ZooKeeper服务发现场景下的安全ACL配置咨询及适用性确认

Absolutely, ZooKeeper is a perfect fit for your service discovery use case—its built-in ACL (Access Control List) system is designed to handle exactly this kind of granular permission separation across multi-cluster environments. Let’s break this down:

First: Why ZooKeeper Works Here #

• Temporary Nodes: ZooKeeper’s ephemeral nodes are tailor-made for service discovery. When a server disconnects (e.g., service goes offline), the ephemeral node is automatically deleted, which keeps your service registry up-to-date without extra cleanup logic.
• Per-Node ACLs: Unlike some systems with flat permissions, ZooKeeper lets you set distinct ACL rules for individual nodes (your trusted directories and their child nodes). This means you can lock down the parent directory while allowing limited access to its children.
• Multi-Cluster Support: ZooKeeper clusters can be accessed across multiple trusted networks, and ACLs work consistently regardless of where clients connect from (as long as authentication is set up correctly).

Second: ACL Configuration Steps #

Let’s assume you’re using digest authentication (username/password) to distinguish trusted sources from regular servers—this is a common, flexible choice. We’ll also cover IP-based auth as an alternative for cluster environments.

1. Prepare Credentials for Trusted Sources #

First, generate a hashed password for your trusted source user (never use plaintext in ACLs):

# Run this on your ZooKeeper server to generate the hashed digest
zkServer.sh digest trusted-source:yourStrongPassword

This will output a string like trusted-source:abc123def456...—save this for later.

2. Create the Trusted Directory & Set Parent ACL #

Log into ZooKeeper CLI as the trusted source (authenticate first):

zkCli.sh
# Authenticate as the trusted user
addauth digest trusted-source:yourStrongPassword
# Create the root directory for service discovery
create /service-registry ""
# Set the ACL: trusted source has full control, others can only read and create child nodes
setAcl /service-registry digest:trusted-source:abc123def456...:cdrwa,world:anyone:cr

Let’s break down the permissions:

• cdrwa: Full permissions for the trusted source (Create, Delete, Read, Write, Admin) — this lets them manage the directory itself (create, delete, modify ACLs).
• cr: Limited permissions for all other clients (Create, Read) — they can create ephemeral child nodes (for service registration) and read the list of registered services, but cannot delete/modify the parent directory or alter its ACLs.

3. Verify Regular Client Permissions #

For a regular server (non-trusted client), they don’t need to authenticate with the trusted source credentials. When they connect, they can:

• List registered services:

  ls /service-registry
  

• Create an ephemeral node for their service:

  create -e /service-registry/service-1 "192.168.1.10:8080"
  

But they will get permission denied if they try to:

• Delete the parent directory: delete /service-registry
• Modify the parent directory’s data: set /service-registry "new-data"
• Delete another client’s ephemeral node: delete /service-registry/service-2 (since ephemeral nodes default to giving full permissions only to their creator)

Alternative: IP-Based Authentication #

If your trusted sources come from a fixed IP range (e.g., a management cluster), you can use IP-based ACLs instead of digest auth for simpler setup:

# Set ACL to allow full control for 10.0.0.0/24 (trusted cluster), read/create for everyone else
setAcl /service-registry ip:10.0.0.0/24:cdrwa,world:anyone:cr

Key Notes for Security #

• No ACL Inheritance: ZooKeeper doesn’t automatically inherit ACLs from parent nodes, which is good here—your ephemeral nodes will use the creator’s permissions by default, so regular clients can’t modify each other’s service nodes.
• Enable SSL: To protect authentication data and service registry traffic, enable ZooKeeper’s SSL encryption for client-server communication.
• Audit Logs: Enable ZooKeeper’s audit logging to track who is creating/accessing nodes, which helps with troubleshooting and compliance.

内容的提问来源于stack exchange，提问作者M4rk