poorbarcode commented on PR #132: URL: https://github.com/apache/flink-connector-pulsar/pull/132#issuecomment-6431612834
Thanks for raising this. I revisited FLINK-32938 and the Pulsar authorization path. `Topics.getMessagesById` is authorized as `TopicOperation.PEEK_MESSAGES`, which `PulsarAuthorizationProvider` maps to `canConsumeAsync`, rather than tenant-admin or superuser access. Therefore this recovery check only requires consume permission on the sink topic; it does not require granting the Flink application admin privileges. The connector uses this read-only lookup only during transaction recovery to distinguish an already committed transaction from an uncommitted one. It does still require network access to the admin HTTP endpoint. Would that address the original concern, or is access to that endpoint itself disallowed in the intended deployment model? References: - https://github.com/apache/pulsar/blob/master/pulsar-broker/src/main/java/org/apache/pulsar/broker/admin/impl/PersistentTopicsBase.java#L3170-L3172 - https://github.com/apache/pulsar/blob/master/pulsar-broker-common/src/main/java/org/apache/pulsar/broker/authorization/PulsarAuthorizationProvider.java#L730-L750 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
