iloveeyjafjalla opened a new issue, #6850:
URL: https://github.com/apache/rocketmq-dashboard/issues/6850
## Summary
`POST /api/acl/push-to-broker` installs every stored ACL account and policy
on **every** master behind the instance's endpoint, instead of only on the
brokers of the cluster the instance is configured for. Where the endpoint's
NameServer serves several clusters, the ACL page shows one cluster's rules
while the push writes the dashboard's credentials and policies into another
cluster's brokers, and reports those upserts as successes.
## Why
- The push resolves its broker list from the whole cluster table:
`AclService.masterAddresses(...)` walks
`admin.examineBrokerClusterInfo().getBrokerAddrTable().values()` —
`server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclService.java:488`
— and `pushAclToBroker` runs `upsertAccount` for every entry of that list
(`:366`, `:378`).
- The read path of the same page does the opposite: it resolves the
instance's configured cluster and narrows the topology before touching a broker
(`server/src/main/java/org/apache/rocketmq/studio/instance/acl/ApacheAclReadService.java:40-44`
with `scopedBrokerNames`). That scoping is what #6502 added; the push kept the
unscoped table.
- The pre-flight ACL 2.0 switch check is made against `masters.get(0)`, an
arbitrary broker of that unscoped list, so it can read the *other* cluster's
`authenticationEnabled`/`authorizationEnabled` values.
## Impact
An instance whose endpoint is a shared NameServer and whose configuration
names one cluster (the shape #6502 exists for) pushes its accounts — username
and secret — and its rules into a cluster it is not bound to. The response
(`PushAclToBrokerResultVO.brokers` and the per-account `brokers[]`) and the
`PUSH_ACL_TO_BROKER` audit record report those writes as successful, so nothing
in the console distinguishes them from the intended ones.
## Reproduction
`AclServiceTest.pushAclToBrokerTouchesOnlyTheConfiguredClusterOfASharedNameServerTest`
builds the shared-NameServer topology (`cluster-a` → `10.0.0.1:10911`,
`cluster-b` → `10.0.0.2:10911`), configures the instance for `cluster-a`,
stores one account and pushes it:
```
expected: ["10.0.0.1:10911"]
but was: ["10.0.0.1:10911", "10.0.0.2:10911"]
```
The same test verifies that no `createUser` / `updateUser` / `updateAcl` /
`getBrokerConfig` call reaches `10.0.0.2:10911`.
## Expected
The push touches only the brokers of the instance's configured cluster, and
an instance that names no cluster keeps every master of the endpoint
(`pushAclToBrokerKeepsEveryMasterWhenTheInstanceNamesNoClusterTest`).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
