This is an automated email from the ASF dual-hosted git repository.
adoroszlai pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/master by this push:
new 5f210a1365c HDDS-16560. [STS] Intermittent AccessDenied in GetObject
(#11306)
5f210a1365c is described below
commit 5f210a1365ce6aa9440f82eecde6e9e624f0e9c9
Author: fmorg-git <[email protected]>
AuthorDate: Wed Sep 23 06:51:11 2026 -0700
HDDS-16560. [STS] Intermittent AccessDenied in GetObject (#11306)
---
.../src/main/smoketest/security/ozone-secure-sts-multitenant.robot | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git
a/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts-multitenant.robot
b/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts-multitenant.robot
index f4c56839dca..7d6128a7c4a 100644
---
a/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts-multitenant.robot
+++
b/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts-multitenant.robot
@@ -188,7 +188,8 @@ Verify Role-Scoped Token Accesses
# This token should be able to read from
${TENANT_ONE}/${TENANT_ONE_ICEBERG_BUCKET} but not
${TENANT_TWO}/${TENANT_TWO_ICEBERG_BUCKET}
# nor ${TENANT_THREE}/${TENANT_THREE_ICEBERG_BUCKET}. Also verify that it
can write to ${TENANT_ONE}/${TENANT_ONE_ICEBERG_BUCKET}.
- Get Object Should Succeed ${TENANT_ONE_ICEBERG_BUCKET}
${ICEBERG_BUCKET_TESTFILE}
+ # Wait for all role policies to reach the Ranger plugin cache before
checking the access matrix.
+ Wait Until Keyword Succeeds 60s 5s Get Object
Should Succeed ${TENANT_ONE_ICEBERG_BUCKET} ${ICEBERG_BUCKET_TESTFILE}
Get Object Should Fail ${TENANT_TWO_ICEBERG_BUCKET}
${ICEBERG_BUCKET_TESTFILE} NoSuchBucket
Get Object Should Fail ${TENANT_THREE_ICEBERG_BUCKET}
${ICEBERG_BUCKET_TESTFILE} NoSuchBucket
Put Object Should Succeed ${TENANT_ONE_ICEBERG_BUCKET}
${ICEBERG_BUCKET_TESTFILE}
@@ -207,7 +208,7 @@ Verify Role-Scoped Token Accesses
# nor ${TENANT_TWO}/${TENANT_TWO_ANOTHER_BUCKET} nor
${TENANT_THREE}/${TENANT_THREE_ICEBERG_BUCKET}
# nor ${TENANT_ONE}/${TENANT_ONE_LINKED_BUCKET}.
# Also verify that it can write to
${TENANT_TWO}/${TENANT_TWO_ICEBERG_BUCKET}.
- Get Object Should Succeed ${TENANT_TWO_ICEBERG_BUCKET}
${ICEBERG_BUCKET_TESTFILE}
+ Wait Until Keyword Succeeds 60s 5s Get Object
Should Succeed ${TENANT_TWO_ICEBERG_BUCKET} ${ICEBERG_BUCKET_TESTFILE}
Get Object Should Fail ${TENANT_ONE_ICEBERG_BUCKET}
${ICEBERG_BUCKET_TESTFILE} NoSuchBucket
Get Object Should Fail ${TENANT_TWO_ANOTHER_BUCKET}
${ANOTHER_BUCKET_TESTFILE} AccessDenied
Get Object Should Fail ${TENANT_THREE_ICEBERG_BUCKET}
${ICEBERG_BUCKET_TESTFILE} NoSuchBucket
@@ -220,7 +221,7 @@ Verify Role-Scoped Token Accesses
# nor ${TENANT_TWO}/${TENANT_TWO_ICEBERG_BUCKET} nor
${TENANT_TWO}/${TENANT_TWO_ANOTHER_BUCKET}
# nor ${TENANT_ONE}/${TENANT_ONE_LINKED_BUCKET}.
# Also verify that it can write to
${TENANT_THREE}/${TENANT_THREE_ICEBERG_BUCKET}.
- Get Object Should Succeed ${TENANT_THREE_ICEBERG_BUCKET}
${ICEBERG_BUCKET_TESTFILE}
+ Wait Until Keyword Succeeds 60s 5s Get Object
Should Succeed ${TENANT_THREE_ICEBERG_BUCKET} ${ICEBERG_BUCKET_TESTFILE}
Get Object Should Fail ${TENANT_ONE_ICEBERG_BUCKET}
${ICEBERG_BUCKET_TESTFILE} NoSuchBucket
Get Object Should Fail ${TENANT_TWO_ICEBERG_BUCKET}
${ICEBERG_BUCKET_TESTFILE} NoSuchBucket
Get Object Should Fail ${TENANT_TWO_ANOTHER_BUCKET}
${ANOTHER_BUCKET_TESTFILE} NoSuchBucket
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
