feat(kafka acl): add acl delete command

[craicoverflow]

This PR adds a command to delete ACLs which match criteria passed via filters.

Example interaction:

$ ./rhoas kafka acl delete --permission allow --operation all --topic rhoas --prefix --service-account srvc-acct-11924479-43fe-42b4-9676-cf0c9aca8136
⚠ The following ACLs will be deleted from Kafka instance "enda":

  PRINCIPAL                                        PERMISSION   OPERATION   DESCRIPTION                
 ------------------------------------------------ ------------ ----------- --------------------------- 
  srvc-acct-11924479-43fe-42b4-9676-cf0c9aca8136   ALLOW        ALL         TOPIC starts with "rhoas"  

? Are you sure you want to delete these ACLs? Yes

⣽ Deleting ACLs from Kafka instance "enda" 
✔️ Deleted 1 ACL from Kafka instance "enda"

I also refactored some of the ACL util files into one package.

Verification

This allows numerous operation combinations so will require extensive verification and testing. Run rhoas kafka acl delete and try a number of combinations.

[craicoverflow]

This ended up quite large, lots of boilerplate involved.

I will continue testing it tomorrow. But ready for review.

[rkpattnaik780]

./rhoas kafka acl delete --transactional-id "*" --operation all --permission allow --service-account srvc-acct-8c95ca5e1225-94a-41f1-ab97-aacf3df1

preview: All accounts ALLOW ALL TOPIC is "*"

[craicoverflow]

./rhoas kafka acl delete --transactional-id "*" --operation all --permission allow --service-account srvc-acct-8c95ca5e1225-94a-41f1-ab97-aacf3df1

preview: All accounts ALLOW ALL TOPIC is "*"

Is this a question?

[rkpattnaik780]

./rhoas kafka acl delete --transactional-id "*" --operation all --permission allow --service-account srvc-acct-8c95ca5e1225-94a-41f1-ab97-aacf3df1

preview: All accounts ALLOW ALL TOPIC is "*"

Is this a question?

Message got lost. On trying to delete a ACL for transactional id, topic is being accessed.

Command: ./rhoas kafka acl delete --user rkpattnaik780 --permission allow --operation describe --transactional-id all
Request URL: /rest/acls?operation=DESCRIBE&patternType=LITERAL&permission=ALLOW&principal=User%3Arkpattnaik780&resourceName=%2A&resourceType=TOPIC

[craicoverflow]

Thanks for catching that, it is fixed now.

[rkpattnaik780]

Command: ./rhoas kafka acl delete --user rkpattnaik780 --topic all --prefix --permission allow --operation create
Request URL: /rest/acls?operation=DELETE&patternType=PREFIXED&permission=ALLOW&principal=User%3Arkpattnaik780&resourceName=%2A&resourceType=TOPIC

[rkpattnaik780]

Command: ./rhoas kafka acl delete --user ephelan_kafka_devexp --permission allow --operation describe-config --topic dddddd --prefix
Error: Invalid operation "describe-config" for resource type "topic".
Describe config and alter configs should be a valid operation type for topic. Able to create using UI.

[rkpattnaik780]

Command: ./rhoas kafka acl delete --user ephelan_kafka_devexp --permission allow --operation delete --group my-group.
Request URL: /rest/acls?operation=&patternType=LITERAL&permission=ALLOW&principal=User%3Aephelan_kafka_devexp&resourceName=my-group&resourceType=GROUP
Error message: [Bad Request] Validation error for parameter operation in location QUERY: Input doesn't match one of allowed values of enum: [READ, ALL, ALTER, DELETE, CREATE, ALTER_CONFIGS, ANY, DESCRIBE, DESCRIBE_CONFIGS, WRITE]

[rkpattnaik780]

Should we use plural like alter-configs?

Suggested change

	OperationFilterDESCRIBE_CONFIGS = "describe-config"
	OperationFilterDESCRIBE_CONFIGS = "describe-configs"

[craicoverflow]

Yes!

[rkpattnaik780]

Suggested change

	// AddUser adds a flag to pass a user ID principal
	// AddServiceAccount adds a flag to pass a service account ID principal

[rkpattnaik780]

A rare scenario: If user creates a ACL rule using CLI with pricipal="all", <Allow | Read> and topic starts with "all". It would be impossible to delete using CLI, is that an edge case we should handle?

[craicoverflow]

A rare scenario: If user creates a ACL rule using CLI with pricipal="all", <Allow | Read> and topic starts with "all". It would be impossible to delete using CLI, is that an edge case we should handle?

As agreed, I have now removed wildcard aliases. Could you review again?

[rkpattnaik780]

Seems like an issue with api maybe
cpmmand: ./rhoas kafka acl delete --user kakashi --permission any --cluster --operation alter -v
preview:

PRINCIPAL      PERMISSION   OPERATION   DESCRIPTION                 
 -------------- ------------ ----------- ---------------------------- 
  kakashi        ALLOW        ALTER       CLUSTER is "kafka-cluster"  
  All accounts   ALLOW        ALTER       CLUSTER is "kafka-cluster"

[rkpattnaik780]

LGTM!

[rkpattnaik780]

./rhoas kafka acl delete --user kakashi --permission any --cluster --operation alter -v

Seems like an issue with api maybe cpmmand: ./rhoas kafka acl delete --user kakashi --permission any --cluster --operation alter -v preview:

PRINCIPAL      PERMISSION   OPERATION   DESCRIPTION                 
 -------------- ------------ ----------- ---------------------------- 
  kakashi        ALLOW        ALTER       CLUSTER is "kafka-cluster"  
  All accounts   ALLOW        ALTER       CLUSTER is "kafka-cluster"

Playing around the api a little, I found out that list operation lists out all the permissions with those specifics for the given user, including the ones it gets from All accounts. The above command makes a get request with cluster=kafka-cluster, allow:alter for user kakashi, which also checks if the user gets the access through rules defined for "All accounts".

Similarly, searching for a rule that isn't defined for the user but defined for "All accounts" is returned.

./rhoas kafka acl delete --user wtrocki --permission allow --operation read --group sasuke --prefix
⚠ The following ACLs will be deleted from Kafka instance "rama-test-2":

  PRINCIPAL      PERMISSION   OPERATION   DESCRIPTION                 
 -------------- ------------ ----------- ---------------------------- 
  All accounts   ALLOW        READ        GROUP starts with "sasuke"

I think list operation is working as it should be, some changes should be made to delete to prevent deleting the all account rules. Wdyt?

[craicoverflow]

Can you move this to a new issue where can we can discuss this? It will be lost/hidden here.