. Must be set to"*" for Managed Service for Apache Kafka.

Example acl-entry:"principal=User:admin@project.iam.gserviceaccount.com,operation=ALL,permission-type=ALLOW,host=*"

Run$gcloud help for details.