/opt/kafka/kafka/bin/zookeeper-security-migration.sh

ZooKeeper Migration Tool Help. This tool updates the ACLs of znodes as part of the process of setting up ZooKeeper authentication.
Option                                 Description
------                                 -----------
--enable.path.check                    Checks if all the root paths exist in
                                         ZooKeeper before migration. If not,
                                         exit the command.
--help                                 Print usage information.
--version                              Display Kafka version.
--zk-tls-config-file <String:          Identifies the file where ZooKeeper
  ZooKeeper TLS configuration>           client TLS connectivity properties
                                         are defined.  Any properties other
                                         than zookeeper.ssl.keystore.
                                         location, zookeeper.
                                         clientCnxnSocket, zookeeper.ssl.
                                         truststore.location, zookeeper.ssl.
                                         truststore.password, zookeeper.ssl.
                                         truststore.type, zookeeper.ssl.
                                         client.enable, zookeeper.ssl.cipher.
                                         suites, zookeeper.ssl.protocol,
                                         zookeeper.ssl.keystore.password,
                                         zookeeper.ssl.ocsp.enable, zookeeper.
                                         ssl.endpoint.identification.
                                         algorithm, zookeeper.ssl.crl.enable,
                                         zookeeper.ssl.keystore.type,
                                         zookeeper.ssl.enabled.protocols are
                                         ignored.
--zookeeper.acl <String>               Indicates whether to make the Kafka
                                         znodes in ZooKeeper secure or
                                         unsecure. The options are 'secure'
                                         and 'unsecure'
--zookeeper.connect <String>           Sets the ZooKeeper connect string
                                         (ensemble). This parameter takes a
                                         comma-separated list of host:port
                                         pairs. (default: localhost:2181)
--zookeeper.connection.timeout         Sets the ZooKeeper connection timeout.
  <Integer>                              (default: 30000)
--zookeeper.session.timeout <Integer>  Sets the ZooKeeper session timeout.
                                         (default: 30000)