nevzheng opened a new issue, #13083:
URL: https://github.com/apache/gravitino/issues/13083
## Version
main branch
## Describe what's wrong
Apache #12983 intentionally requires `USE_SECRET` before `getCredentials` or
`getSecrets` returns plaintext credentials. The Cloud Filesystem Hadoop
authorization integration tests were not migrated with that policy change.
Those tests still expect credential vending when a caller has only
`READ_FILESET`, `WRITE_FILESET`, or fileset ownership. Under the new policy,
the server correctly returns an empty credential result unless the caller
owns
the metalake or has scoped `USE_SECRET`.
This makes the Cloud credential-vending suite fail after the policy change.
## Error message and/or stacktrace
On `datastrato/gravitino-enterprise#1915`, the Cloud Filesystem Hadoop job
fails with six related failures:
- Three direct credential assertions expect one credential but receive zero.
- S3 read/write cases fail with `NoAwsCredentialsException`.
- The GCS read-only case unexpectedly writes because no vended credential is
installed and the test falls back to ambient GCP authentication.
Failed job:
https://github.com/datastrato/gravitino-enterprise/actions/runs/34526016946/job/103034984095
## How to reproduce
1. Use Apache main containing #12983 / `25f874f`.
2. Run the cloud-enabled `:clients:filesystem-hadoop3:test` suite.
3. Exercise the fileset credential-vending authorization tests with only
`READ_FILESET`, `WRITE_FILESET`, or fileset ownership.
The credential endpoint returns an empty result because the caller lacks
`USE_SECRET`.
## Additional context
This is a test-migration omission, not a request to roll back the policy.
#12983 already added analogous `USE_SECRET` test grants for Spark JDBC in
`501f3cbf`, but did not update:
- `AbstractFileSystemCredentialAuthorizationIT`
- `FilesetCatalogAuthorizationCredentialIT`
Proposed repair:
- Grant and revoke fileset-scoped `USE_SECRET` alongside data privileges in
positive vending tests.
- Update the fileset-owner case to expect no credential until `USE_SECRET` is
granted.
- Add missing/denied-`USE_SECRET` coverage.
- Assert the GCS positive path received a vended token before asserting
read-only behavior.
Related to: https://github.com/apache/gravitino/pull/12983
Related to: https://github.com/datastrato/gravitino-enterprise/pull/1915
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
