Prefixed * ACL Pattern Causes Metadata Fetch Failures and UI Loading Issues — Validation or Documentation Needed

[kuldeep0508]

🧠 Problem Statement:

Using Kafka ACLs with --resource-pattern-type prefixed and resource name"*"does not act as a wildcard.
Kafka accepts this ACL silently, but it matches no actual topic because no topic name begins with *.
When other topic-specific ACLs are added, the UI or client loses visibility — showing that the prefixed * ACL is ineffective and misleading.

🛠 Reproducible Scenario:

Kafka cluster: AWS MSK with mTLS
Client cert: CN=.kafka.mtls.sbcp.io, O=o-m61xxxx
Client: Kafka UI deployed in Kubernetes via Istio using mTLS cert

Steps:

1. Baseline (No ACLs):

Kafka UI shows all topics — MSK default (allow.everyone.if.no.acl.found=true)

2. Apply Literal * ACL with wrong principal (missing O=):

     kafka-acls.sh --add --allow-principal "User:CN=*.kafka.msk.sbcp.io" --operation All --topic "*" --resource-pattern-type literal

   🔴 Kafka UI shows no topics
   ✅ Root cause: Principal mismatch (full DN not matched)

3. Apply Prefixed * ACL with same principal:

     kafka-acls.sh --add --allow-principal "User:CN=*.kafka.msk.sbcp.io" --operation All --topic "*" --resource-pattern-type prefixed

   ⚠️ False sense of success — MSK fallback still letting UI fetch open topics
   🟡 Kafka UI temporarily shows topics

4. Add topic-specific ACL for different principal:

      kafka-acls.sh --add --allow-principal "User:User:CN=*.dotk-4.msk.sbcp.io" --operation All --topic "dotk-4_" --resource-pattern-type prefixed

   🔴 Kafka UI no longer sees any dotk-4_ topics
   💥 At this point, MSK enforces ACLs strictly → only matching ACLs apply
   💥 The prefixed * from earlier fails to apply (no topic starts with *)

5. Add Literal ACL for single topic to different principal

       kafka-acls.sh --add --allow-principal "User:User:CN=*.dotk-3.msk.sbcp.io" --operation All --topic "dotk-3_sample-topic" 

   🔴 Kafka UI cannot see dotk-4_sample-topic either
   📌 Confirms that CN=*.kafka.mtls.sbcp.io, O=o-m61xxxx principal has no effective access, and prefixed * ACL does not apply.

6. Apply proper ACL with full DN and Literal* :

    kafka-acls.sh --add --allow-principal "User:CN=*.kafka.mtls.sbcp.io, O=o-m61xxxx" --operation All --topic "*" --resource-pattern-type literal

   🟢 Kafka UI shows all topics again
   ✅ Works as expected — Literal * correctly applies wildcard access to all topics

7. Apply proper ACL with full DN and Prefixed * :
   bash kafka-acls.sh --add --allow-principal "User:CN=*.kafka.mtls.sbcp.io, O=o-m61xxxx" --operation All --topic "*" --resource-pattern-type prefixed
   🔴 Kafka UI became unresponsive — stuck in infinite loading state.
   💥 Prefixed * pattern does not match any real topic (because no topic name starts with *).
   💥 Kafka UI keeps retrying metadata fetching (due to 0 authorized topics), resulting in an infinite loading spinner.

Based on the behavior observed, it appears that using --resource-pattern-type prefixed with a resource name "*" does not function as a wildcard and results in no actual resource match (since no Kafka topic can start with *).

Could you please confirm:

1. Is --resource-pattern-type prefixed --topic "*" is a valid wildcard pattern in Kafka ACL configuration ?
2. If not invalid, under what specific scenario would Prefixed * be expected to match resources?
3. Can documentation be updated clearly to warn about the ineffectiveness of Prefixed * to prevent production misconfiguration risks?