Skip to content

Conversation

@ThomasCAI-mlv
Copy link
Collaborator

@ThomasCAI-mlv ThomasCAI-mlv commented Sep 15, 2025

This PR attempts to fix the issue #631:

The issue
When the namespace has one LITERAL ACL and one PREFIXED ACL on the same resource myTopic, if the ns4kafka name of the LITERAL ACL comes first in alphanumerical order, then the PREFIXED ACL is removed when computing the regex patterns given to AKHQ in the AKHQ claim V3 API /akhq-claim/v3.

The fix

  1. In the acl.forEach iterations in the method generateClaimV3, I added the pattern type (PREFIXED or LITERAL) to the key in bindings so that both ACLs on the same resource are added to the Map and taken into account in the regex patterns (^\\QmyTopic\\E$ and ^\\QmyTopic\\E.*$).
  • Before the fix, if the LITERAL ACL comes first in the list of ACLs, all the next ACLs which share the same resource will be ignored: in this issue, the PREFIXED ACL will be ignored.
  • The issue doesn't happen when the PREFIXED ACL comes first, because ignoring the LITERAL ACL is the wanted behaviour.
  1. In the method optimizeAcl which should remove already covered ACLs from the ACLs list, I removed the resource name filter !accessControlEntryOther.getSpec().getResource().equals(accessControlEntry.getSpec().getResource()) and added a filter on the ns4kafka ACL name:
  • The resource name filter hinders the correct ACL optimization: when there are 2 ACLs on the same resource, both are kept.
  • I think the resource name filter was originally put so that an ACL is not compared with itself.
  • The ns4kafka ACL name filter works better so that an ACL is not compared with itself, since it is mandatory & unique in each namespace.

Any of the 2 points would have fixed the issue, I implemented both to make sure there is no more issue regarding same resource ACLs in AKHQ claims.

Additional changes

  • Refactored the operations stream().filter().map().anyMatch() by stream().anyMatch() for readability in optimizeAcl
  • Renamed accessControlEntry to acl, and accessControlEntryOther to aclOther for readability in optimizeAcl
  • Added the metadata.name field in all AKHQ claim unit tests, since it is now used in the optimizeAcl method

@ThomasCAI-mlv ThomasCAI-mlv self-assigned this Sep 15, 2025
@ThomasCAI-mlv ThomasCAI-mlv added the bug Something isn't working label Sep 15, 2025
@sonarqubecloud
Copy link

@ThomasCAI-mlv ThomasCAI-mlv changed the title Fix ACL optimization in AKHQ claim v3 API Fix wrong resource patterns in AKHQ claim v3 API Sep 16, 2025
@loicgreffier loicgreffier merged commit 3e346d5 into master Sep 29, 2025
5 checks passed
@loicgreffier loicgreffier deleted the fix/akhq-claim-same-resource-acls branch September 29, 2025 21:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

AKHQ v3 claims wrong regex patterns with ACLs on the same resource

2 participants