[KAFKA-9392] Document and add test for deleteAcls that match single/multiple resources

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.6.0
• Component/s: security
• Assignee: Rajini Sivaram
• Reporter: Rajini Sivaram
• Reviewer: Manikumar
• Created: 09/Jan/20 13:17
• Updated: 01/Jun/20 16:22
• Resolved: 01/Jun/20 16:22

Description

From PR review of https://github.com/apache/kafka/pull/7911:

If you do Admin.createAcls() followed by Admin.deleteAcls(), if you specify the ACL in both cases, you are guaranteed to delete the ACL regardless of which broker handles the request. If you use a matching filter that doesn't specify the resource pattern for deleteAcls, then we don't provide that guarantee.

We should document this and add a deterministic test for the guaranteed behaviour to ensure we don't regress.

Issue Links

• links to: GitHub Pull Request #7956