You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@rocketmq.apache.org by 丁双喜 <di...@gmail.com> on 2023/11/15 11:50:25 UTC
[DISCUSS][RIP-67] RocketMQ ACL 2.0
Hi, RocketMQ Community
RocketMQ ACL is crucial for ensuring the security of message data. We aim
to enhance its capabilities and are preparing to upgrade it to a newer
version.
We have written the proposal and you can see it by the link below:
https://github.com/apache/rocketmq/issues/7560
Please reply to this email if you have any questions
Best Regards
Re: [DISCUSS][RIP-67] RocketMQ ACL 2.0
Posted by 丁双喜 <di...@gmail.com>.
Hello Li Zhanhui
I'm glad to receive your response. Regarding the propagation between
different brokers and the issue of copying to new nodes, there is currently
no good solution based on the current architecture. I'm pleased to hear
that there are ongoing consensus efforts. May I ask about the current
design and progress of this work? If it aligns with our timeline and
capability, we can consider building on top of this consensus algorithm.
I look forward to hearing from you again.
Best Regards
Zhanhui Li <li...@gmail.com> 于2023年11月15日周三 20:50写道：
> Hi Ding,
>
> The storage of ACL is primarily kept locally in the Broker, and there are
> > two main options: file storage and RocksDB-based storage. In this case,
> > RocksDB is used for storage, while file storage is provided as an example
> > for reference purposes.
>
>
> Either embedded RocksDB or yaml file is stored per node. This raises two
> concerns: how the metadata will be propagated to newly added nodes? How to
> avoid partial failure and resulting inconsistency among nodes?
>
> There are consensus efforts ongoing, will this this feature be built on top
> of them?
>
> Li Zhanhui
>
> On Wed, Nov 15, 2023 at 8:32 PM qiaoao <qi...@foxmail.com> wrote:
>
> > Good to know! Will the ACL 2.0 support ACL in NameServer?
> >
> > > 2023年11月15日 19:50，丁双喜 <di...@gmail.com> 写道：
> > >
> > > Hi, RocketMQ Community
> > >
> > > RocketMQ ACL is crucial for ensuring the security of message data. We
> aim
> > > to enhance its capabilities and are preparing to upgrade it to a newer
> > > version.
> > >
> > > We have written the proposal and you can see it by the link below:
> > > https://github.com/apache/rocketmq/issues/7560
> > >
> > > Please reply to this email if you have any questions
> > > Best Regards
> >
> >
>
Re: [DISCUSS][RIP-67] RocketMQ ACL 2.0
Posted by Zhanhui Li <li...@gmail.com>.
Hi Ding,
The storage of ACL is primarily kept locally in the Broker, and there are
> two main options: file storage and RocksDB-based storage. In this case,
> RocksDB is used for storage, while file storage is provided as an example
> for reference purposes.
Either embedded RocksDB or yaml file is stored per node. This raises two
concerns: how the metadata will be propagated to newly added nodes? How to
avoid partial failure and resulting inconsistency among nodes?
There are consensus efforts ongoing, will this this feature be built on top
of them?
Li Zhanhui
On Wed, Nov 15, 2023 at 8:32 PM qiaoao <qi...@foxmail.com> wrote:
> Good to know! Will the ACL 2.0 support ACL in NameServer?
>
> > 2023年11月15日 19:50，丁双喜 <di...@gmail.com> 写道：
> >
> > Hi, RocketMQ Community
> >
> > RocketMQ ACL is crucial for ensuring the security of message data. We aim
> > to enhance its capabilities and are preparing to upgrade it to a newer
> > version.
> >
> > We have written the proposal and you can see it by the link below:
> > https://github.com/apache/rocketmq/issues/7560
> >
> > Please reply to this email if you have any questions
> > Best Regards
>
>
Re: [DISCUSS][RIP-67] RocketMQ ACL 2.0
Posted by qiaoao <qi...@foxmail.com>.
Hi Ding,
Thank you for your reply! Looking forward to your pr~
Best wished,
> 2023年11月17日 11:37，丁双喜 <di...@gmail.com> 写道：
>
> Hello qiaoao
>
> NameServer is unable to directly support ACL for the following two reasons:
>
> 1. NameServer is a stateless application, and storing ACL configurations
> is not suitable.
> 2. ACL is stored on the Broker, so if NameServer wants to support ACL,
> it would require a reverse dependency on the Broker, which is also not
> suitable.
>
> The current solution available is: In RocketMQ 5.0, a Proxy component was
> introduced. This component acts as a proxy for both NameServer and Broker
> access, allowing NameServer to not be exposed externally.
>
>
> Best Regards
>
> qiaoao <qi...@foxmail.com> 于2023年11月15日周三 20:32写道：
>
>> Good to know! Will the ACL 2.0 support ACL in NameServer?
>>
>>> 2023年11月15日 19:50，丁双喜 <di...@gmail.com> 写道：
>>>
>>> Hi, RocketMQ Community
>>>
>>> RocketMQ ACL is crucial for ensuring the security of message data. We aim
>>> to enhance its capabilities and are preparing to upgrade it to a newer
>>> version.
>>>
>>> We have written the proposal and you can see it by the link below:
>>> https://github.com/apache/rocketmq/issues/7560
>>>
>>> Please reply to this email if you have any questions
>>> Best Regards
>>
>>
Re: [DISCUSS][RIP-67] RocketMQ ACL 2.0
Posted by 丁双喜 <di...@gmail.com>.
Hello qiaoao
NameServer is unable to directly support ACL for the following two reasons:
1. NameServer is a stateless application, and storing ACL configurations
is not suitable.
2. ACL is stored on the Broker, so if NameServer wants to support ACL,
it would require a reverse dependency on the Broker, which is also not
suitable.
The current solution available is: In RocketMQ 5.0, a Proxy component was
introduced. This component acts as a proxy for both NameServer and Broker
access, allowing NameServer to not be exposed externally.
Best Regards
qiaoao <qi...@foxmail.com> 于2023年11月15日周三 20:32写道：
> Good to know! Will the ACL 2.0 support ACL in NameServer?
>
> > 2023年11月15日 19:50，丁双喜 <di...@gmail.com> 写道：
> >
> > Hi, RocketMQ Community
> >
> > RocketMQ ACL is crucial for ensuring the security of message data. We aim
> > to enhance its capabilities and are preparing to upgrade it to a newer
> > version.
> >
> > We have written the proposal and you can see it by the link below:
> > https://github.com/apache/rocketmq/issues/7560
> >
> > Please reply to this email if you have any questions
> > Best Regards
>
>
Re: [DISCUSS][RIP-67] RocketMQ ACL 2.0
Posted by qiaoao <qi...@foxmail.com>.
Good to know! Will the ACL 2.0 support ACL in NameServer?
> 2023年11月15日 19:50，丁双喜 <di...@gmail.com> 写道：
>
> Hi, RocketMQ Community
>
> RocketMQ ACL is crucial for ensuring the security of message data. We aim
> to enhance its capabilities and are preparing to upgrade it to a newer
> version.
>
> We have written the proposal and you can see it by the link below:
> https://github.com/apache/rocketmq/issues/7560
>
> Please reply to this email if you have any questions
> Best Regards