November 2022
Beginner to intermediate
346 pages
11h
Chinese
Content preview from Kafka权威指南（第2版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
保护
Kafka
｜
219
➋
用主体
Role:Operator
和自定义主体类型
Role
创建一个
ACL
，将其应用于具有
Operator
角色的用户。
11.5.3
安全方面的考虑
因为
AclAuthorizer
将
ACL
保存在
ZooKeeper
中，所以要对
ZooKeeper
的访问进行安全限
制。如果集群中没有安全的
ZooKeeper
，则可以实现一个自定义授权器，将
ACL
保存在安
全的外部数据库中。
在拥有大量用户的大型组织中
，管理单个资源的
ACL
可能会非常烦琐。可以为不同的部门
预留不同的资源前缀
，这样就可以使用前缀
ACL
，以此来减少
ACL
的数量。还可以结合使
用基于组或角色的
ACL
（如前面的例子所示），以进一步简化大型组织的访问控制配置。
当用户受到攻击时，基于最小权限原则来限制用户访问可以降低暴露风险。也就是说，我
们只为每个用户主体授予执行其操作所需的资源的访问权限
，并在
ACL
使用完毕之后将
其移除。当用户主体不再被使用（例如，当一个员工离开组织）时，应该立即移除对应
的
ACL
。对于长时间运行的应用程序，可以使用服务凭证（而不是与特定用户关联的凭
证）
，以避免员工离开组织时出现任何中断。由于一个用户主体的长寿命连接有可能在用
户被删除之后继续处理请求，因此可以用
Deny
ACL
来确保主体不会因通配符
ACL
而无
意中被授予了访问权限。如果可能，要避免重用主体，防止将访问权限授予与旧版本主体
关联的连接。
11.6
审计
broker
可以生成用于审计和调试的
log4j
日志。可以在
log4j.properties
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.