Struct MetadataImage 

pub struct MetadataImage { /* private fields */ }

Implementations

impl MetadataImage

pub fn new(cluster_id: Uuid) -> Self

pub fn cluster_id(&self) -> Uuid

pub fn topics(&self) -> impl Iterator<Item = &TopicRecord>

pub fn topic(&self, name: &str) -> Option<&TopicRecord>

pub fn topic_by_id(&self, id: &Uuid) -> Option<&TopicRecord>

KIP-516: resolve a topic by its UUID. O(1) through the topic_ids index.

pub fn topic_name_by_id(&self, id: &Uuid) -> Option<&str>

KIP-516: resolve a topic name by its UUID.

pub fn partition(&self, topic: &str, idx: i32) -> Option<&PartitionRecord>

pub fn partitions_of( &self, topic: &str, ) -> impl Iterator<Item = &PartitionRecord>

All partitions of topic, in ascending partition-index order. The by-topic index gives an O(1) topic lookup and an O(own partitions) iteration. The method never scans the partitions of other topics, so a per-topic caller stays proportional to the topic it asks about, even in images with tens of thousands of topics.

pub fn partition_next_offset(&self, topic: &str, partition: i32) -> Option<i64>

The committed next-offset for a diskless partition, if any advance has been applied.

pub fn partition_elr( &self, topic: &str, partition: i32, ) -> (&[NodeId], &[NodeId])

pub fn leader_recovery_state( &self, topic: &str, partition: i32, ) -> LeaderRecoveryState

pub fn topic_partition_count(&self, topic: &str) -> i32

The live partition count for topic, derived from the partitions map and not from the stored TopicRecord.partitions field. This is the authoritative count for the KIP-631 round-trip, because the KIP-631 TopicRecord carries no partition count. It is also the authoritative count for the validate partition-count-grew check. Returns 0 for an unknown topic, or for a topic with no applied partition records. O(1).

pub fn all_partitions(&self) -> impl Iterator<Item = &PartitionRecord>

Single-pass iterator over every partition in the image. Each record carries its own topic and partition fields. Topic order is unspecified. Within a topic the order is ascending partition index. The iterator is O(P) in total partition count. The cluster-wide maintenance loops for failover, rebalance, reassignment, and metrics use this instead of a per-topic loop.

pub fn reassignments_in_flight( &self, ) -> impl Iterator<Item = &PartitionRecord> + '_

All partitions where a reassignment is currently in flight, that is, where adding_replicas or removing_replicas is non-empty.

pub fn topic_config(&self, topic: &str) -> Option<&BTreeMap<String, String>>

Currently-effective config overrides for topic, or None if no V1TopicConfig record has applied for this topic since the last V1DeleteTopic, or since image creation.

pub fn broker_config( &self, node_id: NodeId, ) -> Option<&BTreeMap<String, String>>

Per-broker config overrides for node_id, or None if no V1BrokerConfig record has been applied for this broker.

pub fn default_broker_config(&self) -> Option<&BTreeMap<String, String>>

Cluster-wide dynamic broker-config defaults, or None when no default broker config has been applied.

pub fn broker_throttle_rate( &self, node_id: NodeId, kind: ThrottleKind, ) -> Option<ByteRate>

Returns the KIP-73 throttle rate for node_id and kind. Returns None if the config key is absent, unparseable, or negative. -1 is Kafka’s convention for “disabled” or “unlimited”.

pub fn client_metrics_config( &self, name: &str, ) -> Option<&BTreeMap<String, String>>

Override map for a single KIP-714 client-metrics subscription.

pub fn client_metrics_subscriptions( &self, ) -> impl Iterator<Item = (&String, &BTreeMap<String, String>)>

All configured client-metrics subscriptions, (name, overrides).

pub fn group_config(&self, group_id: &str) -> Option<&BTreeMap<String, String>>

Dynamic KIP-1071 overrides for one GROUP config resource.

pub fn group_configs( &self, ) -> impl Iterator<Item = (&String, &BTreeMap<String, String>)>

All configured GROUP resources.

pub fn client_quotas(&self) -> &HashMap<EntityKey, BTreeMap<String, f64>>

pub fn scram_credential( &self, user: &str, mechanism: SaslMechanism, ) -> Option<&ScramCredential>

pub fn scram_credentials_users(&self) -> Vec<String>

All distinct users with at least one SCRAM credential. Order is unspecified.

pub fn scram_credentials_for_user( &self, user: &str, ) -> Vec<(SaslMechanism, u32)>

All (mechanism, iterations) pairs for user. Empty if user has no SCRAM credentials. Order is unspecified.

pub fn broker(&self, node_id: NodeId) -> Option<&BrokerRegistrationRecord>

pub fn controller( &self, node_id: NodeId, ) -> Option<&ControllerRegistrationRecord>

pub fn broker_epoch(&self, node_id: NodeId) -> Option<i64>

KIP-903: the broker epoch (registration commit offset) for node_id, or None if the broker is not registered in this image.

pub fn next_producer_id(&self) -> i64

First producer ID not covered by any committed allocation block.

pub fn brokers(&self) -> impl Iterator<Item = &BrokerRegistrationRecord>

pub fn controllers(&self) -> impl Iterator<Item = &ControllerRegistrationRecord>

pub fn kraft_version(&self) -> u16

pub fn voters(&self) -> &VoterSet

pub fn matching_acls<'a>( &'a self, rt: ResourceType, rn: &'a str, ) -> impl Iterator<Item = &'a AclEntry> + 'a

Iterate every ACL that could possibly match (rt, rn):

• all literal entries at (rt, rn)
• all literal entries at (rt, "*"), the WILDCARD_RESOURCE, which matches every resource of that type. See Kafka’s AclAuthorizer and StandardAuthorizer. This is what kafka-acls --topic '*' produces.
• all prefixed entries whose resource_name is a prefix of rn

pub fn all_acls(&self) -> impl Iterator<Item = &AclEntry>

All ACL entries, both literal and prefixed, across all resource types. DescribeAcls uses this.

pub fn topic_freeze(&self, topic: &str) -> Option<&TopicFreezeRecord>

The write-freeze entry that covers topic, or None when the topic accepts writes (KFC-9).

A cluster with no freeze costs two is_empty tests, because the produce path calls this once per topic per request. A literal entry beats every prefix entry, and the longest matching prefix wins among the prefix entries.

An internal topic is never frozen. The __ name convention is the test, so a prefix scope of "" or "_" cannot take __consumer_offsets down with the rest of the cluster.

pub fn topic_freezes(&self) -> impl Iterator<Item = &TopicFreezeRecord>

Every live write-freeze entry, literal and prefixed (KFC-9). A thawed entry is removed on apply, so every entry here has frozen: true. Order is unspecified.

pub fn break_glass_proposal( &self, id: Uuid, ) -> Option<&BreakGlassProposalRecord>

Look up a break-glass proposal by its id (KFC-9).

pub fn break_glass_proposals( &self, ) -> impl Iterator<Item = &BreakGlassProposalRecord>

Every break-glass proposal still in the image (KFC-9), including the consumed and withdrawn ones that the expiry sweep has not yet removed. Order is unspecified.

pub fn delegation_token_by_id(&self, token_id: &str) -> Option<&DelegationToken>

Look up a delegation token by its token_id (KIP-48).

pub fn delegation_tokens_by_owner( &self, owner: &KafkaPrincipal, ) -> Vec<&DelegationToken>

All tokens owned by owner (KIP-48). The match on the owning KafkaPrincipal is exact. Order is unspecified.

pub fn delegation_tokens_visible_to( &self, principal: &KafkaPrincipal, ) -> Vec<&DelegationToken>

Tokens that principal may see through DescribeDelegationToken without DescribeToken permission: those it owns, created or may renew (DelegationToken::owner_or_renewer). Order is unspecified.

pub fn all_delegation_tokens(&self) -> impl Iterator<Item = &DelegationToken>

Every delegation token currently in the image (KIP-48). DescribeDelegationToken uses this for callers with DescribeToken permission on the cluster.

pub fn delegation_token_by_hmac( &self, secret_key: &[u8], hmac: &[u8], ) -> Option<&DelegationToken>

KIP-48: the delegation token whose HMAC under secret_key is hmac.

RenewDelegationToken and ExpireDelegationToken identify a token by HMAC on the wire and not by token_id. The image keeps no HMAC, as Kafka’s metadata does not, so each token’s HMAC is recomputed with krabka_security::compute_token_hmac. The scan is linear over the small in-memory token map.

pub fn finalized_features(&self) -> &BTreeMap<String, i16>

KIP-584: finalized feature levels, keyed by feature name. Empty until an UpdateFeatures call lands a V1FeatureLevel record.

pub fn finalized_features_epoch(&self) -> i64

KIP-584 finalized-features epoch. -1 (“unknown”) until the first feature is finalized.

pub fn finalized_metadata_version(&self) -> Option<i16>

The finalized metadata.version level, or None if no V1FeatureLevel for metadata.version has applied. That is a pre-bootstrap or legacy image, which is MetadataVersion.UNKNOWN.

pub fn finalized_feature(&self, name: &str) -> Option<i16>

KIP-584: the finalized level for an arbitrary feature, or None if it has not been finalized. Generic counterpart to Self::finalized_metadata_version.

pub fn min_required_metadata_version(&self) -> i16

The minimum metadata.version level that the live image needs: the floor that a downgrade must not drop below. It rises with feature-gated state present in the image: KRaft SCRAM creds, delegation tokens, and KIP-1276 CIDR ACL hosts. The baseline is METADATA_VERSION_MIN.

pub fn metadata_version_downgrade_records( &self, target: i16, ) -> Vec<MetadataRecord>

Metadata removals needed to materialize this image at target. An empty result means the downgrade is lossless. The controller emits these records before the trailing metadata.version feature record only for an explicitly unsafe downgrade.

pub fn apply(&mut self, rec: &MetadataRecord)

Apply one record. Returns the previous record, for V1Topic and V1BrokerRegistration, so the caller can observe overwrite cases. The method is infallible. The controller pre-validates against the current image before it submits to Raft. Apply must never fail on a committed entry.

pub fn to_records(&self) -> Vec<MetadataRecord>

Serialize the image into the minimal sequence of MetadataRecords whose in-order apply reproduces this image exactly. This is the inverse of apply over a sequence of non-tombstone records: each stored entry maps to the record that would create it.

The method deliberately never emits tombstone or removal records: V1DeleteTopic, V1DeleteScramCredential, V1DeleteAccessControlEntry, V1DeleteDelegationToken, and V1UnregisterBroker. A snapshot captures resulting state, not deletion history. V1BrokerConfig deletes vanish in the same way. The method emits only the surviving key and value pairs, as Some(value) sets.

The method emits records in dependency order, so a fresh image that applys them never sees a dangling reference: brokers, broker-configs, topics, partitions, topic-configs, SCRAM creds, ACLs, client quotas, delegation tokens.

pub fn from_records(cluster_id: Uuid, records: &[MetadataRecord]) -> Self

Reconstruct an image from a cluster_id and a record sequence, typically the output of Self::to_records read back from a snapshot. The method news an empty image and applys each record in order.

pub fn validate(&self, rec: &MetadataRecord) -> Result<(), MetadataError>

Synchronous pre-validation: returns Ok if the record would be a no-conflict apply, otherwise the appropriate error. Controller::submit_change uses this before it forwards to openraft.

Errors

Returns the conflict that would prevent the record from being applied.

Trait Implementations

impl Clone for MetadataImage

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MetadataImage

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for MetadataImage

fn default() -> Self

Returns the “default value” for a type.

impl PartialEq for MetadataImage

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for MetadataImage