Hi Pulsar community,
I would like to start a discussion for PIP-471: Authorization Operation Metrics. PIP PR: https://github.com/apache/pulsar/pull/25513 This PIP proposes adding low-cardinality broker authorisation metrics for authorisation outcomes. Today, Pulsar has authentication-related metrics, but authorisation denials are mostly visible through logs, request failures, or client-side errors. That makes it difficult for operators to alert on authorisation failures, compare failures with successful authorisation checks, or build dashboards around authorisation behaviour. The proposed metrics are: Prometheus: pulsar_authorization_operations_total{resource_type, operation, result} OpenTelemetry: - pulsar.authorization.operation.count Attributes: - pulsar.authorization.resource.type - pulsar.authorization.operation - pulsar.authorization.result The result value is one of: - success: the authorization request was allowed - failure: the authorization request was denied or rejected by authorization handling - error: authorization evaluation failed before an allow/deny decision was returned The resource_type value is selected from a fixed low-cardinality set, such as: - topic - namespace - tenant - broker - cluster - superuser - tenant_admin - topic_policy - namespace_policy - cluster_policy The proposal intentionally avoids high-cardinality or identity-bearing labels such as role, principal, topic name, namespace name, tenant name, client address, provider name, or error message. It is intended as an operational metric, not an audit log replacement. Please take a look and share your feedback. Thanks, Mattison Sent with Notion Mail <https://www.notion.so/product/mail>
