Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[v23.1.x] admin: drop no-op user requests before writing to controller log #9855

Merged
merged 2 commits into from
Apr 11, 2023
Merged

[v23.1.x] admin: drop no-op user requests before writing to controller log #9855

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1e539fa
admin: skip controller writes for no-op user actions
jcsp Apr 5, 2023
75a2fd9
admin: redirect user writes to controller leader
jcsp Apr 5, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
53 changes: 53 additions & 0 deletions src/v/redpanda/admin_server.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1666,8 +1666,26 @@ static bool match_scram_credential(
}
}

bool is_no_op_user_write(
security::credential_store& store,
security::credential_user username,
security::scram_credential credential) {
auto user_opt = store.get<security::scram_credential>(username);
if (user_opt.has_value()) {
return user_opt.value() == credential;
} else {
return false;
}
}

ss::future<ss::json::json_return_type>
admin_server::create_user_handler(std::unique_ptr<ss::httpd::request> req) {
if (need_redirect_to_leader(model::controller_ntp, _metadata_cache)) {
// In order that we can do a reliably ordered validation of
// the request (and drop no-op requests), run on controller leader;
throw co_await redirect_to_leader(*req, model::controller_ntp);
}

auto doc = parse_json_body(*req);

auto credential = parse_scram_credential(doc);
Expand All @@ -1679,6 +1697,15 @@ admin_server::create_user_handler(std::unique_ptr<ss::httpd::request> req) {

auto username = security::credential_user(doc["username"].GetString());

if (is_no_op_user_write(
_controller->get_credential_store().local(), username, credential)) {
vlog(
logger.debug,
"User {} already exists with matching credential",
username);
co_return ss::json::json_return_type(ss::json::json_void());
}

auto err
= co_await _controller->get_security_frontend().local().create_user(
username, credential, model::timeout_clock::now() + 5s);
Expand All @@ -1703,8 +1730,19 @@ admin_server::create_user_handler(std::unique_ptr<ss::httpd::request> req) {

ss::future<ss::json::json_return_type>
admin_server::delete_user_handler(std::unique_ptr<ss::httpd::request> req) {
if (need_redirect_to_leader(model::controller_ntp, _metadata_cache)) {
// In order that we can do a reliably ordered validation of
// the request (and drop no-op requests), run on controller leader;
throw co_await redirect_to_leader(*req, model::controller_ntp);
}

auto user = security::credential_user(req->param["user"]);

if (!_controller->get_credential_store().local().contains(user)) {
vlog(logger.debug, "User '{}' already gone during deletion", user);
co_return ss::json::json_return_type(ss::json::json_void());
}

auto err
= co_await _controller->get_security_frontend().local().delete_user(
user, model::timeout_clock::now() + 5s);
Expand All @@ -1719,12 +1757,27 @@ admin_server::delete_user_handler(std::unique_ptr<ss::httpd::request> req) {

ss::future<ss::json::json_return_type>
admin_server::update_user_handler(std::unique_ptr<ss::httpd::request> req) {
if (need_redirect_to_leader(model::controller_ntp, _metadata_cache)) {
// In order that we can do a reliably ordered validation of
// the request (and drop no-op requests), run on controller leader;
throw co_await redirect_to_leader(*req, model::controller_ntp);
}

auto user = security::credential_user(req->param["user"]);

auto doc = parse_json_body(*req);

auto credential = parse_scram_credential(doc);

if (is_no_op_user_write(
_controller->get_credential_store().local(), user, credential)) {
vlog(
logger.debug,
"User {} already exists with matching credential",
user);
co_return ss::json::json_return_type(ss::json::json_void());
}

auto err
= co_await _controller->get_security_frontend().local().update_user(
user, credential, model::timeout_clock::now() + 5s);
Expand Down