dprmfl opened a new pull request, #13384:
URL: https://github.com/apache/gravitino/pull/13384
### What changes were proposed in this pull request?
Move the `loadTable()` call inside the Kerberos proxy boundary during
`alterTable`.
- Add an overload of `buildIcebergTableChanges()` in
IcebergCatalogWrapperHelper
that takes an explicit Catalog instead of the internally held raw one.
- Add `buildAndUpdateTable()` to IcebergCatalogWrapper, which passes
`getCatalog()`
to the builder and commits the transaction in a single proxied call.
- Update `internalUpdateTable()` in IcebergCatalogOperations to use it.
### Why are the changes needed?
IcebergCatalogWrapperHelper holds the raw Catalog obtained via
`getCatalog()` at
init time. When Kerberos impersonation is enabled,
`buildIcebergTableChanges()`
calls `loadTable()` on that raw object, bypassing
KerberosAwareIcebergCatalogProxy
and therefore `UGI.doAs()`.
The metadata.json read then runs as the service principal instead of the
impersonated user, failing with AccessControlException on secured HDFS
clusters.
Fix: #13383
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Verified on a Kerberos-secured HDFS cluster where the service account has no
access to the warehouse directory. `ALTER TABLE ADD COLUMNS` now succeeds
under
impersonation, and the HDFS audit log shows the user identity for the
metadata
read, directory creation and new metadata file write.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
