cyriltovena commented on code in PR #65433:
URL: https://github.com/apache/doris/pull/65433#discussion_r3636578221
##########
be/src/cloud/cloud_storage_engine.cpp:
##########
@@ -405,6 +417,10 @@ Status
CloudStorageEngine::start_bg_threads(std::shared_ptr<WorkloadGroup> wg_sp
return Status::OK();
}
+bool CloudStorageEngine::_should_check_storage_vault() {
+ return !_storage_vault_synced.exchange(true) &&
config::enable_check_storage_vault;
Review Comment:
Thank you for identifying the post-startup lifecycle gap. Fixed in
0d735b8003: vault synchronization is serialized, and connectivity is now
checked for every newly added or changed keyless S3 configuration while
unchanged refreshes skip the probe. CheckNewAndChangedKeylessStorageVault
covers a new Workload Identity vault, an HMAC-to-Workload-Identity transition,
unchanged Workload Identity, static credentials, assumed role, and the disabled
check setting.
##########
fe/fe-core/src/main/java/org/apache/doris/datasource/property/storage/S3Properties.java:
##########
@@ -702,7 +729,21 @@ public static Cloud.ObjectStoreInfoPB.Builder
getObjStoreInfoPB(Map<String, Stri
}
if (hasCredentialsProviderType(properties)) {
- builder.setCredProviderType(getCredProviderTypePB(properties));
+ if (isGcpWorkloadIdentityCredentialsProvider(properties)) {
+ Preconditions.checkArgument(!builder.hasProvider() ||
builder.getProvider() == Provider.GCP,
+ "%s=%s is only supported with provider GCP",
+ CREDENTIALS_PROVIDER_TYPE,
GCP_WORKLOAD_IDENTITY_CREDENTIALS_PROVIDER);
+ Preconditions.checkArgument(!builder.hasAk() &&
!builder.hasSk(),
+ "%s=%s cannot be used together with %s/%s",
+ CREDENTIALS_PROVIDER_TYPE,
GCP_WORKLOAD_IDENTITY_CREDENTIALS_PROVIDER,
+ ACCESS_KEY, SECRET_KEY);
+
Preconditions.checkArgument(Strings.isNullOrEmpty(properties.get(S3Properties.ROLE_ARN)),
+ "%s=%s cannot be used together with %s",
+ CREDENTIALS_PROVIDER_TYPE,
GCP_WORKLOAD_IDENTITY_CREDENTIALS_PROVIDER, ROLE_ARN);
+
builder.setCredProviderType(CredProviderTypePB.GCP_WORKLOAD_IDENTITY);
Review Comment:
Thank you. Fixed in 837bd30dc1: SHOW CREATE STORAGE VAULT now recognizes the
persisted GCP_WORKLOAD_IDENTITY enum, emits
s3.credentials_provider_type=gcp_workload_identity, and omits the static AK/SK
properties. The focused FE test verifies the selector is present and both key
properties are absent.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
