johntomcat7408-cmyk commented on issue #4268: URL: https://github.com/apache/amoro/issues/4268#issuecomment-5352864091
Hi, I am interested in working on this issue. Before starting implementation, I would like to confirm the first-PR boundary. The proposal crosses several runtime paths—AMS commits, optimizer writes, maintenance cleanup, and Hadoop identity handling—so covering all of them at once would make compatibility and failure behavior difficult to review. Would the following be an acceptable first PR? - Add an opt-in catalog setting for HDFS proxy impersonation. - Apply impersonation only to AMS-side optimizing commits. - Resolve the effective user from one clearly defined table-owner source. - Fail with an actionable error when the owner cannot be resolved or proxy authorization is unavailable, rather than silently running as the service user. - Add Kerberos/MiniDFS coverage and document the required `hadoop.proxyuser` settings. I would leave optimizer task writes and other maintenance operations for follow-up work unless those paths need to be delivered together for correctness. Before I prepare an implementation plan, could you confirm: 1. Should the first PR cover only AMS-side optimizing commits, or also optimizer task writes and maintenance cleanup? 2. What is the authoritative effective-user source for Hive and Iceberg tables? 3. Should missing owner or proxy authorization fail the operation, or fall back to the catalog service user? 4. Is an owner or group allowlist required in the initial design? 5. What integration-test evidence is expected for the Kerberos and HDFS behavior? Once the scope is settled, I will trace the affected production paths on the latest `master` and post a concrete implementation and validation plan before coding. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
