[KAFKA-2641] Upgrade path for ZK authentication

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.9.0.0
• Component/s: security
• Assignee: Flavio Paiva Junqueira
• Reporter: Flavio Paiva Junqueira
• Created: 13/Oct/15 12:22
• Updated: 23/Oct/15 22:11
• Resolved: 23/Oct/15 22:11

Description

If a cluster isn't secure and wants to migrate to secure, then it will need to execute the following steps with respect to ZK:

1. Perform a rolling restart passing the appropriate JAAS file to enable the ZK client to authenticate against the server
2. Run a ZkSecurityMigrationTool that will set the appropriate ACLs
3. Perform a second rolling restart to set `zookeeper.enable.secure.acls`

This recipe assumes that the ZK ensemble has security on.