Skip to content

KAFKA-15119:Support incremental syncTopicAcls in MirrorSourceConnector #13913

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hudeqi wants to merge 5 commits into from
Closed

KAFKA-15119:Support incremental syncTopicAcls in MirrorSourceConnector #13913

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7cf6489
KAFKA-15119:Support incremental syncTopicAcls in MirrorSourceConnector
Jun 25, 2023
ee89046
add unit test
Jul 1, 2023
373579e
fix
Jul 11, 2023
dd25b78
minor
Jul 11, 2023
585cbcd
fix bug
Jul 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion clients/src/main/java/org/apache/kafka/clients/admin/CreateAclsResult.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,8 @@
public class CreateAclsResult {
private final Map<AclBinding, KafkaFuture<Void>> futures;

CreateAclsResult(Map<AclBinding, KafkaFuture<Void>> futures) {
// Visible for testing
public CreateAclsResult(Map<AclBinding, KafkaFuture<Void>> futures) {
this.futures = futures;
}

Expand Down
38 changes: 32 additions & 6 deletions connect/mirror/src/main/java/org/apache/kafka/connect/mirror/MirrorSourceConnector.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,10 +20,12 @@
import java.util.Locale;
import java.util.Map.Entry;

import java.util.concurrent.Future;
import java.util.concurrent.atomic.AtomicReference;
import org.apache.kafka.clients.admin.Admin;
import org.apache.kafka.clients.consumer.ConsumerConfig;
import org.apache.kafka.common.IsolationLevel;
import org.apache.kafka.common.KafkaFuture;
import org.apache.kafka.common.config.ConfigValue;
import org.apache.kafka.common.errors.SecurityDisabledException;
import org.apache.kafka.connect.connector.Task;
Expand Down Expand Up @@ -74,6 +76,7 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import static org.apache.kafka.common.utils.Utils.sleep;
import static org.apache.kafka.connect.mirror.MirrorSourceConfig.SYNC_TOPIC_ACLS_ENABLED;

/** Replicate data, configuration, and ACLs between clusters.
Expand Down Expand Up @@ -104,6 +107,7 @@ public class MirrorSourceConnector extends SourceConnector {
private Admin offsetSyncsAdminClient;
private volatile boolean useIncrementalAlterConfigs;
private AtomicBoolean noAclAuthorizer = new AtomicBoolean(false);
private Set<AclBinding> knownTopicAclBindings = Collections.emptySet();

public MirrorSourceConnector() {
// nop
Expand Down Expand Up @@ -581,13 +585,30 @@ void incrementalAlterConfigs(Map<String, Config> topicConfigs) {
}));
}

private void updateTopicAcls(List<AclBinding> bindings) {
log.trace("Syncing {} topic ACL bindings.", bindings.size());
targetAdminClient.createAcls(bindings).values().forEach((k, v) -> v.whenComplete((x, e) -> {
if (e != null) {
log.warn("Could not sync ACL of topic {}.", k.pattern().name(), e);
// Visible for testing
int updateTopicAcls(List<AclBinding> bindings) {
Set<AclBinding> addBindings = new HashSet<>(bindings);
Set<AclBinding> failedBindings = new HashSet<>();
addBindings.removeAll(knownTopicAclBindings);
Comment thread
hudeqi marked this conversation as resolved.
int newBindCount = addBindings.size();
if (!addBindings.isEmpty()) {
log.info("Syncing new found {} topic ACL bindings.", newBindCount);
Map<AclBinding, KafkaFuture<Void>> futureMap = targetAdminClient.createAcls(addBindings).values();
futureMap.forEach((k, v) -> v.whenComplete((x, e) -> {
if (e != null) {
log.warn("Could not sync ACL of topic {}.", k.pattern().name(), e);
failedBindings.add(k);
}
}));
while (!futureMap.values().stream().allMatch(Future::isDone)) {
sleep(1000);
}
}));
knownTopicAclBindings = new HashSet<>(bindings);
Comment thread
hudeqi marked this conversation as resolved.
knownTopicAclBindings.removeAll(failedBindings);

@C0urante C0urante Jul 11, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't failedBindings likely to be empty at this point unless the admin client is able to perform the request to create the ACL bindings exceptionally fast (which also happens to be the scenario we're covering in the unit test)?

} else {
log.debug("Not found new topic Acl info, skip sync!");
}
return newBindCount - failedBindings.size();
}

private static Stream<TopicPartition> expandTopicDescription(TopicDescription description) {
Expand Down Expand Up @@ -672,4 +693,9 @@ boolean isCycle(String topic) {
String formatRemoteTopic(String topic) {
return replicationPolicy.formatRemoteTopic(sourceAndTarget.source(), topic);
}

// Visible for testing
Set<AclBinding> knownTopicAclBindings() {
return knownTopicAclBindings;
}
}
71 changes: 71 additions & 0 deletions connect/mirror/src/test/java/org/apache/kafka/connect/mirror/MirrorSourceConnectorTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@

import org.apache.kafka.clients.admin.AlterConfigOp;
import org.apache.kafka.clients.admin.Admin;
import org.apache.kafka.clients.admin.CreateAclsResult;
import org.apache.kafka.clients.admin.DescribeAclsResult;
import org.apache.kafka.common.KafkaFuture;
import org.apache.kafka.common.TopicPartition;
Expand All @@ -27,8 +28,10 @@
import org.apache.kafka.common.acl.AclPermissionType;
import org.apache.kafka.common.config.ConfigResource;
import org.apache.kafka.common.config.ConfigValue;
import org.apache.kafka.common.errors.ApiException;
import org.apache.kafka.common.errors.UnsupportedVersionException;
import org.apache.kafka.common.errors.SecurityDisabledException;
import org.apache.kafka.common.internals.KafkaFutureImpl;
import org.apache.kafka.common.resource.PatternType;
import org.apache.kafka.common.resource.ResourcePattern;
import org.apache.kafka.common.resource.ResourceType;
Expand All @@ -41,9 +44,11 @@
import org.apache.kafka.connect.errors.ConnectException;
import org.apache.kafka.connect.source.ExactlyOnceSupport;
import org.junit.jupiter.api.Test;
import org.mockito.ArgumentMatchers;

import static org.apache.kafka.clients.admin.AdminClientTestUtils.alterConfigsResult;
import static org.apache.kafka.clients.consumer.ConsumerConfig.ISOLATION_LEVEL_CONFIG;
import static org.apache.kafka.common.utils.Utils.sleep;
import static org.apache.kafka.connect.mirror.MirrorConnectorConfig.CONSUMER_CLIENT_PREFIX;
import static org.apache.kafka.connect.mirror.MirrorConnectorConfig.SOURCE_PREFIX;
import static org.apache.kafka.connect.mirror.MirrorSourceConfig.OFFSET_LAG_MAX;
Expand All @@ -55,6 +60,7 @@
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertNull;
import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
import static org.mockito.ArgumentMatchers.anySet;
import static org.mockito.ArgumentMatchers.isA;
import static org.mockito.Mockito.any;
import static org.mockito.Mockito.doAnswer;
Expand All @@ -74,10 +80,14 @@
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.Set;
import java.util.concurrent.ExecutionException;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.stream.Collectors;

public class MirrorSourceConnectorTest {
Expand Down Expand Up @@ -683,4 +693,65 @@ private Optional<ConfigValue> validateProperty(String name, Map<String, String>
assertNotNull(result, "Connector should not have record null config value for '" + name + "' property");
return Optional.of(result);
}

@Test
public void testUpdateIncrementTopicAcls() {
Admin sourceAdmin = mock(Admin.class);
Admin targetAdmin = mock(Admin.class);
MirrorSourceConnector connector = new MirrorSourceConnector(sourceAdmin, targetAdmin);

List<AclBinding> filteredBindings = new ArrayList<>();
AclBinding binding1 = mock(AclBinding.class);
AclBinding binding2 = mock(AclBinding.class);
filteredBindings.add(binding1);
filteredBindings.add(binding2);
doReturn(mock(CreateAclsResult.class)).when(targetAdmin).createAcls(anySet());

// First topic acl info update when starting `syncTopicAcls` thread
int newAddCount = connector.updateTopicAcls(filteredBindings);
assertEquals(new HashSet<>(filteredBindings), connector.knownTopicAclBindings());
assertEquals(filteredBindings.size(), newAddCount);

List<AclBinding> newAddBindings = new ArrayList<>();
AclBinding binding3 = mock(AclBinding.class);
AclBinding binding4 = mock(AclBinding.class);
newAddBindings.add(binding3);
newAddBindings.add(binding4);
filteredBindings.addAll(newAddBindings);

// The next increment topic acl info update
newAddCount = connector.updateTopicAcls(filteredBindings);
assertEquals(new HashSet<>(filteredBindings), connector.knownTopicAclBindings());
assertEquals(newAddBindings.size(), newAddCount);

// The next increment topic acl info update, contains failed create
List<AclBinding> newAddFailedBindings = new ArrayList<>();
AclBinding binding5 = mock(AclBinding.class);
AclBinding binding6 = mock(AclBinding.class);
newAddFailedBindings.add(binding5);
newAddFailedBindings.add(binding6);
filteredBindings.addAll(newAddFailedBindings);

Map<AclBinding, KafkaFuture<Void>> futures = new HashMap<>();
KafkaFutureImpl<Void> futureForBinding5 = new KafkaFutureImpl<>();
KafkaFutureImpl<Void> futureForBinding6 = new KafkaFutureImpl<>();
ExecutorService singleThread = Executors.newSingleThreadExecutor();
// Delayed completion of `createAclRequest` for simulating actual scenarios
singleThread.submit(() -> {
sleep(5000);
futureForBinding5.complete(null);
futureForBinding6.completeExceptionally(new ApiException("mock create acl failure."));
});
futures.put(binding5, futureForBinding5);
futures.put(binding6, futureForBinding6);
CreateAclsResult mockCreateAclsResult = new CreateAclsResult(new HashMap<>(futures));
doReturn(new ResourcePattern(ResourceType.TOPIC, "topic6", PatternType.LITERAL)).when(binding6).pattern();
doReturn(mockCreateAclsResult).when(targetAdmin).createAcls(ArgumentMatchers.eq(new HashSet<>(newAddFailedBindings)));

int newAddSuccessCount = connector.updateTopicAcls(filteredBindings);
Set<AclBinding> bindingToVerify = new HashSet<>(filteredBindings);
bindingToVerify.remove(binding6);
assertEquals(bindingToVerify, connector.knownTopicAclBindings());
assertEquals(1, newAddSuccessCount);
}
}