It seems that the secure nodes as referred by ZkUtils.scala are the following:
A couple things:
- the list is highly outdated, and for example the most important nodes such as kafka-acls don't get secured. That's a huge security risk. Would it be better to just secure all the nodes recursively from the given root?
- the root of some nodes aren't secured. Ex: /brokers (but many others).
The result is the following after running the tool:
zookeeper-security-migration --zookeeper.acl secure --zookeeper.connect zoo1:2181/kafka-test
[zk: localhost:2181(CONNECTED) 9] getAcl /kafka-test/brokers
[zk: localhost:2181(CONNECTED) 11] getAcl /kafka-test/brokers/ids
[zk: localhost:2181(CONNECTED) 16] getAcl /kafka-test/kafka-acl
That seems pretty bad to be honest... A fast enough ZkClient could delete some root nodes, and create the nodes they like before the Acls get set.