DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
Currently, when describing config for a resource, we'll get `null` if the config is a sensitive config, ex: "ssl.keystore.certificate.chain", "ssl.keystore.password". And when describing configs with them it'll always return something like this:
| Code Block |
|---|
> bin/kafka-configs.sh --bootstrap-server localhost:9092 --entity-type brokers --entity-name 2 --describe
Dynamic configs for broker 2 are:
listener.name.myssl.ssl.keystore.key=null sensitive=true synonyms={DYNAMIC_BROKER_CONFIG:listener.name.myssl.
=null} |
...
- The user will update the ssl.keystore.location, ssl.keystore.password, ssl.keystore.type in the vault.
- After the updates are complete he will send a adminClient request to the broker to notify that configs are updated.
- Once the Broker receives a alteredConfig request it will invoke the get function in VaultConfigProvider.
- The VaultConfigProvider will fetch the actual values for ssl.keystore.location, ssl.keystore.password, ssl.keystore.type from the vault.
- The broker will validate these configs and apply the changes.
In the step (2b), the operator needs a way to know what if the current state of these configs before updating it. With current design, the operator will never know it, and blindly run the alter config multiple times, or worse, the operator thought it is already updated and skipped this update, and cause the broker connection failure.
...
Because the metadata configs are internal configs, it cannot be shown as an config entry when describing configs. Instead, the metadata value will be injected merged into the mapping confidential config as "lastUpdatedTimestamp" field. When describing the config, we'll see it:
...
| Code Block |
|---|
> bin/kafka-configs.sh --bootstrap-server localhost:9092 --entity-type brokers --entity-name 2 --describe --all // non-sensitive field will not show "lastUpdatedTimestamp" field as before advertised.listeners=PLAINTEXT://localhost:9092 sensitive=false synonyms={STATIC_BROKER_CONFIG:advertised.listeners=PLAINTEXT://localhost:9092} ... // sensitive field will show "lastUpdatedTimestamp" field. If it is not changed before, it'll be -1. listener.name.sslnochange.ssl.key.password=null sensitive=true synonyms={STATIC_BROKER_CONFIG:listener.name.plaintext.ssl.key.password=null, STATIC_BROKER_CONFIG:ssl.key.password=null} lastUpdatedTimestamp=-1 // If it is changed, it'll return the last updated timestamp listener.name.ssl.ssl.key.password=null sensitive=true synonyms={STATIC_BROKER_CONFIG:listener.name.ssl.ssl.key.password=null, STATIC_BROKER_CONFIG:ssl.key.password=null} lastUpdatedTimestamp=1731651970963 |
Note:
(1) When the lastUpdatedTimestamp is -1, it means it has never dynamically updated before.
(2) The value of metadata configs will only be honored for DYNAMIC_BROKER_CONFIG. That is, if the value is from DYNAMIC_DEFAULT_BROKER_CONFIG or STATIC_BROKER_CONFIG (from properties file), it'll be ignored because the sensitive configs are all per-broker configs, only DYNAMIC_BROKER_CONFIG update is possible.
Thus, in DescribeConfigsResponse, we need to add one "LastUpdatedTimestamp" field to it.
...
| Code Block |
|---|
{
"apiKey": 32,
"type": "response",
"name": "DescribeConfigsResponse",
// Version 1 adds ConfigSource and the synonyms.
// Starting in version 2, on quota violation, brokers send out responses before throttling.
// Version 4 enables flexible versions.
// Version 5 adds "LastUpdateTimestampLastUpdateTimestampMs" field
"validVersions": "0-5",
"flexibleVersions": "5+",
"fields": [
{ "name": "ThrottleTimeMs", "type": "int32", "versions": "0+",
"about": "The duration in milliseconds for which the request was throttled due to a quota violation, or zero if the request did not violate any quota." },
{ "name": "Results", "type": "[]DescribeConfigsResult", "versions": "0+",
"about": "The results for each resource.", "fields": [
{ "name": "ErrorCode", "type": "int16", "versions": "0+",
"about": "The error code, or 0 if we were able to successfully describe the configurations." },
{ "name": "ErrorMessage", "type": "string", "versions": "0+", "nullableVersions": "0+",
"about": "The error message, or null if we were able to successfully describe the configurations." },
{ "name": "ResourceType", "type": "int8", "versions": "0+",
"about": "The resource type." },
{ "name": "ResourceName", "type": "string", "versions": "0+",
"about": "The resource name." },
{ "name": "Configs", "type": "[]DescribeConfigsResourceResult", "versions": "0+",
"about": "Each listed configuration.", "fields": [
{ "name": "Name", "type": "string", "versions": "0+",
"about": "The configuration name." },
{ "name": "Value", "type": "string", "versions": "0+", "nullableVersions": "0+",
"about": "The configuration value." },
{ "name": "ReadOnly", "type": "bool", "versions": "0+",
"about": "True if the configuration is read-only." },
{ "name": "IsDefault", "type": "bool", "versions": "0",
"about": "True if the configuration is not set." },
// Note: the v0 default for this field that should be exposed to callers is
// context-dependent. For example, if the resource is a broker, this should default to 4.
// -1 is just a placeholder value.
{ "name": "ConfigSource", "type": "int8", "versions": "1+", "default": "-1", "ignorable": true,
"about": "The configuration source." },
{ "name": "IsSensitive", "type": "bool", "versions": "0+",
"about": "True if this configuration is sensitive." },
{ "name": "Synonyms", "type": "[]DescribeConfigsSynonym", "versions": "1+", "ignorable": true,
"about": "The synonyms for this configuration key.", "fields": [
{ "name": "Name", "type": "string", "versions": "1+",
"about": "The synonym name." },
{ "name": "Value", "type": "string", "versions": "1+", "nullableVersions": "0+",
"about": "The synonym value." },
{ "name": "Source", "type": "int8", "versions": "1+",
"about": "The synonym source." }
]},
{ "name": "ConfigType", "type": "int8", "versions": "3+", "default": "0", "ignorable": true,
"about": "The configuration data type. Type can be one of the following values - BOOLEAN, STRING, INT, SHORT, LONG, DOUBLE, LIST, CLASS, PASSWORD" },
{ "name": "Documentation", "type": "string", "versions": "3+", "nullableVersions": "0+", "ignorable": true,
"about": "The configuration documentation." },
// newly added field
{ "name": "LastUpdateTimestampLastUpdateTimestampMs", "type": "int64", "versions": "5+", "ignorable": true,
"about": "The last updated timestamp for this config." }
]}
]}
]
} |
...