[jira] [Commented] (KAFKA-20667) O(N) ACL scan in StandardAuthorizerData.checkSection

["Yunseop Eom (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/KAFKA-20667?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101137#comment-18101137 ] 

Yunseop Eom commented on KAFKA-20667:
-------------------------------------

Opened PR https://github.com/apache/kafka/pull/23036.

This adds a persistent principal index to AclCache and uses it during StandardAuthorizerData authorization, so each request scans ACLs for the request principal and wildcard principal instead of all ACLs in the resource section. The resource index is still checked separately to preserve default-allow semantics when unrelated ACLs exist.

Verification: the new AclCache add/remove test, the full :metadata:test suite including StandardAuthorizerPropertyTest, :metadata:spotlessCheck, and git diff --check pass. Awaiting maintainer review.

>  O(N) ACL scan in StandardAuthorizerData.checkSection
> -----------------------------------------------------
>
>                 Key: KAFKA-20667
>                 URL: https://issues.apache.org/jira/browse/KAFKA-20667
>             Project: Kafka
>          Issue Type: Bug
>          Components: core
>    Affects Versions: 3.9.2
>            Reporter: ibenchhida
>            Priority: Critical
>              Labels: authorization, perfomance
>
> Root cause: checkSection() iterates all ACLs sharing the same resource 
> pattern via TreePSet.tailSet(), calling HashSet.contains per ACL × topic. 
> With 504 topics × 7001 ACLs → ~3.5M iterations per MetadataRequest.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)