Support for IP ranges in ACL host

[gabschne]

Hi Redpanda team,

I’m configuring ACLs and would like to restrict access by host more granularly than just a single IP or the full wildcard *. Specifically, I’d like to use “sub-wildcard” IP patterns such as 100.64.* for --allow-host / --deny-host when creating ACLs for user principals.

From the documentation, I see that:

• A host is described as “the IP address or hostname from which access is allowed/denied”, with examples like 192.168.1.100 and * (any host), see ACL terminology.
• I couldn’t find any mention in the docs of support for partial IP wildcards (for example 100.64.*) or CIDR-style ranges in the host field.

This is especially interesting in K8s envs, where application pods frequently receive different IP addresses. Being able to express IP ranges in ACL hosts would make it much easier to maintain secure, least-privilege configurations without constantly updating ACLs as pod IPs change.

Questions:

• Does Redpanda currently support sub-wildcard IP patterns or any other way to express IP ranges in ACL hosts?
• If not, could this be considered a feature request?

Thanks!

[michael-redpanda]

Hi @gabschne, looks like you're requesting support for KIP-1274 which hasn't been approved yet. We can discuss this internally and get back to you.

[gabschne]

Yep, that's exactly what I'm looking for, thanks!

Seems like the linked Jira issue was created 4 days ago and had some activity yesterday (actually just coincidence, I absolutely didn't know about it, lol). Seems like someone picked it up and the status changed to in-progress.

[gabschne]

For everyone who comes along and is also looking for it, see #29403.