You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by GitBox <gi...@apache.org> on 2021/12/07 00:42:17 UTC
[GitHub] [pulsar] yuruguo opened a new pull request #13157: [Authorization] Converge perm to operate subscription conf of namespace
yuruguo opened a new pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157
### Motivation
Currently, only `super-user` or `tenant-administrator` can `set`/`get`/`remove` the subscription configuration of the namespace. In fact, this authorization can be further converged, and roles with the permission to `consume` the namespace can also operate subscription configuration.
The subscription configuration involved includes:
- subscription-expiration-time
- subscription-auth-mode
- subscription-types-enabled
- subscription-dispatch-rate
- max-consumers-per-subscription
- max-unacked-messages-per-subscription
- auto-subscription-creation
### Documentation
- [x] `no-need-doc`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994467051
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-996440639
@codelipenghui @freeznet PTAL, thx!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994775611
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994585874
/pulsarbot run-failure-checks
> I think this PR introduces breaking changes for any existing third party implementations of the `AuthorizationProvider`.
>
> @yuruguo - is your proposal to make it possible for a non admin user to have sufficient permission to update these namespace policies? As currently written, I think these operations fall within the role of the tenant admin (although I'm not sure we have this defined explicitly somewhere).
>
> (Requesting changes to prevent this from being merged for now.)
I have updated [Motivation](https://github.com/apache/pulsar/pull/13157#issue-1072782305) and Code, PTAL, thx!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994858347
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hsaputra commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
hsaputra commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-1005970847
But agree I may be bit over-worried on this change particular changes.
Just bit worry since we have to update implementation of our plugins from last time we sync our internal repo =(
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987549247
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987570232
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987582464
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] michaeljmarshall commented on a change in pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
michaeljmarshall commented on a change in pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#discussion_r770032265
##########
File path: pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/NamespacesBase.java
##########
@@ -1357,7 +1357,7 @@ protected void internalRemoveReplicatorDispatchRate() {
}
protected void internalSetReplicatorDispatchRate(DispatchRateImpl dispatchRate) {
- validateSuperUserAccess();
+ validateNamespacePolicyOperation(namespaceName, PolicyName.RATE, PolicyOperation.WRITE);
Review comment:
```suggestion
validateNamespacePolicyOperation(namespaceName, PolicyName.REPLICATION_RATE, PolicyOperation.WRITE);
```
##########
File path: pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/v1/Namespaces.java
##########
@@ -122,7 +122,7 @@
@Path("/{property}/{cluster}/{namespace}/destinations")
@ApiOperation(hidden = true, value = "Get the list of all the topics under a certain namespace.",
response = String.class, responseContainer = "Set")
- @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin permission"),
+ @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin or consume permission on namespace"),
Review comment:
@gaoran10 good point. The risk here is that custom implementations won't necessarily align with needing admin privileges. I think making it an "or" like you proposed sounds good to me.
##########
File path: pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/NamespacesBase.java
##########
@@ -1341,7 +1341,7 @@ protected SubscribeRate internalGetSubscribeRate() {
}
protected void internalRemoveReplicatorDispatchRate() {
- validateSuperUserAccess();
+ validateNamespacePolicyOperation(namespaceName, PolicyName.RATE, PolicyOperation.WRITE);
Review comment:
```suggestion
validateNamespacePolicyOperation(namespaceName, PolicyName.REPLICATION_RATE, PolicyOperation.WRITE);
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-995249812
@merlimat @eolivelli @codelipenghui @hangc0276 ptal
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-995419920
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994775611
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] gaoran10 commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
gaoran10 commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987512290
If all consume roles could modify the namespace level subscription-related policies, do it may cause some confusion?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987531379
> If all consume roles could modify the namespace level subscription-related policies, do it may cause some confusion?
In fact, this problem still exists if the tenant has multiple `admin-roles`, maybe we need to discuss it separately.
https://github.com/apache/pulsar/blob/47e4f38f2ed10f9b9492ebeb3e1424da18ab3655/pulsar-client-tools/src/main/java/org/apache/pulsar/admin/cli/CmdTenants.java#L61-L63
But in terms of the operation permission for subscription-related policies, it should be more reasonable to converge to a role that can `consume` namespace.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987582464
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-995419920
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987548978
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987569933
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987624154
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987634230
@eolivelli @codelipenghui @hangc0276 @gaoran10 Would you help review this PR? thx!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987502487
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987560978
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987570232
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987606683
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987634230
@eolivelli @codelipenghui @hangc0276 @gaoran10 Would you help review this PR? thx!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on a change in pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on a change in pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#discussion_r770052795
##########
File path: pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/v1/Namespaces.java
##########
@@ -122,7 +122,7 @@
@Path("/{property}/{cluster}/{namespace}/destinations")
@ApiOperation(hidden = true, value = "Get the list of all the topics under a certain namespace.",
response = String.class, responseContainer = "Set")
- @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin permission"),
+ @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin or consume permission on namespace"),
Review comment:
So `Don't have operate policies permission on the namespace` is better? @michaeljmarshall @gaoran10
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994858347
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on a change in pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on a change in pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#discussion_r770186142
##########
File path: pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/v1/Namespaces.java
##########
@@ -122,7 +122,7 @@
@Path("/{property}/{cluster}/{namespace}/destinations")
@ApiOperation(hidden = true, value = "Get the list of all the topics under a certain namespace.",
response = String.class, responseContainer = "Set")
- @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin permission"),
+ @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin or consume permission on namespace"),
Review comment:
@gaoran10 @michaeljmarshall Thanks for you suggestion :)
This is a correction of known inaccurate annonations, not limited to `namespace polocies` operation, including: `getTopics`, `clearNamespaceBundleBacklog`, `unsubscribeNamespace`, etc. so perhaps `Don't have admin or operate permission on the namespace` is more general, what do you think?
**NOTE**：`getTopics`, `clearNamespaceBundleBacklog` and `unsubscribeNamespace` require `consume` permission on the namespace to allow execution in the default authorization implementation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] michaeljmarshall commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
michaeljmarshall commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-997151623
@yuruguo - would you mind renaming this PR's title before we merge it? That way the commit message aligns with the changes. Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994585874
/pulsarbot run-failure-checks
> I think this PR introduces breaking changes for any existing third party implementations of the `AuthorizationProvider`.
>
> @yuruguo - is your proposal to make it possible for a non admin user to have sufficient permission to update these namespace policies? As currently written, I think these operations fall within the role of the tenant admin (although I'm not sure we have this defined explicitly somewhere).
>
> (Requesting changes to prevent this from being merged for now.)
I have updated [Motivation](https://github.com/apache/pulsar/pull/13157#issue-1072782305) and Code, PTAL, thx!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994895620
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on a change in pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on a change in pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#discussion_r770186142
##########
File path: pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/v1/Namespaces.java
##########
@@ -122,7 +122,7 @@
@Path("/{property}/{cluster}/{namespace}/destinations")
@ApiOperation(hidden = true, value = "Get the list of all the topics under a certain namespace.",
response = String.class, responseContainer = "Set")
- @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin permission"),
+ @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin or consume permission on namespace"),
Review comment:
@gaoran10 @michaeljmarshall Thanks for you suggestion :)
This is a correction of known inaccurate annonations, not limited to `namespace polocies` operation, including: `getTopics`, `clearNamespaceBundleBacklog`, `unsubscribeNamespace`, etc. so perhaps `Don't have admin or operate permission on the namespace` is more general, what do you think?
**NOTE**：`getTopics`, `clearNamespaceBundleBacklog` and `unsubscribeNamespace` require `consume` permission on the namespace to allow execution
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] michaeljmarshall merged pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
michaeljmarshall merged pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987531379
> If all consume roles could modify the namespace level subscription-related policies, do it may cause some confusion?
In fact, this problem still exists if the tenant has multiple `admin-roles`, maybe we need to discuss it separately.
https://github.com/apache/pulsar/blob/47e4f38f2ed10f9b9492ebeb3e1424da18ab3655/pulsar-client-tools/src/main/java/org/apache/pulsar/admin/cli/CmdTenants.java#L61-L63
But in terms of the operation permission for subscription-related policies, it should be more reasonable to converge to a role that can `consume` namespace.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987606683
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987624154
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994470011
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987548978
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987592604
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hsaputra edited a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
hsaputra edited a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-1005218640
This seems like another breaking changes that impact the implementations of the AuthorizationProvider?
Could we be more gentle and considerate when making these kind of "improvements " ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994904035
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994895620
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994587001
> I think this PR introduces breaking changes for any existing third party implementations of the `AuthorizationProvider`.
>
> @yuruguo - is your proposal to make it possible for a non admin user to have sufficient permission to update these namespace policies? As currently written, I think these operations fall within the role of the tenant admin (although I'm not sure we have this defined explicitly somewhere).
>
> (Requesting changes to prevent this from being merged for now.)
I have updated [Motivation](https://github.com/apache/pulsar/pull/13157#issue-1072782305) and Code, PTAL, thx!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on a change in pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on a change in pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#discussion_r770186142
##########
File path: pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/v1/Namespaces.java
##########
@@ -122,7 +122,7 @@
@Path("/{property}/{cluster}/{namespace}/destinations")
@ApiOperation(hidden = true, value = "Get the list of all the topics under a certain namespace.",
response = String.class, responseContainer = "Set")
- @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin permission"),
+ @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin or consume permission on namespace"),
Review comment:
@gaoran10 @michaeljmarshall Thanks for you suggestion :)
This is a correction of known inaccurate annonations, not limited to `namespace polocies` operation, including: `getTopics`, `clearNamespaceBundleBacklog`, `unsubscribeNamespace`, etc. so perhaps `Don't have admin or operate permission on the namespace` is more general, what do you think?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] gaoran10 commented on a change in pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
gaoran10 commented on a change in pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#discussion_r769937630
##########
File path: pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/v1/Namespaces.java
##########
@@ -122,7 +122,7 @@
@Path("/{property}/{cluster}/{namespace}/destinations")
@ApiOperation(hidden = true, value = "Get the list of all the topics under a certain namespace.",
response = String.class, responseContainer = "Set")
- @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin permission"),
+ @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin or consume permission on namespace"),
Review comment:
Maybe we need to modify the message, such as "Don't have admin or operate policies permission on the namespace".
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-996440639
@codelipenghui @freeznet PTAL, thx!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987502487
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] michaeljmarshall commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
michaeljmarshall commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-1006087757
Hi @hsaputra - you're right that it would impact external implementations. There is already a PR to revert this commit. There is ongoing discussion there. https://github.com/apache/pulsar/pull/13463
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987569933
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987592604
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987560978
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994467051
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994904035
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hsaputra commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
hsaputra commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-1005968196
Hi @eolivelli - sorry, I did not mean broken compatibility, but more of may add potential of breaking changes for external implementation of AuthorizationProvider to handle new operations need to be handled.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-994470011
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on a change in pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on a change in pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#discussion_r770052795
##########
File path: pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/v1/Namespaces.java
##########
@@ -122,7 +122,7 @@
@Path("/{property}/{cluster}/{namespace}/destinations")
@ApiOperation(hidden = true, value = "Get the list of all the topics under a certain namespace.",
response = String.class, responseContainer = "Set")
- @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin permission"),
+ @ApiResponses(value = {@ApiResponse(code = 403, message = "Don't have admin or consume permission on namespace"),
Review comment:
So “ Don't have operate policies permission on the namespace” is better? @michaeljmarshall @gaoran10
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] eolivelli commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
eolivelli commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-1005948490
@hsaputra in this case we have not broken compatibility.
What do you mean?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hsaputra commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
hsaputra commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-1006104606
Thanks for the follow up, @michaeljmarshall !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hsaputra commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
hsaputra commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-1005218640
This is another breaking changes that impact the implementations of the AuthorizationProvider =(
Could we be more gentle and considerate when making these kind of "improvements " ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz of ns policies from super-user to tenant-administrator
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-995249812
@merlimat @eolivelli @codelipenghui @hangc0276 ptal
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo commented on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo commented on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987557386
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] yuruguo removed a comment on pull request #13157: [Authorization] Converge authz to operate subscription conf of namespace
Posted by GitBox <gi...@apache.org>.
yuruguo removed a comment on pull request #13157:
URL: https://github.com/apache/pulsar/pull/13157#issuecomment-987557386
/pulsarbot run-failure-checks
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org