spetz opened a new pull request, #4615: URL: https://github.com/apache/iggy/pull/4615
Stream, topic and user settings followed separate paths. Updating one setting meant resending the name and every other field, nothing could return a setting to its default, and each SDK encoded options its own way per resource and transport. Encryption shared one data key across all streams, and a read could not tell which key a stream used. Route every create and update through one scoped catalog on the existing ResourceOptions map. Each key declares its scopes, kind, storage, mutability, default, visibility and criticality, and one admission path enforces it on every transport. UpdateResource carries only the keys that change and explicit resets, and metadata prepare resolves it into a per-scope internal operation so defaults are replicated, not recomputed. Names and user status stay indexed columns while the catalog validates them. Give every encrypted stream its own data key, supplied by the client or generated by the admitting node, and store it only inside an authenticated envelope wrapped under a key derived from the config key. Reads expose the key source and fingerprints, never key bytes. Rotating the config key replicates rewrapped envelopes and leaves message data untouched, and boot refuses envelopes the configured keys cannot open. Typed options replace raw maps in every SDK, with a raw escape hatch for keys newer than the SDK. Unknown critical state fails closed. Protocol 0.12.0 and snapshot format 13 move together because both layouts change. BREAKING CHANGE: clients and servers must run protocol 0.12.0, data directories need snapshot format 13, and UpdateStream, UpdateTopic and UpdateUser are replaced by UpdateResource. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
