-
Notifications
You must be signed in to change notification settings - Fork 595
HDDS-10412. Prefix ACL check needs to resolve the bucket link #6268
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
@whbing @ChenSammi Could you help take a look when you have time? |
adoroszlai
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @ivandika3 for the patch, LGTM.
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/PrefixManagerImpl.java
Outdated
Show resolved
Hide resolved
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/PrefixManagerImpl.java
Outdated
Show resolved
Hide resolved
| String volume = null; | ||
| String bucket = null; | ||
| String key = null; | ||
| String prefix = null; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
String prefix or String prefixPath maybe only need one?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you for the review. I removed all the unnecessary variables (volume, bucket, and prefix)
|
|
||
| OzoneObj obj = getOzoneObj(); | ||
| OzoneObj obj = resolvedPrefixObj; | ||
| if (obj == null) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is null condition necessary here ? I see a call to resolvedPrefixObj.getpath () on line 81, 82.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If IOException is thrown during the getResolvedPrefixObj (i.e. during bucket resolving process), the resolvedPrefixObj should be null and we should fall back to the initial ozone object from getOzoneObj.
|
@ivandika3 Thanks ! LGTM. |
|
@ChenSammi would you like to take a look? |
|
Thanks @ivandika3 for the patch, @whbing for the review. |
|
Thank you @adoroszlai @whbing for the reviews. |
What changes were proposed in this pull request?
Following up on HDDS-4715, we also need to resolve the bucket link for prefix ACL.
Here are the changes included in this patch:
BucketManagerImplso that prefix access under a bucket link will be resolved to the source bucketPrefixManagerImpl#getAclwill resolve the bucket to get the ACLOMPrefixAclRequest#validateAndUpdateCachewill resolve the bucket before writing the ACLOzoneObjto the request hooks (onComplete,apply) so that the request implementation can use the resolved object and not the link objectPrefixManagerImpl#setAclso that default ACL is inherited only when the prefix does not existWhat is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-10412
How was this patch tested?
Acceptance and integration tests.
Clean CI run: https://github.com/ivandika3/ozone/actions/runs/8029229022