Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change ACL modification mechanism in Console #1220

Open
jason-da-redpanda opened this issue Apr 17, 2024 · 0 comments
Open

Change ACL modification mechanism in Console #1220

jason-da-redpanda opened this issue Apr 17, 2024 · 0 comments
Assignees
Labels
backend bug Something isn't working feature New feature or request frontend

Comments

@jason-da-redpanda
Copy link

jason-da-redpanda commented Apr 17, 2024

Currently in console when ACL's are modified, we delete the existing ones.. then recreate with existing acls + additions.

We have seen this can cause problems on clients ...

Have been able to reproduce consistently with following steps :

  • In Console configure acls for a user-A. . give permisions for topic-1, + consumergroup1. (then repeat with topic2, consumer group2 ... up to 5 sets of resources for topic + group) [Save/ok]

  • Start java consumer. Confirm it's reading from topic1 , Group 1 running.. + no issues with authorisation.

  • In console Amend ACL's for user-A.. Give additional permissions for topic6 + consumergroup6. [Save/ok]

  • Java Consumer now fails with auth errors
    Java log :
    [com.redpanda.ConsumerExample.main()] WARN org.apache.kafka.clients.consumer.internals.Fetcher - [Consumer clientId=consumer-firefox-1, groupId=firefox] Not authorized to read from partition topic-1-0. org.apache.kafka.common.errors.TopicAuthorizationException: Not authorized

     Redpanda Reports :
    

2024-04-16 11:43:10.200REDPANDA redpanda INFO 2024-04-16 11:43:10,200 [shard 0:fetc] kafka - 31.54.228.122:62370 failed authorization - connection_context.cc:179 - proto: kafka rpc protocol, sasl state: complete, acl op: read, principal: type {user} name {redpanda-chat-account}, resource: {topic1}

  • Restart java consumer no issues with ACLS / authorisation

  • The ACL's are as expected in consol/rpk acl list...e.g the additional topic/group was added we didnt lose any

Requested Feature change :
Either :

  1. change the UI for ACLs significantly
  2. make console smarter so that it can do better diffs without removing
@rikimaru0345 rikimaru0345 self-assigned this Apr 30, 2024
@weeco weeco added frontend bug Something isn't working feature New feature or request backend labels Jun 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backend bug Something isn't working feature New feature or request frontend
Projects
None yet
Development

No branches or pull requests

3 participants