kafka icon indicating copy to clipboard operation
kafka copied to clipboard

KAFKA-14214: Convert StandardAuthorizer to copy-on-write

Open cmccabe opened this issue 2 years ago • 3 comments

Convert StandardAuthorizer to use a copy-on-write sorted array rather than a ConcurrentSkipList. The issue with the skiplist was that because it was modified while in use by StandardAuthorizer#authorize, we could sometimes expose an inconsistent state. For example, if we added a "deny principal foo", followed by "allow all", a request for principal foo might happen to see the second one, without seeing the first one, even though the first one was added first.

The sorted array data structure is more compact than the tree, although it has the disadvantage of needing to be copied every time it's modified. On the broker side, we can apply a batch of updates atomically now. On the controller side, we still apply updates one-by-one, for now.

This PR renames AclAuthorizerBenchmark to AuthorizerBenchmark and extends it to report information about StandardAuthorizer as well as AclAuthorizer.

Co-authored-by: Akhilesh Chaganti [email protected]

cmccabe avatar Sep 13 '22 22:09 cmccabe

Jenkins went down again. :(

java.nio.file.FileSystemException: /home/jenkins/workspace/Kafka_kafka-pr_PR-12636: No space left on device

cmccabe avatar Sep 14 '22 17:09 cmccabe

Thanks for the PR. @cmccabe can you please include the benchmark results before/after this change? Also, can we explain if there are any changes with regards to algorithmic complexity from the previous implementation to this one for authorize and updateAcl calls?

ijuma avatar Sep 15 '22 13:09 ijuma

I uploaded a new version at https://github.com/apache/kafka/pull/12662

cmccabe avatar Sep 19 '22 20:09 cmccabe

I uploaded a new version at https://github.com/apache/kafka/pull/12662

In that case, closing this one.

divijvaidya avatar Jun 16 '23 14:06 divijvaidya