[jira] [Commented] (KAFKA-13744) Quota metric tags are inconsistent

["Jun Rao (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KAFKA-13744?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17507142#comment-17507142 ] 

Jun Rao commented on KAFKA-13744:
---------------------------------

[~jeqo] : Thanks for reporting this issue. It seems that the tags are added as designed in [https://cwiki.apache.org/confluence/display/KAFKA/KIP-55%3A+Secure+Quotas+for+Authenticated+Users] . The idea is that if a client is not authenticated with the brokers, we want to tag the clients with the cliendId. If a client is authenticated with the brokers, we typically can tag the clients with user, but giving the client the option to be tagged by both user and clientId.

> Quota metric tags are inconsistent
> ----------------------------------
>
>                 Key: KAFKA-13744
>                 URL: https://issues.apache.org/jira/browse/KAFKA-13744
>             Project: Kafka
>          Issue Type: Bug
>          Components: core, metrics
>            Reporter: Jorge Esteban Quilcate Otoya
>            Priority: Major
>              Labels: quotas
>         Attachments: image-2022-03-15-16-57-12-583.png
>
>
> When enabling metrics for quotas the metrics apply to _all_ clients (see https://issues.apache.org/jira/browse/KAFKA-13742).
> Though, the tags are calculated depending on the quotas registered and applied to all clients: [https://github.com/apache/kafka/blob/0b9a8bac36f16b5397e9ec3a0441758e4b60a384/core/src/main/scala/kafka/server/ClientQuotaManager.scala#L649-L694]
> This causes different metric tags result depending on which quota is registered first.
> For instance, if a quota is registered with userId and clientId, then metrics are tagged with both, though if then a quota is registered with only tagged with clientId, then all metrics are only tagged by clientId — even though user principal is available.
> !image-2022-03-15-16-57-12-583.png|width=1034,height=415!
> I managed to reproduce this behavior here:
>  * From 10:30 to 10:45, there was a quota with both client-id and user-id
>  * It was removed by 10:45, so no metrics were exposed.
>  * After, a quota with client id was created, and metrics were collected only with client id, even though the user was available.
> I'd expect metrics to always contain both, if available — and simplify the logic here [https://github.com/apache/kafka/blob/0b9a8bac36f16b5397e9ec3a0441758e4b60a384/core/src/main/scala/kafka/server/ClientQuotaManager.scala#L649-L694].



--
This message was sent by Atlassian Jira
(v8.20.1#820001)