lh0156 opened a new pull request, #23036: URL: https://github.com/apache/kafka/pull/23036
## Summary `StandardAuthorizerData.checkSection` currently scans every ACL in the relevant resource section before filtering by principal. With many ACLs and a metadata request covering many topics, this repeats the same unrelated principal checks for every topic. This change adds a persistent, immutable ACL index keyed by principal. Authorization now searches the request principal's ACLs and the wildcard-principal ACLs while retaining the resource index for the existing default-allow semantics. ACL add and remove operations update both indexes atomically through the existing copy-on-write cache snapshots. ## Jira https://issues.apache.org/jira/browse/KAFKA-20667 ## Testing * `./gradlew :metadata:test --tests org.apache.kafka.metadata.authorizer.AclCacheTest --tests org.apache.kafka.metadata.authorizer.StandardAuthorizerTest` * `./gradlew :metadata:test` * `./gradlew :metadata:spotlessCheck` * `git diff --check` The tests cover principal-index add/remove behavior and the existing authorization semantics, including prefix ACLs, wildcard ACLs, deny precedence, and the default-allow behavior when a resource has ACLs for another principal. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
