Message Queue CKafka provides managed services based on the Apache Kafka open-source ecosystem and supports performing corresponding operations through the console, TencentCloud API, and open-source clients. To reduce the operational risks associated with certain management operations, CKafka supports blocking selected Admin APIs. After blocking takes effect, restricted APIs cannot be called through open-source AdminClient, scripts, or third-party tools. Where supported, use the CKafka console or TencentCloud API to perform the corresponding administrative operations.
Note:
The Admin API in this document refers to management interfaces called through the Kafka protocol, which differ from the TencentCloud API. When replacing calls, you must adapt them according to the parameters and authentication methods of TencentCloud API. You cannot simply replace the request address.
Scope and Applicability
Starting from November 16, 2026, Admin API blocking is enabled by default for new instances that meet the following instance type and version requirements. For existing instances (instances already running online), blocking is not enabled by default to maintain compatibility.
Supported instance types: This feature is supported only for Serverful instances. It is not currently supported for Serverless instances.
Supported versions: The instance must run the minimum supported minor version or later within its version series, as listed below.
Series 2.4.2: minor version 2.4.2_1.2.8 or later
Series 2.8.1: minor version 2.8.1_1.1.17 or later
Series 3.2.3: minor version 3.2.3_1.0.12 or later
Note:
For existing instances, the system allows operations through the Admin API by default, and operations such as specification changes and minor version upgrades do not automatically change this default behavior. To help improve cluster stability, we recommend reviewing your use of the affected APIs and making any necessary changes before manually enabling these restrictions. Where supported, use the CKafka console or TencentCloud API for administrative operations.
Restricted Admin APIs
The following APIs cannot be called after blocking takes effect:
|
DELETE_TOPICS | deleteTopics(...) | Delete a Topic. |
CREATE_ACLS | createAcls(...) | Create a resource access control policy. |
ALTER_CONFIGS | alterConfigs(...) | Modify resource configurations for topics, brokers, and other components. |
INCREMENTAL_ALTER_CONFIGS | incrementalAlterConfigs(...) | Incrementally modify resource configurations, such as setting, deleting, or adjusting configuration items. |
DELETE_RECORDS | deleteRecords(...) | Delete message records in the specified partition whose offset is less than the specified value. |
DELETE_ACLS | deleteAcls(...) | Delete ACLs that match the filter criteria. |
CREATE_PARTITIONS | createPartitions(...) | Increase the number of partitions for an existing Topic. |
DELETE_GROUPS | deleteConsumerGroups(...) | Delete a consumer group. |
ELECT_LEADERS | electLeaders(...) | Trigger Leader election for a partition. |
ALTER_PARTITION_REASSIGNMENTS | alterPartitionReassignments(...) | Change or cancel partition replica reassignment. |
DESCRIBE_CLIENT_QUOTAS | describeClientQuotas(...) | Query quota entities such as users and clients, along with their quotas. |
ALTER_CLIENT_QUOTAS | alterClientQuotas(...) | Modify or remove client quotas. |
ALTER_USER_SCRAM_CREDENTIALS | alterUserScramCredentials(...) | Add, modify, or delete SASL/SCRAM credentials for a user. |
ALTER_REPLICA_LOG_DIRS | alterReplicaLogDirs(...) | Move replica logs to the specified storage directory. |
Attention:
The above is an example of a Java client method. Method names in SDKs for other languages may differ, so verify them against the SDK you are using.
After blocking takes effect, you cannot remove the blocking in the console. If necessary, contact us for evaluation. Enabling Admin API Blocking
For existing Serverful Pro Edition instances, you can manually enable Admin API blocking by following the steps below. Before doing so, complete the API call self-check and business adaptation.
2. Select Instance List in the left sidebar, and click the target instance ID to go to the details page.
3. On the Instance Details page, check the kernel version in the basic instance information to confirm whether the current minor version meets or exceeds the minimum version required for blocking. If your instance version is earlier than the minimum requirement below, perform instance kernel minor version upgrade first. |
2.4.x | 2.4.2_1.2.8 |
2.8.x | 2.8.1_1.1.17 |
3.2.x | 3.2.3_1.0.12 |
4. Select the Intelligent Ops tab on the left side of the page, and then select One-Click Diagnosis subtab. If you have not blocked high-risk Admin APIs, a high-risk diagnosis item for Admin API permissions will be displayed under the security governance category in the diagnosis results. You can follow the product guidance to disable high-risk Admin API permissions.
Attention:
After blocking takes effect, you cannot remove the blocking in the console. If necessary, contact us for evaluation.