Related problem
Currently we rely fully on k8s access token when AI assistant reach MCP server. We should implement a mechanism that will restrict access to underlying resources based on access token. For Strimzi MCP it is not too relevant as we can restrict it on k8s level, but for Kafka we need proper authn & authz.
Suggested solution
We should implement a module that will reach to keycloak and based on PAT provided by user it will determine the access rights to resources deployed within Kafka cluster. More details can be found here - https://github.com/streamshub/streamshub-mcp/blob/preview-auth-and-authz/architecture/mcp-auth-and-authz.md (just a draft)
Alternatives
No response
Additional context
No response
Related problem
Currently we rely fully on k8s access token when AI assistant reach MCP server. We should implement a mechanism that will restrict access to underlying resources based on access token. For Strimzi MCP it is not too relevant as we can restrict it on k8s level, but for Kafka we need proper authn & authz.
Suggested solution
We should implement a module that will reach to keycloak and based on PAT provided by user it will determine the access rights to resources deployed within Kafka cluster. More details can be found here - https://github.com/streamshub/streamshub-mcp/blob/preview-auth-and-authz/architecture/mcp-auth-and-authz.md (just a draft)
Alternatives
No response
Additional context
No response