Question Regarding Show/Hide Clusters and Specific Topics

[BrendanMS-MT]

We have two clusters that are connected to AKHQ using one UI, I would like to know if there is the possibility of showing specific Clusters depending on Roles (Example Topic-Reader just seeing Cluster1).

Additionally, is there a way to hide specific topics, perhaps via regex to specific roles?

Thanks in advance.

[AlexisSouquiere]

Yes for both of your questions. You can check here:https://akhq.io/docs/configuration/authentifications/groups.html

The groups definition allows you to define a mapping between roles, patterns (regex for topic names, subjects names, consumer groups, etc. - all the different resources types managed in AKHQ) and clusters.

You will find some examples here

[BrendanMS-MT]

Good Morning @AlexisSouquiere thank you for your reply! I have a follow-up question, so this is our configuration:

    security:
      default-group: no-roles # Default groups for all the user even unlogged user
      # Groups definition
      groups:
        admin: # unique key
          name: admin # Group name
          roles:  # roles for the group
            - topic/read
            - topic/insert
            - topic/delete
            - topic/config/update
            - node/read
            - node/config/update
            - topic/data/read
            - topic/data/insert
            - topic/data/delete
            - group/read
            - group/delete
            - group/offsets/update
            - registry/read
            - registry/insert
            - registry/update
            - registry/delete
            - registry/version/delete
            - acls/read
            - connect/read
            - connect/insert
            - connect/update
            - connect/delete
            - connect/state/update
        topic-reader: # unique key
          name: topic-reader # Group name
          roles:  # roles for the group
            - topic/read
            - topic/data/read
            - node/read
            - registry/read
            - group/read
            - acls/read
            - connect/read
          attributes:
            topics-filter-regexp: "^(?!.*cdc).*"
        consumer-group-editor:
          name: consumer-group-editor # Group name
          roles:  # roles for the group
            - topic/read
            - topic/data/read
            - node/read
            - registry/read
            - group/read
            - group/delete
            - group/offsets/update
            - acls/read
            - connect/read

As you can see for the topic-reader I've applied a regEx topic filter, that will basically NOT show anything that has 'cdc' in the topic name. This works, however, since I am a member of each group, I still get effected by this.

With regards to the clusters - this is how I tried to implement it:

        consumer-group-editor:
          name: consumer-group-editor # Group name
          clusters:
            - "kafka-int-servers"
          roles:  # roles for the group
            - topic/read
            - topic/data/read

where in my connections configuration I have the following:
kafka-int-servers and kafka-edge-servers

[AlexisSouquiere]

I think you are using a version <= 0.23.0 which only proposed a partial RBAC implementation. Try with the latest version and update the groups / roles accordingly

[AlexisSouquiere]

Sorry I wanted to say <= 0.24.0. The new RBAC implementation was released in 0.25.0

[BrendanMS-MT]

In 0.25.0, lets say a member is part of each group, will the highest group take over? I.E. Will it fix my current situation?

[AlexisSouquiere]

With 0.25+ you will have to rewrite the groups definition. Adding topic-related permissions in a consumer groups group without any restrictions makes no sense. Permissions will be fine-grained for each resource types

[BrendanMS-MT]

And one final question, lets say we have to stick with the current version, if I had to have a user being ONLY in 1 group, in this case the 'admin' group, that user will not be effected with the attribute filter correct? As long as each user is only part of one group.

Thank you for all the help!

[AlexisSouquiere]

Yes, correct. Filters are applied only to the group on which it's defined