[ISSUE #10496]Add sample plain_acl.yml to distribution/conf

[SummCoder]

Which Issue(s) This PR Fixes

• Fixes [Bug] plain_acl.yml is missing from the official binary release distribution #10496

Brief Description

The official ACL documentation references "distribution/conf/plain_acl.yml"
but the file was not included in the binary release. This PR adds a sample
template so users have a working starting point for ACL configuration.
The default account matches conf/tools.yml for out-of-the-box mqadmin usage.

How Did You Test This Change?

1. Built distribution with "mvn -Prelease-all -DskipTests clean install -U"
   and confirmed plain_acl.yml is included in the resulting tar.gz.
2. Extracted the distribution, enabled ACL on a fresh broker instance.
3. Verified mqadmin commands work with default tools.yml credentials.
4. Verified ACL correctly allows the rocketmq2 user and rejects unknown users.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 48.04%. Comparing base (91cb333) to head (48fb4ec).
⚠️ Report is 3 commits behind head on develop.

Additional details and impacted files

@@              Coverage Diff              @@
##             develop   #10497      +/-   ##
=============================================
- Coverage      48.13%   48.04%   -0.09%     
+ Complexity     13355    13329      -26     
=============================================
  Files           1377     1377              
  Lines         100707   100707              
  Branches       13010    13010              
=============================================
- Hits           48477    48389      -88     
- Misses         46296    46371      +75     
- Partials        5934     5947      +13     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[SummCoder]

Test Failure Analysis & Rerun Request

Finding

The failing test (QueryMsgByKeyIT.testQueryMsgWithSameHash2) is unrelated to this PR's changes. This PR only adds distribution/conf/plain_acl.yml — a configuration template file that has no interaction with the integration tests.

Why the test failed

• Pre-existing flaky test: Race condition in broker synchronization
• Root cause: Test attempts to query messages before full replication across all brokers
• Error: CODE: 208 - query message by key finished, but no message

Request

Since this is a known flaky test unrelated to the ACL configuration file addition, could you please re-run the integration tests?

You can do this by:

1. Going to the Actions tab on this PR
2. Finding the failed workflow run
3. Clicking "Re-run failed jobs" or "Re-run all jobs"

The test should pass on the retry. If it fails again, this indicates a pre-existing infrastructure issue that should be addressed in a separate ticket.

---

Thank you for your time reviewing this contribution!

[RockteMQ-AI]

Review by github-manager-bot

Summary

Adds a sample plain_acl.yml configuration file as a reference template for users setting up ACL.

LGTM. Having a sample config file reduces friction for users configuring ACL for the first time. 👍

---

Automated review by github-manager-bot

[RockteMQ-AI]

Review by github-manager-bot

Summary

Adds a sample plain_acl.yml file to distribution/conf/ to provide a ready-to-use ACL configuration template for users enabling ACL in RocketMQ 5.x.

Findings

• [Positive] distribution/conf/plain_acl.yml — The sample file includes the Apache License header, globalWhiteRemoteAddresses, and a sample accounts entry with admin: true. This provides a clear starting point for users.
• [Warning] distribution/conf/plain_acl.yml:18-20 — The sample accessKey: rocketmq2 and secretKey: 12345678 are placeholder credentials. Consider adding a comment warning users to change these before deployment, similar to how database config templates warn about default passwords.
• [Info] The file uses defaultTopicPerm: PUB|SUB and defaultGroupPerm: PUB|SUB for the admin account, which is appropriate for a sample configuration.

Suggestions

• Add a comment at the top of the file (after the license header):

  # WARNING: Change the accessKey and secretKey before deploying to production.
  # The values below are for development/testing only.

Verdict

LGTM with a minor suggestion. Useful addition to the distribution.

---

Automated review by github-manager-bot