How to grant a user to access more resource?

[barryzhounb]

Suppose I have the following user definition: my-user-1 has permission to access my-topic-1 and my-group-1.

apiVersion: kafka.strimzi.io/v1beta1
kind: KafkaUser
metadata:
  labels:
    strimzi.io/cluster: my-cluster
  name: my-user-1
spec:
  authentication:
    type: tls
  authorization:
    acls:
      - host: '*'
        operation: All
        resource:
          name: my-topic-1
          patternType: literal
          type: topic
        type: allow
      - host: '*'
        operation: All
        resource:
          name: my-group-1
          patternType: literal
          type: group
        type: allow
      - host: '*'
        operation: All
        resource:
          type: cluster
        type: allow
    type: simple

Now I want to grant my-user-1 to access one more topic and one group. Could I change it as

name: my-topic-1, my-topic-2

name: my-group-1, my-group-2

Does it work for this change?

[scholzj]

No, you have to add the whole block multiple times:

apiVersion: kafka.strimzi.io/v1beta2
kind: KafkaUser
metadata:
  labels:
    strimzi.io/cluster: my-cluster
  name: my-user-1
spec:
  authentication:
    type: tls
  authorization:
    acls:
      - host: '*'
        operation: All
        resource:
          name: my-topic-1
          patternType: literal
          type: topic
        type: allow
      - host: '*'
        operation: All
        resource:
          name: my-topic-2
          patternType: literal
          type: topic
        type: allow
      - host: '*'
        operation: All
        resource:
          name: my-group-1
          patternType: literal
          type: group
        type: allow
      - host: '*'
        operation: All
        resource:
          name: my-group-2
          patternType: literal
          type: group
        type: allow
      - host: '*'
        operation: All
        resource:
          type: cluster
        type: allow
    type: simple

Or you can also use the patternType: prefix and set it to my-topic and my-group. But that would of course also give access to for example my-topic-5.

[barryzhounb]

Great, thank you.