-
Notifications
You must be signed in to change notification settings - Fork 15
Open
Labels
bugSomething isn't workingSomething isn't working
Description
Describe the bug
The reset-offset API allows to reset-offset any topic as long as the namespace has the ownership of the consumer group, even if the namespace has no READ or OWNER ACL on the topic.
To Reproduce
Steps to reproduce the behavior:
- Create the namespaces
ns1andns2with respective ownership onns1.andns2.prefixed topics and prefixed consumer groups. - With the namespace
ns1, create a topicns1.topic - With the namespace
ns2, call the reset-offset APIPOST /api/namespaces/ns2/consumer-groups/ns2.consumer-group/resetand the following body:
{
"apiVersion": "v1",
"kind": "ConsumerGroupResetOffsets",
"metadata": {
"name": "ns2.consumer-group",
"namespace": "ns2"
},
"spec": {
"topic": "ns1.topic",
"method": "TO_EARLIEST"
}
}- The namespace
ns2does not have a READ ACL on the topicns1.topic, but the API doesn't return an authorization error response (status code 422?).
Environment
- Ns4Kafka version: v1.16.0
- Kafka broker type and version: N/A
Steps taken to try and solve the problem
A new checker can be added to check the topic
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working