The Strimzi Quotas plugin offers a possibility to specify excluded principals that should be excluded from the quotas set by users. That works for the principals that uses other mechanism than SSL - so for example users like my-user.
But in case that we want to specify the SSL principal like User:CN=my-user,O=io.strimzi it is parsed as two users - User:CN=my-user and O=io.strimzi - because the excluded principals are specified as a comma-separated list (which is also the parsing mechanism inside of the plugin).
I think that the users should be "semicolon-separated" list, as it is for the super.users list for authorization.
- links to
-
RHSA-2024:142550 Streams for Apache Kafka 2.8.0 release and security update