Kvindo™ Cloud Docs
A Kafka User is a SCRAM principal inside a specific Kafka Cluster. It is the only credential mechanism for that cluster — the cluster resource itself has no user-facing password — so a Kafka User is how you hand out scoped, revocable credentials to an application or team.
• Belongs to one cluster forever — spec.kafkaId is required and immutable; a user cannot move between clusters
• Role-based grants, not raw ACL tuples — a grant says "produce to orders" and the platform expands it into the operations Kafka actually needs (Write + Describe, or Read + Describe). Exposing raw operations would let you build a grant that authenticates but cannot fetch metadata, which then fails at runtime with an error that points nowhere useful
• A Consumer grant requires group access — if any grant has role: Consumer and consumerGroupPrefixes is empty, the request is rejected at submit time. A consumer that cannot access its group cannot commit offsets, so silently accepting it would only produce a confusing runtime failure
• Two pattern types — Literal matches exactly the topic name you wrote; Prefixed matches any topic starting with it, so orders- as a Prefixed pattern covers orders-eu and orders-us
• Enabled locks, it does not delete — spec.enabled: false overwrites the SCRAM credential with an unusable random password and keeps every ACL, so re-enabling is one write rather than a full re-grant
• Write-only password — spec.password is never echoed back. It must be re-sent on every whole-cluster re-dispatch, so an omitted password on a user that is being carried along by an unrelated topic change is an error rather than an implicit lock
• One opt-in ACL extra, plus cluster operations — topicGrants[].extraOperations adds DescribeConfigs to that one grant's own pattern (what a Schema Registry needs on its _schemas topic, and what an admin UI reads a topic's config with), and spec.clusterOperations adds cluster-level Describe or IdempotentWrite (what a read-only admin UI needs to show a broker overview). Neither can create or delete a topic — that stays with the Kafka Topic resource, and there is no cluster Create at all. AlterConfigs is deliberately not offered: it would let a client change a topic's config behind the Kafka Topic resource, which the console cannot show
| UI Name | API / kc name | Terraform name | Optional | Format | Default | Is read only | Description |
|---|---|---|---|---|---|---|---|
| Kafka cluster | spec.kafkaId |
spec.kafka_id |
No | ULID — references a Kafka cluster | — | No | Immutable after creation |
| Password | spec.password |
spec.password |
Yes | string (sensitive, write-only) | — | No | Never returned on read. Required whenever the user is part of a dispatched cluster change request — send it again on any modify that reaches this user |
| Enabled | spec.enabled |
spec.enabled |
Yes | boolean | true |
No | Whether the user can authenticate; disabling locks the credential and keeps ACL grants intact |
| Topic grants | spec.topicGrants |
spec.topic_grants |
Yes | list of objects | [] (no topic access) | No | Producer or Consumer only — there is no Admin/Administer role in this release |
| Topic pattern | topicGrants[].topicPattern |
topicGrants[].topicPattern |
Yes | string ≤249 | — | No | The name (Literal) or prefix (Prefixed, e.g. orders-) being granted |
| Pattern type | topicGrants[].patternType |
topicGrants[].patternType |
Yes | one of Literal, Prefixed |
Literal |
No | Mirrors Kafka's own resource-pattern-type |
| Role | topicGrants[].role |
topicGrants[].role |
Yes | one of Producer, Consumer |
— | No | Expanded server-side into the operations Kafka needs, plus group ACLs for a Consumer |
| Consumer group prefixes | spec.consumerGroupPrefixes |
spec.consumer_group_prefixes |
Yes | list of strings | [] (no group access) | No | Prefix-matched ACLs on consumer groups. Required as soon as any grant is a Consumer; "*" is an accepted explicit value for "all groups" |
| Extra topic operations | topicGrants[].extraOperations |
topicGrants[].extra_operations |
Yes | list of DescribeConfigs |
[] (none) | No | Applied to THIS grant's own pattern, never cluster-wide. Lets a tenant run Schema Registry (DescribeConfigs on its _schemas topic) and read a topic's config. Cannot create, delete or re-configure a topic — config is owned by the Kafka Topic resource |
| Cluster operations | spec.clusterOperations |
spec.cluster_operations |
Yes | list of Describe, IdempotentWrite |
[] (none) | No | Cluster-scoped ACLs. Describe is what a read-only admin UI needs for its broker overview; IdempotentWrite is what a producing UI needs. There is deliberately no cluster Create |
A user that produces to one literal topic and consumes from a prefix of topics, with access to the groups starting app-.
Terraform
Python SDK
kc CLI
Resource docs
Examples
More in this section