[KAFKA-17315] Fix the behavior of delegation tokens that expire immediately upon creation in KRaft mode

• Type: Improvement
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 3.9.0, 3.7.2, 3.8.1
• Assignee: TengYao Chi
• Reporter: Chia-Ping Tsai
• Created: 11/Aug/24 22:19
• Updated: 01/Sep/24 13:21
• Resolved: 25/Aug/24 00:10

Description

In kraft mode, expiring delegation token (`expiryTimePeriodMs` < 0) has following different behavior to zk mode.

1. `ExpiryTimestampMs` is set to "expiryTimePeriodMs" [0] rather than "now" [1]
2. it throws exception directly if the token is expired already [2]. By contrast, zk mode does not. [3]

[0] https://github.com/apache/kafka/blob/49fc14f6116a697550339a8804177bd9290d15db/metadata/src/main/java/org/apache/kafka/controller/DelegationTokenControlManager.java#L316
[1] https://github.com/apache/kafka/blob/49fc14f6116a697550339a8804177bd9290d15db/core/src/main/scala/kafka/server/DelegationTokenManagerZk.scala#L292
[2] https://github.com/apache/kafka/blob/49fc14f6116a697550339a8804177bd9290d15db/metadata/src/main/java/org/apache/kafka/controller/DelegationTokenControlManager.java#L305
[3] https://github.com/apache/kafka/blob/49fc14f6116a697550339a8804177bd9290d15db/core/src/main/scala/kafka/server/DelegationTokenManagerZk.scala#L293

Issue Links

• relates to: KAFKA-17417 Backport KAFKA-15751 and KAFKA-15752 to 3.8 and 3.7
• links to: GitHub Pull Request #16858