Class IpFilteringAuthMetrics

java.lang.Object
io.confluent.security.auth.ipFiltering.IpFilteringAuthMetrics
public class IpFilteringAuthMetrics extends Object
Metrics for IP Filtering authorization rule evaluation, modeled on EmbeddedAuthorizer.AuthorizerMetrics. IP Filtering is a DENY-only feature, so unlike the general authorizer there is no "allowed" rule to count; the model is an evaluation that either denies (host not within the allowed CIDRs) or does nothing. Denials are split by action.logIfDenied() so that client-facing rejections are distinguishable from the high-volume resource-filter checks the broker runs while building metadata/list responses.

A fail-close denial (an IP-Filtering-enabled org whose request resolves to no operation group) is recorded only as an error and kept out of the denied counters, mirroring how the general authorizer treats AUTHORIZER_FAILED.

  • Field Details

  • Constructor Details

    • IpFilteringAuthMetrics

      public IpFilteringAuthMetrics(org.apache.kafka.common.metrics.Metrics metrics, org.apache.kafka.common.utils.Time time)

  • Method Details

    • recordDenied

      public void recordDenied(boolean logIfDenied)
      Records a denial caused by an IP filtering rule. logIfDenied distinguishes a client-facing request denial from a resource-filter check (e.g. metadata listing).

    • recordMissingOperationGroupError

      public void recordMissingOperationGroupError()
      Records a fail-close denial where an IP-Filtering-enabled org had no operation-group mapping.

    • recordLatency

      public void recordLatency(long latencyMs)
      Records the latency of an IP filtering rule evaluation in milliseconds.