freesinger opened a new pull request, #11188: URL: https://github.com/apache/gravitino/pull/11188
### What changes were proposed in this pull request?
This PR prevents internal metadata operations triggered by Iceberg REST
server and authorization infrastructure from being recorded as standalone audit
events.
The main changes are:
1. Add internal dispatcher accessors in `GravitinoEnv` for catalog, schema,
table, view, owner, and access control operations.
These internal dispatchers keep the normalize/operation layer but bypass
hook and event dispatchers.
2. Use internal dispatchers for Iceberg REST metadata synchronization:
- schema import after namespace creation
- table import after table creation, staged create commit, and table
registration
- view import after view creation
- owner synchronization for schemas, tables, and views
3. Use internal access control dispatcher for authorization user lookups to
avoid emitting `GET_USER` audit events during auth checks.
4. Use internal catalog dispatcher in `DynamicIcebergConfigProvider` when
running in auxiliary mode, so Iceberg REST catalog config lookups do not emit
`LOAD_CATALOG` audit events.
5. Inject schema dispatcher suppliers into table/view operation dispatchers
so internal table/view imports also use the internal schema dispatcher for
dependent schema loading.
### Why are the changes needed?
Iceberg REST server performs several metadata operations internally as part
of handling a single user request. For example, after creating a
namespace/table/view in the underlying Iceberg catalog, Gravitino imports the
corresponding schema/table/view metadata and
synchronizes ownership.
Before this change, those internal operations reused public dispatchers. As
a result, they emitted audit events such as `LOAD_SCHEMA`, `LOAD_TABLE`,
`LOAD_VIEW`, `SET_OWNER`, `GET_USER`, and `LOAD_CATALOG`, even though users did
not directly invoke those operations.
This caused noisy and misleading audit logs. In particular, dynamic Iceberg
catalog config lookups could repeatedly produce `LOAD_CATALOG ... FAILURE`
audit entries for missing catalogs.
This PR separates internal infrastructure calls from user-facing API calls
by routing them through internal dispatchers that bypass event and hook
dispatchers.
### Fix
Fix: #11172
### Does this PR introduce any user-facing change?
No user-facing API or configuration change is introduced.
The observable behavior change is limited to audit logs: internal Iceberg
REST metadata synchronization, authorization user checks, and auxiliary-mode
catalog config lookups are no longer recorded as standalone user audit events.
User-facing API operations are still audited normally.
### How was this patch tested?
Added and updated unit tests to verify internal dispatcher usage and prevent
regressions:
1. Iceberg table hook dispatcher tests verify that table import and owner
synchronization use internal table/owner dispatchers and do not call public
dispatchers.
2. Iceberg namespace hook dispatcher tests verify that schema/table imports
and owner synchronization use internal schema/table/owner dispatchers.
3. Iceberg view hook dispatcher tests verify that view import and owner
synchronization use internal view/owner dispatchers.
4. Dynamic Iceberg config provider tests verify that auxiliary-mode catalog
config lookup uses internal catalog dispatcher and does not call public catalog
dispatcher.
5. Authorization tests verify that PassThrough and Jcasbin authorizers use
internal access control dispatcher for user lookup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
