Skip to content

Add Confluent Platform RBAC guidance to Kafka ACL setup #38664

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
piochelepiotr wants to merge 2 commits into
base: master
Choose a base branch
from
Draft

Add Confluent Platform RBAC guidance to Kafka ACL setup #38664

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cd9c377
Add Confluent Platform RBAC role bindings alongside ACL permissions f…
piochelepiotr Jul 31, 2026
bdccc47
Trim RBAC guidance to the role/scope table
piochelepiotr Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 20 additions & 1 deletion content/en/data_streams/kafka/setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,9 @@ Datadog Agent version 7.78 or later is required.

### ACL permissions

{{< tabs >}}
{{% tab "ACLs" %}}

If your Kafka cluster uses ACLs, the Datadog Agent user requires the following minimum permissions:

| Resource Name | Resource Type | Operation |
Expand All @@ -23,6 +26,20 @@ If your Kafka cluster uses ACLs, the Datadog Agent user requires the following m
| `*` | `TOPIC` | `DescribeConfigs` |
| `*` | `GROUP` | `Describe` |

{{% /tab %}}
{{% tab "Confluent Platform roles" %}}

If your Confluent Platform cluster uses RBAC instead of native ACLs, grant the Datadog Agent's principal the following role bindings:

| Role | Resource scope |
|-----------------|----------------------|
| `Operator` | `Cluster` (the Kafka cluster) |
| `DeveloperRead` | All topics |
| `DeveloperRead` | All consumer groups |

{{% /tab %}}
{{< /tabs >}}

## Setup

Go to the [Kafka Monitoring setup page][1] and click {{< ui >}}Get Started{{< / ui >}}. Then choose your environment and follow the instructions. To request assistance, choose {{< ui >}}Request a pairing session{{< /ui >}}.
Expand All @@ -37,7 +54,9 @@ This section applies only if you want to view Kafka message payloads in the {{<

### Additional ACL permission

In addition to the ACL permissions listed in [Prerequisites](#acl-permissions), the Datadog Agent user requires:
If your cluster uses Confluent Platform RBAC, no additional role binding is needed: the `DeveloperRead` role from [Prerequisites](#acl-permissions) already includes `Read` on the scoped topics.

If your cluster uses native ACLs, in addition to the permissions listed in [Prerequisites](#acl-permissions), the Datadog Agent user requires:

| Resource Name | Resource Type | Operation |
|---------------|---------------|-----------|
Expand Down
Loading