You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by GitBox <gi...@apache.org> on 2020/07/07 06:33:22 UTC
[GitHub] [pulsar] srkukarni opened a new pull request #7466: Differentiate authorization between source/sink/function operations
srkukarni opened a new pull request #7466:
URL: https://github.com/apache/pulsar/pull/7466
<!--
### Contribution Checklist
- Name the pull request in the form "[Issue XYZ][component] Title of the pull request", where *XYZ* should be replaced by the actual issue number.
Skip *Issue XYZ* if there is no associated github issue for this pull request.
Skip *component* if you are unsure about which is the best component. E.g. `[docs] Fix typo in produce method`.
- Fill out the template below to describe the changes contributed by the pull request. That will give reviewers the context they need to do the review.
- Each pull request should address only one issue, not mix up code from multiple issues.
- Each commit in the pull request has a meaningful commit message
- Once all items of the checklist are addressed, remove the above text and this checklist, leaving only the filled out template below.
**(The sections below can be removed for hotfixes of typos)**
-->
*(If this PR fixes a github issue, please add `Fixes #<xyz>`.)*
Fixes #<xyz>
*(or if this PR is one task of a github issue, please add `Master Issue: #<xyz>` to link to the master issue.)*
Master Issue: #<xyz>
### Motivation
When doing any source/sink/function operation, we currently don't distinguish between sources, sinks and functions. However sources, sinks and functions are different operations, with different endpoints and often require different auth handling. This pr introduces a couple of new interfaces for checking auth for sources and sink operations.
### Modifications
*Describe the modifications you've done.*
### Verifying this change
- [ ] Make sure that the change passes the CI checks.
*(Please pick either of the following options)*
This change is a trivial rework / code cleanup without any test coverage.
*(or)*
This change is already covered by existing tests, such as *(please describe tests)*.
*(or)*
This change added tests and can be verified as follows:
*(example:)*
- *Added integration tests for end-to-end deployment with large payloads (10MB)*
- *Extended integration test for recovery after broker failure*
### Does this pull request potentially affect one of the following parts:
*If `yes` was chosen, please highlight the changes*
- Dependencies (does it add or upgrade a dependency): (yes / no)
- The public API: (yes / no)
- The schema: (yes / no / don't know)
- The default values of configurations: (yes / no)
- The wire protocol: (yes / no)
- The rest endpoints: (yes / no)
- The admin cli options: (yes / no)
- Anything that affects deployment: (yes / no / don't know)
### Documentation
- Does this pull request introduce a new feature? (yes / no)
- If yes, how is the feature documented? (not applicable / docs / JavaDocs / not documented)
- If a feature is not applicable for documentation, explain why?
- If a feature is not documented yet in this PR, please create a followup issue for adding the documentation
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] jerrypeng commented on pull request #7466: Differentiate authorization between source/sink/function operations
Posted by GitBox <gi...@apache.org>.
jerrypeng commented on pull request #7466:
URL: https://github.com/apache/pulsar/pull/7466#issuecomment-655039973
@srkukarni can you add a note to the release notes about this?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] srkukarni commented on pull request #7466: Differentiate authorization between source/sink/function operations
Posted by GitBox <gi...@apache.org>.
srkukarni commented on pull request #7466:
URL: https://github.com/apache/pulsar/pull/7466#issuecomment-655060283
Added
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] srkukarni merged pull request #7466: Differentiate authorization between source/sink/function operations
Posted by GitBox <gi...@apache.org>.
srkukarni merged pull request #7466:
URL: https://github.com/apache/pulsar/pull/7466
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] jerrypeng commented on pull request #7466: Differentiate authorization between source/sink/function operations
Posted by GitBox <gi...@apache.org>.
jerrypeng commented on pull request #7466:
URL: https://github.com/apache/pulsar/pull/7466#issuecomment-654636960
@srkukarni my concern with this PR is BC. Currently, if a user has "functions" permission, the user can run sources, sinks, and functions. With this change, a user has to now have the specific entitlement of sources/sinks to run them as well.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] wolfstudy commented on pull request #7466: Differentiate authorization between source/sink/function operations
Posted by GitBox <gi...@apache.org>.
wolfstudy commented on pull request #7466:
URL: https://github.com/apache/pulsar/pull/7466#issuecomment-672863953
cherry-pick the pull request to `branch-2.6`(2.6.1)
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] srkukarni commented on pull request #7466: Differentiate authorization between source/sink/function operations
Posted by GitBox <gi...@apache.org>.
srkukarni commented on pull request #7466:
URL: https://github.com/apache/pulsar/pull/7466#issuecomment-654957607
Coming to think more about it, the existing sources/sinks will continue to run fine. Thus upon upgrade of cluster, things still will work ok, except that newer sources/sinks will need additional permissions. Couldn't that just be notes in upgrade process?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] srkukarni commented on pull request #7466: Differentiate authorization between source/sink/function operations
Posted by GitBox <gi...@apache.org>.
srkukarni commented on pull request #7466:
URL: https://github.com/apache/pulsar/pull/7466#issuecomment-654639242
@jerrypeng That is indeed a concern. Any ideas on how to solve it?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org