From cd9c377d1f2c26fbf831102855f20283ed1c457e Mon Sep 17 00:00:00 2001 From: Piotr Wolski Date: Fri, 31 Jul 2026 13:48:56 -0600 Subject: [PATCH 1/2] Add Confluent Platform RBAC role bindings alongside ACL permissions for Kafka setup Customers running self-hosted Confluent Platform with RBAC instead of native Kafka ACLs had no guidance on which role bindings the Datadog Agent principal needs. --- content/en/data_streams/kafka/setup.md | 47 +++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-) diff --git a/content/en/data_streams/kafka/setup.md b/content/en/data_streams/kafka/setup.md index 367e1a710f3..950bc0d5242 100644 --- a/content/en/data_streams/kafka/setup.md +++ b/content/en/data_streams/kafka/setup.md @@ -13,6 +13,11 @@ Datadog Agent version 7.78 or later is required. ### ACL permissions +The Datadog Agent needs read-only, describe-level access to your cluster's topics, consumer groups, and cluster metadata. How you grant this depends on whether your cluster authorizes with native Kafka ACLs or with Confluent Platform's role-based access control (RBAC). + +{{< tabs >}} +{{% tab "ACLs" %}} + If your Kafka cluster uses ACLs, the Datadog Agent user requires the following minimum permissions: | Resource Name | Resource Type | Operation | @@ -23,6 +28,44 @@ If your Kafka cluster uses ACLs, the Datadog Agent user requires the following m | `*` | `TOPIC` | `DescribeConfigs` | | `*` | `GROUP` | `Describe` | +{{% /tab %}} +{{% tab "Confluent Platform roles" %}} + +If your Confluent Platform cluster uses RBAC instead of native ACLs, grant the Datadog Agent's principal the following role bindings: + +| Role | Resource scope | +|-----------------|------------------------------------------| +| `Operator` | `Cluster` (the Kafka cluster) | +| `DeveloperRead` | `Topic` (the topics you want to monitor) | +| `DeveloperRead` | `Group` (the consumer groups you want to monitor) | + +`Operator` on the `Cluster` resource covers cluster-level `Describe`/`DescribeConfigs`. `DeveloperRead` covers `Describe` on the scoped topics and consumer groups; it also grants `Read`, which is broader than what the Agent uses but is the narrowest predefined role available for this access. + +Create these role bindings with the Confluent CLI, for example: + +```shell +confluent iam rbac role-binding create \ + --principal User: \ + --role Operator \ + --resource Cluster:kafka-cluster \ + --kafka-cluster + +confluent iam rbac role-binding create \ + --principal User: \ + --role DeveloperRead \ + --resource Topic: \ + --kafka-cluster + +confluent iam rbac role-binding create \ + --principal User: \ + --role DeveloperRead \ + --resource Group: \ + --kafka-cluster +``` + +{{% /tab %}} +{{< /tabs >}} + ## Setup Go to the [Kafka Monitoring setup page][1] and click {{< ui >}}Get Started{{< / ui >}}. Then choose your environment and follow the instructions. To request assistance, choose {{< ui >}}Request a pairing session{{< /ui >}}. @@ -37,7 +80,9 @@ This section applies only if you want to view Kafka message payloads in the {{< ### Additional ACL permission -In addition to the ACL permissions listed in [Prerequisites](#acl-permissions), the Datadog Agent user requires: +If your cluster uses Confluent Platform RBAC, no additional role binding is needed: the `DeveloperRead` role from [Prerequisites](#acl-permissions) already includes `Read` on the scoped topics. + +If your cluster uses native ACLs, in addition to the permissions listed in [Prerequisites](#acl-permissions), the Datadog Agent user requires: | Resource Name | Resource Type | Operation | |---------------|---------------|-----------| From bdccc47c89fce0e0deb8f39db9cc8738d4fdd3cf Mon Sep 17 00:00:00 2001 From: Piotr Wolski Date: Fri, 31 Jul 2026 14:22:20 -0600 Subject: [PATCH 2/2] Trim RBAC guidance to the role/scope table Remove the CLI example and rationale prose per feedback; scope DeveloperRead to all topics/groups instead of naming specific resources. --- content/en/data_streams/kafka/setup.md | 36 ++++---------------------- 1 file changed, 5 insertions(+), 31 deletions(-) diff --git a/content/en/data_streams/kafka/setup.md b/content/en/data_streams/kafka/setup.md index 950bc0d5242..a75b3a51b44 100644 --- a/content/en/data_streams/kafka/setup.md +++ b/content/en/data_streams/kafka/setup.md @@ -13,8 +13,6 @@ Datadog Agent version 7.78 or later is required. ### ACL permissions -The Datadog Agent needs read-only, describe-level access to your cluster's topics, consumer groups, and cluster metadata. How you grant this depends on whether your cluster authorizes with native Kafka ACLs or with Confluent Platform's role-based access control (RBAC). - {{< tabs >}} {{% tab "ACLs" %}} @@ -33,35 +31,11 @@ If your Kafka cluster uses ACLs, the Datadog Agent user requires the following m If your Confluent Platform cluster uses RBAC instead of native ACLs, grant the Datadog Agent's principal the following role bindings: -| Role | Resource scope | -|-----------------|------------------------------------------| -| `Operator` | `Cluster` (the Kafka cluster) | -| `DeveloperRead` | `Topic` (the topics you want to monitor) | -| `DeveloperRead` | `Group` (the consumer groups you want to monitor) | - -`Operator` on the `Cluster` resource covers cluster-level `Describe`/`DescribeConfigs`. `DeveloperRead` covers `Describe` on the scoped topics and consumer groups; it also grants `Read`, which is broader than what the Agent uses but is the narrowest predefined role available for this access. - -Create these role bindings with the Confluent CLI, for example: - -```shell -confluent iam rbac role-binding create \ - --principal User: \ - --role Operator \ - --resource Cluster:kafka-cluster \ - --kafka-cluster - -confluent iam rbac role-binding create \ - --principal User: \ - --role DeveloperRead \ - --resource Topic: \ - --kafka-cluster - -confluent iam rbac role-binding create \ - --principal User: \ - --role DeveloperRead \ - --resource Group: \ - --kafka-cluster -``` +| Role | Resource scope | +|-----------------|----------------------| +| `Operator` | `Cluster` (the Kafka cluster) | +| `DeveloperRead` | All topics | +| `DeveloperRead` | All consumer groups | {{% /tab %}} {{< /tabs >}}