-
Notifications
You must be signed in to change notification settings - Fork 15.4k
KIP-290 Prefixed ACLs #5117
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
KIP-290 Prefixed ACLs #5117
Changes from 2 commits
34c35aa
8d07119
3f9b2ba
7303e7e
d5cca47
dc8a5e2
8d37198
105bb82
d600682
458e5aa
8ae4e11
b78d226
6f96d0d
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -36,6 +36,7 @@ | |
| import static org.apache.kafka.common.protocol.CommonFields.PERMISSION_TYPE; | ||
| import static org.apache.kafka.common.protocol.CommonFields.PRINCIPAL; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_NAME; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_NAME_TYPE; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_TYPE; | ||
|
|
||
| public class CreateAclsRequest extends AbstractRequest { | ||
|
|
@@ -51,9 +52,19 @@ public class CreateAclsRequest extends AbstractRequest { | |
| PERMISSION_TYPE)))); | ||
|
|
||
| /** | ||
| * The version number is bumped to indicate that on quota violation brokers send out responses before throttling. | ||
| * V1 sees a new `RESOURCE_NAME_TYPE` that controls how the resource name is interpreted. | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We want to preserve the comment on quota violation.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. done. |
||
| * | ||
| * For more info, see {@link org.apache.kafka.common.resource.ResourceNameType}. | ||
| */ | ||
| private static final Schema CREATE_ACLS_REQUEST_V1 = CREATE_ACLS_REQUEST_V0; | ||
| private static final Schema CREATE_ACLS_REQUEST_V1 = new Schema( | ||
| new Field(CREATIONS_KEY_NAME, new ArrayOf(new Schema( | ||
| RESOURCE_TYPE, | ||
| RESOURCE_NAME, | ||
| RESOURCE_NAME_TYPE, | ||
| PRINCIPAL, | ||
| HOST, | ||
| OPERATION, | ||
| PERMISSION_TYPE)))); | ||
|
|
||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I can't figure out how to add a comment to the correct line using github's terrible user interface. But on line 110 where you have the code: You must add verification that the version you are using supports the ACLs you are trying to send. If someone tries to set a prefix ACL when using CREATE_ACLS_REQUEST_V0, the code must throw
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Consider it done. |
||
| public static Schema[] schemaVersions() { | ||
| return new Schema[]{CREATE_ACLS_REQUEST_V0, CREATE_ACLS_REQUEST_V1}; | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -37,6 +37,7 @@ | |
| import static org.apache.kafka.common.protocol.CommonFields.PERMISSION_TYPE; | ||
| import static org.apache.kafka.common.protocol.CommonFields.PRINCIPAL_FILTER; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_NAME_FILTER; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_NAME_TYPE_FILTER; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_TYPE; | ||
|
|
||
| public class DeleteAclsRequest extends AbstractRequest { | ||
|
|
@@ -52,9 +53,19 @@ public class DeleteAclsRequest extends AbstractRequest { | |
| PERMISSION_TYPE)))); | ||
|
|
||
| /** | ||
| * The version number is bumped to indicate that on quota violation brokers send out responses before throttling. | ||
| * V1 sees a new `RESOURCE_NAME_TYPE_FILTER` that controls how the filter handles different resource name types. | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We want to preserve the comment on quota violation.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. done. |
||
| * | ||
| * For more info, see {@link org.apache.kafka.common.resource.ResourceNameType}. | ||
| */ | ||
| private static final Schema DELETE_ACLS_REQUEST_V1 = DELETE_ACLS_REQUEST_V0; | ||
| private static final Schema DELETE_ACLS_REQUEST_V1 = new Schema( | ||
| new Field(FILTERS, new ArrayOf(new Schema( | ||
| RESOURCE_TYPE, | ||
| RESOURCE_NAME_FILTER, | ||
| RESOURCE_NAME_TYPE_FILTER, | ||
| PRINCIPAL_FILTER, | ||
| HOST_FILTER, | ||
| OPERATION, | ||
| PERMISSION_TYPE)))); | ||
|
|
||
| public static Schema[] schemaVersions() { | ||
| return new Schema[]{DELETE_ACLS_REQUEST_V0, DELETE_ACLS_REQUEST_V1}; | ||
|
|
@@ -124,7 +135,7 @@ public AbstractResponse getErrorResponse(int throttleTimeMs, Throwable throwable | |
| List<DeleteAclsResponse.AclFilterResponse> responses = new ArrayList<>(); | ||
| for (int i = 0; i < filters.size(); i++) { | ||
| responses.add(new DeleteAclsResponse.AclFilterResponse( | ||
| ApiError.fromThrowable(throwable), Collections.<DeleteAclsResponse.AclDeletionResult>emptySet())); | ||
| ApiError.fromThrowable(throwable), Collections.<DeleteAclsResponse.AclDeletionResult>emptySet())); | ||
| } | ||
| return new DeleteAclsResponse(throttleTimeMs, responses); | ||
| default: | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,10 +19,10 @@ | |
| import org.apache.kafka.common.acl.AccessControlEntry; | ||
| import org.apache.kafka.common.acl.AclBinding; | ||
| import org.apache.kafka.common.protocol.ApiKeys; | ||
| import org.apache.kafka.common.protocol.Errors; | ||
| import org.apache.kafka.common.protocol.types.ArrayOf; | ||
| import org.apache.kafka.common.protocol.types.Field; | ||
| import org.apache.kafka.common.protocol.types.Schema; | ||
| import org.apache.kafka.common.protocol.Errors; | ||
| import org.apache.kafka.common.protocol.types.Struct; | ||
| import org.apache.kafka.common.resource.Resource; | ||
| import org.apache.kafka.common.utils.Utils; | ||
|
|
@@ -43,6 +43,7 @@ | |
| import static org.apache.kafka.common.protocol.CommonFields.PERMISSION_TYPE; | ||
| import static org.apache.kafka.common.protocol.CommonFields.PRINCIPAL; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_NAME; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_NAME_TYPE; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_TYPE; | ||
| import static org.apache.kafka.common.protocol.CommonFields.THROTTLE_TIME_MS; | ||
|
|
||
|
|
@@ -51,11 +52,27 @@ public class DeleteAclsResponse extends AbstractResponse { | |
| private final static String FILTER_RESPONSES_KEY_NAME = "filter_responses"; | ||
| private final static String MATCHING_ACLS_KEY_NAME = "matching_acls"; | ||
|
|
||
| private static final Schema MATCHING_ACL = new Schema( | ||
| private static final Schema MATCHING_ACL_V0 = new Schema( | ||
| ERROR_CODE, | ||
| ERROR_MESSAGE, | ||
| RESOURCE_TYPE, | ||
| RESOURCE_NAME, | ||
| PRINCIPAL, | ||
| HOST, | ||
| OPERATION, | ||
| PERMISSION_TYPE); | ||
|
|
||
| /** | ||
| * V1 sees a new `RESOURCE_NAME_TYPE` that describes how the resource name is interpreted. | ||
| * | ||
| * For more info, see {@link org.apache.kafka.common.resource.ResourceNameType}. | ||
| */ | ||
| private static final Schema MATCHING_ACL_V1 = new Schema( | ||
| ERROR_CODE, | ||
| ERROR_MESSAGE, | ||
| RESOURCE_TYPE, | ||
| RESOURCE_NAME, | ||
| RESOURCE_NAME_TYPE, | ||
| PRINCIPAL, | ||
| HOST, | ||
| OPERATION, | ||
|
|
@@ -67,12 +84,20 @@ public class DeleteAclsResponse extends AbstractResponse { | |
| new ArrayOf(new Schema( | ||
| ERROR_CODE, | ||
| ERROR_MESSAGE, | ||
| new Field(MATCHING_ACLS_KEY_NAME, new ArrayOf(MATCHING_ACL), "The matching ACLs"))))); | ||
| new Field(MATCHING_ACLS_KEY_NAME, new ArrayOf(MATCHING_ACL_V0), "The matching ACLs"))))); | ||
|
|
||
| /** | ||
| * The version number is bumped to indicate that on quota violation brokers send out responses before throttling. | ||
| * V1 sees a new `RESOURCE_NAME_TYPE` field added to MATCHING_ACL_V1, that describes how the resource name is interpreted. | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We want to preserve the comment on quota violation.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. done. |
||
| * | ||
| * For more info, see {@link org.apache.kafka.common.resource.ResourceNameType}. | ||
| */ | ||
| private static final Schema DELETE_ACLS_RESPONSE_V1 = DELETE_ACLS_RESPONSE_V0; | ||
| private static final Schema DELETE_ACLS_RESPONSE_V1 = new Schema( | ||
| THROTTLE_TIME_MS, | ||
| new Field(FILTER_RESPONSES_KEY_NAME, | ||
| new ArrayOf(new Schema( | ||
| ERROR_CODE, | ||
| ERROR_MESSAGE, | ||
| new Field(MATCHING_ACLS_KEY_NAME, new ArrayOf(MATCHING_ACL_V1), "The matching ACLs"))))); | ||
|
|
||
| public static Schema[] schemaVersions() { | ||
| return new Schema[]{DELETE_ACLS_RESPONSE_V0, DELETE_ACLS_RESPONSE_V1}; | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -32,6 +32,7 @@ | |
| import static org.apache.kafka.common.protocol.CommonFields.PERMISSION_TYPE; | ||
| import static org.apache.kafka.common.protocol.CommonFields.PRINCIPAL_FILTER; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_NAME_FILTER; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_NAME_TYPE_FILTER; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_TYPE; | ||
|
|
||
| public class DescribeAclsRequest extends AbstractRequest { | ||
|
|
@@ -44,9 +45,18 @@ public class DescribeAclsRequest extends AbstractRequest { | |
| PERMISSION_TYPE); | ||
|
|
||
| /** | ||
| * The version number is bumped to indicate that on quota violation brokers send out responses before throttling. | ||
| * V1 sees a new `RESOURCE_NAME_TYPE_FILTER` that controls how the filter handles different resource name types. | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We want to preserve the comment on quota violation.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. done |
||
| * | ||
| * For more info, see {@link org.apache.kafka.common.resource.ResourceNameType}. | ||
| */ | ||
| private static final Schema DESCRIBE_ACLS_REQUEST_V1 = DESCRIBE_ACLS_REQUEST_V0; | ||
| private static final Schema DESCRIBE_ACLS_REQUEST_V1 = new Schema( | ||
| RESOURCE_TYPE, | ||
| RESOURCE_NAME_FILTER, | ||
| RESOURCE_NAME_TYPE_FILTER, | ||
| PRINCIPAL_FILTER, | ||
| HOST_FILTER, | ||
| OPERATION, | ||
| PERMISSION_TYPE); | ||
|
|
||
| public static Schema[] schemaVersions() { | ||
| return new Schema[]{DESCRIBE_ACLS_REQUEST_V0, DESCRIBE_ACLS_REQUEST_V1}; | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,10 +20,10 @@ | |
| import org.apache.kafka.common.acl.AccessControlEntry; | ||
| import org.apache.kafka.common.acl.AclBinding; | ||
| import org.apache.kafka.common.protocol.ApiKeys; | ||
| import org.apache.kafka.common.protocol.Errors; | ||
| import org.apache.kafka.common.protocol.types.ArrayOf; | ||
| import org.apache.kafka.common.protocol.types.Field; | ||
| import org.apache.kafka.common.protocol.types.Schema; | ||
| import org.apache.kafka.common.protocol.Errors; | ||
| import org.apache.kafka.common.protocol.types.Struct; | ||
| import org.apache.kafka.common.resource.Resource; | ||
|
|
||
|
|
@@ -41,14 +41,15 @@ | |
| import static org.apache.kafka.common.protocol.CommonFields.PERMISSION_TYPE; | ||
| import static org.apache.kafka.common.protocol.CommonFields.PRINCIPAL; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_NAME; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_NAME_TYPE; | ||
| import static org.apache.kafka.common.protocol.CommonFields.RESOURCE_TYPE; | ||
| import static org.apache.kafka.common.protocol.CommonFields.THROTTLE_TIME_MS; | ||
|
|
||
| public class DescribeAclsResponse extends AbstractResponse { | ||
| private final static String RESOURCES_KEY_NAME = "resources"; | ||
| private final static String ACLS_KEY_NAME = "acls"; | ||
|
|
||
| private static final Schema DESCRIBE_ACLS_RESOURCE = new Schema( | ||
| private static final Schema DESCRIBE_ACLS_RESOURCE_V0 = new Schema( | ||
| RESOURCE_TYPE, | ||
| RESOURCE_NAME, | ||
| new Field(ACLS_KEY_NAME, new ArrayOf(new Schema( | ||
|
|
@@ -57,16 +58,37 @@ public class DescribeAclsResponse extends AbstractResponse { | |
| OPERATION, | ||
| PERMISSION_TYPE)))); | ||
|
|
||
| /** | ||
| * V1 sees a new `RESOURCE_NAME_TYPE` that describes how the resource name is interpreted. | ||
| * | ||
| * For more info, see {@link org.apache.kafka.common.resource.ResourceNameType}. | ||
| */ | ||
| private static final Schema DESCRIBE_ACLS_RESOURCE_V1 = new Schema( | ||
| RESOURCE_TYPE, | ||
| RESOURCE_NAME, | ||
| RESOURCE_NAME_TYPE, | ||
| new Field(ACLS_KEY_NAME, new ArrayOf(new Schema( | ||
| PRINCIPAL, | ||
| HOST, | ||
| OPERATION, | ||
| PERMISSION_TYPE)))); | ||
|
|
||
| private static final Schema DESCRIBE_ACLS_RESPONSE_V0 = new Schema( | ||
| THROTTLE_TIME_MS, | ||
| ERROR_CODE, | ||
| ERROR_MESSAGE, | ||
| new Field(RESOURCES_KEY_NAME, new ArrayOf(DESCRIBE_ACLS_RESOURCE), "The resources and their associated ACLs.")); | ||
| new Field(RESOURCES_KEY_NAME, new ArrayOf(DESCRIBE_ACLS_RESOURCE_V0), "The resources and their associated ACLs.")); | ||
|
|
||
| /** | ||
| * The version number is bumped to indicate that on quota violation brokers send out responses before throttling. | ||
| * V1 sees a new `RESOURCE_NAME_TYPE` field added to DESCRIBE_ACLS_RESOURCE_V1, that describes how the resource name is interpreted. | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. We want to preserve the comment on quota violation.
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. done. |
||
| * | ||
| * For more info, see {@link org.apache.kafka.common.resource.ResourceNameType}. | ||
| */ | ||
| private static final Schema DESCRIBE_ACLS_RESPONSE_V1 = DESCRIBE_ACLS_RESPONSE_V0; | ||
| private static final Schema DESCRIBE_ACLS_RESPONSE_V1 = new Schema( | ||
| THROTTLE_TIME_MS, | ||
| ERROR_CODE, | ||
| ERROR_MESSAGE, | ||
| new Field(RESOURCES_KEY_NAME, new ArrayOf(DESCRIBE_ACLS_RESOURCE_V1), "The resources and their associated ACLs.")); | ||
|
|
||
| public static Schema[] schemaVersions() { | ||
| return new Schema[]{DESCRIBE_ACLS_RESPONSE_V0, DESCRIBE_ACLS_RESPONSE_V1}; | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
s/resource_name_type/resource_name_type_filter?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
done.