[
https://issues.apache.org/jira/browse/KAFKA-20667?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101137#comment-18101137
]
Yunseop Eom commented on KAFKA-20667:
-------------------------------------
Opened PR https://github.com/apache/kafka/pull/23036.
This adds a persistent principal index to AclCache and uses it during
StandardAuthorizerData authorization, so each request scans ACLs for the
request principal and wildcard principal instead of all ACLs in the resource
section. The resource index is still checked separately to preserve
default-allow semantics when unrelated ACLs exist.
Verification: the new AclCache add/remove test, the full :metadata:test suite
including StandardAuthorizerPropertyTest, :metadata:spotlessCheck, and git diff
--check pass. Awaiting maintainer review.
> O(N) ACL scan in StandardAuthorizerData.checkSection
> -----------------------------------------------------
>
> Key: KAFKA-20667
> URL: https://issues.apache.org/jira/browse/KAFKA-20667
> Project: Kafka
> Issue Type: Bug
> Components: core
> Affects Versions: 3.9.2
> Reporter: ibenchhida
> Priority: Critical
> Labels: authorization, perfomance
>
> Root cause: checkSection() iterates all ACLs sharing the same resource
> pattern via TreePSet.tailSet(), calling HashSet.contains per ACL × topic.
> With 504 topics × 7001 ACLs → ~3.5M iterations per MetadataRequest.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
