diff --git a/website/docs/maintenance/configuration.md b/website/docs/maintenance/configuration.md index eedb1b821b..fdbdbbf65b 100644 --- a/website/docs/maintenance/configuration.md +++ b/website/docs/maintenance/configuration.md @@ -53,6 +53,7 @@ below can be modified while the Fluss cluster is running. | authorizer.enabled | Boolean | false | Specifies whether to enable the authorization feature. If enabled, access control is enforced based on the authorization rules defined in the configuration. If disabled, all operations and resources are accessible to all users. | | authorizer.type | String | default | Specifies the type of authorizer to be used for access control. This value corresponds to the identifier of the authorization plugin. The default value is `default`, which indicates the built-in authorizer implementation. Custom authorizers can be implemented by providing a matching plugin identifier. | | super.users | String | (None) | A semicolon-separated list of superusers who have unrestricted access to all operations and resources. Note that the delimiter is semicolon since SSL user names may contain comma, and each super user should be specified in the format `principal_type:principal_name`, e.g., `User:admin;User:bob`. This configuration is critical for defining administrative privileges in the system. | +| security.acl.principal.ignore-case | Boolean | false | Whether to perform case-insensitive matching on principal name and type during ACL authorization checks. When set to true, principals such as `User:Admin` and `user:admin` will be treated as the same principal. The default is false for strict case-sensitive matching. | | server.io-pool.size | Integer | 10 | The size of the IO thread pool to run blocking operations for both coordinator and tablet servers. This includes discard unnecessary snapshot files, transfer kv snapshot files, and transfer remote log files. Increase this value if you experience slow IO operations. The default value is 10. | @@ -91,6 +92,8 @@ The logging-related environment options (`env.log.dir`, `env.log.level`, `env.lo |--------------------------------------------------|------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | tablet-server.id | Integer | (None) | The id for the tablet server. | | tablet-server.rack | String | (None) | The rack for the TabletServer. This will be used in rack aware bucket assignment for fault tolerance. Examples: `RACK1`, `cn-hangzhou-server10` | +| tablet-server.advertised-resource.cpu-cores | Double | (None) | The CPU capacity, in cores, that this tablet server advertises to the CoordinatorServer for resource reporting. This option does not limit CPU usage or configure a cgroup CPU quota. If not configured, the tablet server detects the value from cgroup CPU quota or the JVM runtime. | +| tablet-server.advertised-resource.memory-size | MemorySize | (None) | The memory capacity that this tablet server advertises to the CoordinatorServer for resource reporting and cluster-level KV leader replica capacity estimation. This option does not configure JVM heap size, reserve memory, or enforce a process or container memory limit. It represents total usable capacity, not current memory usage or free memory. If not configured, the tablet server detects the value from cgroup or operating system information. | | data.dir | String | /tmp/fluss-data | This configuration controls the directory where Fluss will store its data. The default value is /tmp/fluss-data | | server.writer-id.expiration-time | Duration | 7d | The time that the tablet server will wait without receiving any write request from a client before expiring the related status. The default value is 7 days. | | server.writer-id.expiration-check-interval | Duration | 10min | The interval at which to remove writer ids that have expired due to `server.writer-id.expiration-time passing. The default value is 10 minutes. | diff --git a/website/docs/security/authorization.md b/website/docs/security/authorization.md index 0287bbe23b..f38c201b05 100644 --- a/website/docs/security/authorization.md +++ b/website/docs/security/authorization.md @@ -14,6 +14,7 @@ Fluss provides a pluggable authorization framework that uses Access Control List |--------------------|---------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | authorizer.enabled | Boolean | false | Specifies whether to enable the authorization feature. | | authorizer.type | String | default | Specifies the type of authorizer to be used for access control. This value corresponds to the identifier of the authorization plugin. The default value is `default`, which indicates the built-in authorizer implementation. Custom authorizers can be implemented by providing a matching plugin identifier. | +| security.acl.principal.ignore-case | Boolean | false | Whether to perform case-insensitive matching on principal name and type during ACL authorization checks. When set to true, principals such as `User:Admin` and `user:admin` will be treated as the same principal. The default is false for strict case-sensitive matching. | ## Core Components of ACLs diff --git a/website/docs/security/overview.md b/website/docs/security/overview.md index aecbf87a51..24609599d3 100644 --- a/website/docs/security/overview.md +++ b/website/docs/security/overview.md @@ -91,6 +91,7 @@ Fluss provides a pluggable authorization framework that uses Access Control List | authorizer.enabled | Boolean | false | Specifies whether to enable the authorization feature. | | authorizer.type | String | default | Specifies the type of authorizer to be used for access control. This value corresponds to the identifier of the authorization plugin. The default value is `default`, which indicates the built-in authorizer implementation. Custom authorizers can be implemented by providing a matching plugin identifier. | | super.users | String | (None) | A semicolon-separated list of super users who have unrestricted access to all operations and resources. Note that the delimiter is semicolon since SSL user names may contain comma, and each super user should be specified in the format `principal_type:principal_name`, e.g., `User:admin;User:bob`. This configuration is critical for defining administrative privileges in the system. | +| security.acl.principal.ignore-case | Boolean | false | Whether to perform case-insensitive matching on principal name and type during ACL authorization checks. When set to true, principals such as `User:Admin` and `user:admin` will be treated as the same principal. The default is false for strict case-sensitive matching. | ## Security Workflow When Client Established a Connection