Uh oh!
There was an error while loading. Please reload this page.
HDDS-2289. Put testing information and a problem description to the g… - #5
Merged
Conversation
adoroszlai
left a comment
Contributor
There was a problem hiding this comment.
Thanks for improving the PR template
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Co-Authored-By: Doroszlai, Attila <6454655+adoroszlai@users.noreply.github.com>
vivekratnavel
commented
Oct 16, 2019
Contributor
+1 LGTM |
vivekratnavel
approved these changes
Oct 16, 2019
anuengineer
approved these changes
Oct 16, 2019
tanvipenumudy added a commit
to tanvipenumudy/ozone
that referenced
this pull request
May 12, 2022
# This is the 1st commit message: Initial Commit # This is the commit message apache#2: more slight changes # This is the commit message apache#3: changes++ # This is the commit message apache#4: getExecutorService Changes # This is the commit message apache#5: applyTransaction() Changes # This is the commit message apache#6: changes++ # This is the commit message apache#7: TestOzoneManagerLock changes # This is the commit message apache#8: add changes # This is the commit message apache#9: add more minor changes # This is the commit message apache#10: add config to ozone-default.xml # This is the commit message apache#11: minor changes # This is the commit message apache#12: change modulo logic # This is the commit message apache#13: changes # This is the commit message apache#14: changes++ # This is the commit message apache#15: add changes++ # This is the commit message apache#16: minor changes # This is the commit message apache#17: Changes (to be reverted) # This is the commit message apache#18: Changes 09/05
vtutrinov pushed a commit
to vtutrinov/ozone
that referenced
this pull request
Apr 7, 2025
vtutrinov added a commit
to vtutrinov/ozone
that referenced
this pull request
Aug 4, 2026
Followup apache#5. Prove that the proxied-user identity propagates all the way from the JDBC client (beeline -n testuser) through HS2's doAs into HMS's RetryingMetaStoreClient and onward to OM's RPC authorization, and that the resulting Ozone data file is owned by testuser (not hms). Wiring: - ozone-oauth-hive/hive-site.xml — hive.server2.enable.doAs flipped to true. hive.exec.scratchdir moved off ofs:// onto file:///tmp/ hive: Tez local mode wants its log/working dir under file:// and ofs decodes the default /tmp/hive as volume=tmp, bucket=hive which doesn't exist. Real query output still goes to ofs:// (the database LOCATION sits on Ozone). - hadoop.proxyuser.hms.* also added to hive-site.xml: Hive 4's classpath puts /opt/hadoop/etc/hadoop (the image's empty core-site.xml) ahead of /opt/hive/conf, so the proxyuser entries in our bind-mounted core-site.xml were masked out. Repeating them in hive-site.xml is the cheap fix for the HS2-side authorization check. - ozone-oauth-hive/docker-config — CORE-SITE.XML_hadoop.proxyuser. hms.{hosts,groups,users}=* so the ozone-runner containers (OM/SCM/DN) also accept "hms acting as testuser". Without it OM threw shaded ipc_.RemoteException: User: hms is not allowed to impersonate testuser, which I first mistook for an HS2-side rejection until I noticed the ipc_. prefix. - ozone-oauth-hive/docker-compose.yaml mounts core-site.xml at /opt/hadoop/etc/hadoop/core-site.xml too so it isn't masked. - docker-compose's hiveserver2 service now starts as root with an entrypoint wrapper that useradds hms / testuser / hadoop, chowns /tmp/hive* and /opt/hive/conf to hms, cd's into /home/hms/wd (Tez local mode creates ./tez-local-cache* relative to PWD), then exec's the original entrypoint under su hms. Without this, Hive 4's DagUtils.validateOwnerOrSubmitterPath fails because the container OS user (hive) doesn't match the UGI user (hms or testuser) — the local-fs owner check is a known mismatch when running without LinuxContainerExecutor. - ozone-oauth-hive/test.sh — beeline_exec now connects with -n testuser. The Tez-hits assertion globs /tmp/*/hive.log so it follows the runtime user (hms now, was hive). - smoketest/security/hms.robot — new test case "Data File Owner Is testuser Not HMS" greps the data file's owner column from ozone fs -ls and asserts it's testuser. Verified: 6/6 robot tests green; HS2's metastore client log shows "ugi=testuser (auth:PROXY) via hms/hiveserver2@EXAMPLE.COM (auth:OAUTH)"; ofs file owner is testuser; tez.TezTask hit count 122; proactive refresh hits 13. Only followup remaining in README: CA-distribution sidecar to re-enable hdds.grpc.tls.enabled.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
Add additional lines to the github PR template based on the proposal.
What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-2289
How was this patch tested?
Couldn't be tested before the merge ;-(
Merge it and try to open a new PR.