yuqi1129 opened a new pull request, #14512: URL: https://github.com/apache/gravitino/pull/14512
### What changes were proposed in this pull request? Replace stale same-name schema registrations with a different source ID in one relational transaction. Reuse cascade retirement for descendants and relational governance associations; retain children for the same ID. Check and lock active/retired source identities, reject active foreign-catalog IDs, and use plain insertion for never-seen IDs so a concurrent winner cannot be stolen by an upsert. Import schemas without source markers non-overwriting. Report schema/table registration failure after a successful catalog create instead of returning success, preserving the original cause and recovery guidance. Retain credentials referenced by the created schema, and document partial-success semantics on the public create APIs. ### Why are the changes needed? Source drop/recreate can retain or collide with an old schema registration and its children; successful create responses can conceal registration failure. The corresponding stale-table cleanup is already on main. Fixes #14501 ### Does this PR introduce _any_ user-facing change? This is write-triggered repair, not periodic reconciliation. Each relational schema overwrite now takes an exclusive parent-catalog row lock and performs three extra probes: active ID, locked ID including retired rows, and the current name registration. This serializes registrations and schema drops in that catalog; ordinary alter is not globally serialized. The first ID read rejects an active foreign identity before locking its row; the locking read revalidates after waiting. Different-ID replacement retires the old relational hierarchy and owner/tag/securable-object privilege associations. It does not transfer them to the new identity. Same-ID overwrite retains children. Existing cache/epoch/change-log entry points remain in use; no DDL/schema migration or configuration change. Retirement does not drop source objects, delete old schema/descendant secrets, or remove external authorization policies such as Ranger. An old object may have been renamed and still reference those credentials. There is no automatic secret GC: verify external references before manually cleaning up obsolete credentials/policies. External create is not rolled back/replayed if registration fails; resolve the store error and verify catalog state before retrying. ### How was this patch tested? - Complete core unit/H2 lanes and API unit tests passed, as did MySQL/PostgreSQL SchemaMetaService + TableMetaService lanes. - Added real-store cases for stale nested hierarchy/tag cleanup, same-ID retention, foreign-ID rejection, retired-ID revival, deterministic fresh-ID concurrent winner and rollback after failed insertion. Dispatcher cases check failure type/cause/identifier/guidance, actual source state, retained secrets and non-overwriting import. - Restoring silent create success and skipping stale cleanup breaks the corresponding unit/H2 regressions. A separate MySQL mutation restores fresh-ID upsert with cleanup still enabled and breaks the concurrent-winner regression. Restored dispatcher/H2/MySQL suites, Spotless and RAT passed. Independent fresh-context review found no blocking findings. - No live source/secret-provider/Ranger tests. Simultaneous revival of the same retired ID and a full two-node invalidation harness were not separately exercised; the new lock protocol and existing cascade/cache/change-log paths were traced independently rather than claimed as new multi-node runtime proof. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
