yuqi1129 opened a new pull request, #11811:
URL: https://github.com/apache/gravitino/pull/11811
### What changes were proposed in this pull request?
Add the authorization plugin packages
`org.apache.gravitino.authorization.{ranger,chain,jdbc,common}.` to
`IsolatedClassLoader.isCatalogClass()` so these plugin classes are loaded by
the isolated classloader instead of being delegated to the server classloader.
The bare `org.apache.gravitino.authorization.*` prefix is intentionally left
out so server-side classes (e.g. `RoleManager`, `AuthorizationUtils`) remain
shared.
Tests: add
`TestIsolatedClassLoader.testAuthorizationPluginPackagesRecognizedAsCatalogClass`
and extend the negative test to assert server-side authorization classes stay
shared.
### Why are the changes needed?
Authorization plugin classes were classified as *shared* and delegated to
the server classloader. Under certain classloader-initialization timing windows
the server classloader becomes the defining classloader of a plugin class (e.g.
`RangerPrivileges`), and its nested/synthetic classes (e.g. the inner enum
`RangerPrivileges$RangerHdfsPrivilege`) cannot be resolved from the server
classpath. The JVM permanently caches this load failure for the lifetime of the
process, so every subsequent role/authorization operation throws
`NoClassDefFoundError` until restart. This surfaces intermittently in
`RangerHiveE2EIT`.
This is the same class of bug as #11704 (fixed for the hive packages in
#11705), now applied to the authorization plugins.
Fix: #11810
### Does this PR introduce _any_ user-facing change?
No. This is an internal classloader fix with no API or behavior change.
### How was this patch tested?
`./gradlew :core:test --tests
"org.apache.gravitino.utils.TestIsolatedClassLoader"` — passes (4 test methods,
including the new authorization-plugin coverage and the
server-side-stays-shared assertions).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
