Disable add/delete/shrink/grow QQ operations via HTTP api

rabbitmq · Aug 22, 2023 · 66a254a · 66a254a
1 parent 2b177e5
commit 66a254a
Show file tree

Hide file tree

Showing 6 changed files with 36 additions and 5 deletions.
diff --git a/deps/rabbitmq_management/priv/schema/rabbitmq_management.schema b/deps/rabbitmq_management/priv/schema/rabbitmq_management.schema
@@ -521,3 +521,10 @@ end}.
     {datatype, {enum, [true, false]}},
     {include_default, false}
 ]}.
+
+%% Disables add/remove/grow/shrink over API.
+
+{mapping, "management.restrictions.quorom_queue_replica_operations.disabled", "rabbitmq_management.restrictions.quorum_queue_replica_operations.disabled", [
+    {datatype, {enum, [true, false]}},
+    {include_default, false}
+]}.
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_features.erl b/deps/rabbitmq_management/src/rabbit_mgmt_features.erl
@@ -8,8 +8,12 @@
 -module(rabbit_mgmt_features).
 
 -export([is_op_policy_updating_disabled/0,
+         is_qq_replica_operations_disabled/0,
          are_stats_enabled/0]).
 
+is_qq_replica_operations_disabled() ->
+    get_restriction([quorum_queue_replica_operations, disabled]).
+
 is_op_policy_updating_disabled() ->
     case get_restriction([operator_policy_changes, disabled]) of
         true -> true;

diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_quorum_queue_replicas_add_member.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_quorum_queue_replicas_add_member.erl
@@ -56,4 +56,9 @@ accept_content(ReqData, Context) ->
 
 
 is_authorized(ReqData, Context) ->
-  rabbit_mgmt_util:is_authorized_admin(ReqData, Context).
+    case rabbit_mgmt_features:is_qq_replica_operations_disabled() of
+        true ->
+            rabbit_mgmt_util:method_not_allowed(<<"Broker settings disallow quorum queue replica operations.">>, ReqData, Context);
+        false ->
+            rabbit_mgmt_util:is_authorized_admin(ReqData, Context)
+    end.
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_quorum_queue_replicas_delete_member.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_quorum_queue_replicas_delete_member.erl
@@ -56,5 +56,11 @@ delete_completed(ReqData, Context) ->
   %% return 202 Accepted since this is an inherently asynchronous operation
   {false, ReqData, Context}.
 
+
 is_authorized(ReqData, Context) ->
-  rabbit_mgmt_util:is_authorized_admin(ReqData, Context).
+    case rabbit_mgmt_features:is_qq_replica_operations_disabled() of
+        true ->
+            rabbit_mgmt_util:method_not_allowed(<<"Broker settings disallow quorum queue replica operations.">>, ReqData, Context);
+        false ->
+            rabbit_mgmt_util:is_authorized_admin(ReqData, Context)
+    end.
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_quorum_queue_replicas_grow.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_quorum_queue_replicas_grow.erl
@@ -48,6 +48,10 @@ accept_content(ReqData, Context) ->
     end),
   {true, ReqData, Context}.
 
-
 is_authorized(ReqData, Context) ->
-  rabbit_mgmt_util:is_authorized_admin(ReqData, Context).
+    case rabbit_mgmt_features:is_qq_replica_operations_disabled() of
+        true ->
+            rabbit_mgmt_util:method_not_allowed(<<"Broker settings disallow quorum queue replica operations.">>, ReqData, Context);
+        false ->
+            rabbit_mgmt_util:is_authorized_admin(ReqData, Context)
+    end.
diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_quorum_queue_replicas_shrink.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_quorum_queue_replicas_shrink.erl
@@ -35,4 +35,9 @@ delete_completed(ReqData, Context) ->
   {false, ReqData, Context}.
 
 is_authorized(ReqData, Context) ->
-  rabbit_mgmt_util:is_authorized_admin(ReqData, Context).
+    case rabbit_mgmt_features:is_qq_replica_operations_disabled() of
+        true ->
+            rabbit_mgmt_util:method_not_allowed(<<"Broker settings disallow quorum queue replica operations.">>, ReqData, Context);
+        false ->
+            rabbit_mgmt_util:is_authorized_admin(ReqData, Context)
+    end.