apache / apache/pulsar

Authorization and Geo-Replication are tightly coupled

Open
#20,023 2 comments 0 reactions 0 assignees View on GitHub
Stale type/enhancement
Dominant language
Java
Stars
15.3k
Forks
3.8k
Avg merge
1d 14h
Merged PRs (30d)
160

Description

### Search before asking

- [X] I searched in the [issues](https://github.com/apache/pulsar/issues) and found nothing similar.

### Motivation

While working on https://github.com/apache/pulsar/pull/19989, I ran into test failures in cases that didn't seem to make sense. See the comment and commit history for that PR for additional info. After additional research, I discovered this code:

https://github.com/apache/pulsar/blob/3b76dd435d1bb7f5f933dbc15307255c7c928ca4/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java#L508-L519

https://github.com/apache/pulsar/blob/3b76dd435d1bb7f5f933dbc15307255c7c928ca4/pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java#L536-L547

That code indicates that the logic for `getClusterDataIfDifferentCluster` changes depending on whether authorization is enabled. This is a surprising consequence, and it seems like we implicitly rely on the assumption that geo-replication will only be enabled when authorization is enabled.

Based on the tests that failed, it seems that getting an active cluster is dependent on this behavior. Other admin operations may be dependent on it too. In the past, I've tested geo-replication in the same k8s cluster (so I didn't have authorization enabled) and things seemed to work, so the dependency might only be for certain endpoints.

### Solution

See if it is possible to decouple authorization and `getClusterDataIfDifferentCluster`.

### Alternatives

If we need to retain this dependency, we should document why.

### Anything else?

_No response_

### Are you willing to submit a PR?

- [ ] I'm willing to submit a PR!

Contributor guide

Open the contributing guide

Research direction

Start with the linked sections of pulsar-broker/src/main/java/org/apache/pulsar/broker/web/PulsarWebResource.java, especially getClusterDataIfDifferentCluster, then review the comment and commit history for PR 19989. Trace which active-cluster and other admin operations depend on authorization, and define done as either decoupling the behaviors or documenting the required dependency.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization, distributed-systems
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.