KIP-546 — Client-quota admin APIs

Status: implemented — back to the KIP index.

What the KIP changes in Apache Kafka

Kafka 2.6 added DescribeClientQuotas (key 48) and AlterClientQuotas (key 49): a unified admin surface over quota entities — user, client-id, ip, and their <default> variants — replacing direct ZooKeeper writes from kafka-configs.sh. Filters support exact-match, any, and default-entity components.

How kaas implements it

Both handlers (crates/kaas-broker/src/handlers/describe_client_quotas.rs and alter_client_quotas.rs, keys 48/49, v0–v1, flexible from v1) wrap the QuotaEnforcer in crates/kaas-auth/src/quota.rs — the same debt-carrying token bucket that throttles Produce/Fetch (KIP-13).

• Entity model: the user axis only. client-id / ip components return an empty result on describe and INVALID_REQUEST (42) on alter. match_type=DEFAULT (--entity-default) is unsupported — kaas users are CR-instantiated, there is no <default> entity.
• Describe resolves override > store > none: a runtime override wins, otherwise the store-backed value from credentials.json (materialised by the operator from KafkaUser.spec.quotas). Exact-match and list-all-users both work.
• Alter merges ops per key onto the user's current quotas (Apache semantics: SET replaces one key, remove drops one key, unspecified keys survive) and installs the result via set_user_quota, live-updating any existing token bucket. Known keys: producer_byte_rate, consumer_byte_rate, request_percentage; anything else answers INVALID_CONFIG (40). validate_only skips the install.
• Alterations are runtime-only and per-broker. The override lives in the enforcer's in-memory map: it does not survive a broker restart and is not broadcast to peer brokers. The durable, cluster-wide path is KafkaUser.spec.quotas (producerMaxByteRatePerBroker / consumerMaxByteRatePerBroker — named for the per-broker semantics, see Listeners & auth).
• request_percentage round-trips but is not enforced — only the byte-rate keys are wired into the bucket (apply_quotas reads just producer/consumer rates). Authorization follows Apache's mapping: describe → DescribeConfigs, alter → AlterConfigs, both on the cluster resource.

How it's verified

• crates/kaas-auth/src/quota.rs unit tests: set_user_quota_live_updates_existing_bucket, describe_user_quota_resolution_order (override > store precedence).
• crates/kaas-codec/src/api/alter_client_quotas.rs and describe_client_quotas.rs round-trip tests cover both versions.
• scripts/kafka-configs.sh scenarios 6–10 run quota CRUD plus a live 10 MB/s throttle probe through the real kafka-configs.sh tool. (Their labels still say XFAIL from before the quota engine landed — stale labels, the scenarios exercise the implemented path.)

See also the DescribeClientQuotas and AlterClientQuotas entries.