roryqi commented on code in PR #12177: URL: https://github.com/apache/gravitino/pull/12177#discussion_r3718767023
########## design-docs/policy-on-tag.md: ########## @@ -0,0 +1,669 @@ +<!-- + Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. +--> + +# Design of Policy-on-Tag in Gravitino + +--- + +## Background + +Gravitino currently has two independent governance concepts: + +| Concept | Current state | +|---------|---------------| +| Tag | A flat metalake-scoped metadata object used to classify or annotate metadata objects. Tags can be associated with catalogs, schemas, tables, filesets, topics, models, and columns. Tag listing follows the metadata object hierarchy, so a child object can receive tags from parent metadata objects. | +| Policy | A metalake-scoped metadata object with typed content, enabled state, and audit information. The current model allows policies to be associated directly with metadata objects. The system iceberg compaction policy is the first built-in policy type and is consumed by the table maintenance service. | + +The current object-side governance model is: + +```text +Tag -> Metadata Object +Policy -> Metadata Object +``` + +This direct object policy model is understandable for a small number of objects, but it creates +problems when governance needs to scale across many catalogs, schemas, tables, and columns: + +1. Users must manage both object tags and object policies on the same metadata object. +2. Policy assignment does not naturally follow classification. A table can be marked as + `maintenance_standard`, but the maintenance policy still has to be attached separately. +3. New objects can be missed unless administrators attach policies to every new object or rely on + ancestor-level direct policy assignment. +4. TMS needs maintenance policy selection now, while future ABAC needs tag-driven policy selection. + Direct object policies do not provide a shared selection layer for both scenarios. +5. Keeping two object-side governance paths makes the user model harder to explain and document. + +The proposed target model is: + +```text +Policy -> Tag -> Metadata Object +``` + +Policy remains a first-class object. Tags become the only object-side governance attachment point. +An object policy is a read-only policy result for a metadata object, derived from the tags the +object has or inherits from parent metadata objects. Tags themselves are not nested. + +--- + +## Goals + +1. **Single Object-Side Attachment Point**: Metadata objects receive governance behavior only + through tags, not through direct policy attachment. +2. **Reusable Policy Lifecycle**: Policies remain first-class objects with typed content, enabled + state, audit information, and metalake-scoped lifecycle operations. +3. **Immutable Policy Definitions**: Policy definitions are not modified in place. To change policy Review Comment: Updated in 4259c6c9d. Removed policy definition immutability from this proposal. Policy-on-tag changes the association path, while the existing policy lifecycle and mutation APIs remain unchanged. Only derived object policies are read-only. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
