This is an automated email from the ASF dual-hosted git repository.
jojochuang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/master by this push:
new 55c834b9050 HDDS-16961. Fix OM fetch-key secret key refresh (#11526)
55c834b9050 is described below
commit 55c834b9050fd018791089e9cd5d236748a573cc
Author: Andy Huang <[email protected]>
AuthorDate: Thu Oct 15 08:02:59 2026 +0800
HDDS-16961. Fix OM fetch-key secret key refresh (#11526)
---
.../security/symmetric/DefaultSecretKeyClient.java | 5 ++
.../symmetric/TestDefaultSecretKeyClient.java | 71 ++++++++++++++++++++++
.../apache/hadoop/ozone/TestBlockTokensCLI.java | 4 +-
.../ozone/om/TestOMAdminRpcAuthorization.java | 21 +++++++
.../org/apache/hadoop/ozone/om/OzoneManager.java | 6 +-
5 files changed, 104 insertions(+), 3 deletions(-)
diff --git
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/symmetric/DefaultSecretKeyClient.java
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/symmetric/DefaultSecretKeyClient.java
index c2ac712c302..391148e2100 100644
---
a/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/symmetric/DefaultSecretKeyClient.java
+++
b/hadoop-hdds/framework/src/main/java/org/apache/hadoop/hdds/security/symmetric/DefaultSecretKeyClient.java
@@ -42,6 +42,11 @@ public ManagedSecretKey getCurrentSecretKey() {
return signerClientDelegate.getCurrentSecretKey();
}
+ @Override
+ public void refetchSecretKey() {
+ signerClientDelegate.refetchSecretKey();
+ }
+
@Override
public void start(ConfigurationSource conf) throws IOException {
signerClientDelegate.start(conf);
diff --git
a/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/symmetric/TestDefaultSecretKeyClient.java
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/symmetric/TestDefaultSecretKeyClient.java
new file mode 100644
index 00000000000..174d770b587
--- /dev/null
+++
b/hadoop-hdds/framework/src/test/java/org/apache/hadoop/hdds/security/symmetric/TestDefaultSecretKeyClient.java
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hadoop.hdds.security.symmetric;
+
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.time.Duration;
+import java.time.Instant;
+import org.apache.hadoop.hdds.conf.OzoneConfiguration;
+import org.apache.hadoop.hdds.protocol.SecretKeyProtocol;
+import org.junit.jupiter.api.Test;
+
+/** Tests refreshing the signing key through the composite client. */
+class TestDefaultSecretKeyClient {
+ @Test
+ void refetchSecretKeyUpdatesCurrentKey() throws Exception {
+ SecretKeyProtocol scm = mock(SecretKeyProtocol.class);
+ ManagedSecretKey oldKey = SecretKeyTestUtil.generateHmac(Instant.now(),
Duration.ofDays(9));
+ ManagedSecretKey newKey = SecretKeyTestUtil.generateHmac(Instant.now(),
Duration.ofDays(9));
+ when(scm.getCurrentSecretKey()).thenReturn(oldKey, newKey);
+ SecretKeyClient client = DefaultSecretKeyClient.create(new
OzoneConfiguration(), scm, "test-");
+ try {
+ client.start(new OzoneConfiguration());
+ assertSame(oldKey, client.getCurrentSecretKey());
+ client.refetchSecretKey();
+ assertSame(newKey, client.getCurrentSecretKey());
+ verify(scm, times(2)).getCurrentSecretKey();
+ } finally {
+ client.stop();
+ }
+ }
+
+ @Test
+ void refetchSecretKeyPropagatesFailure() throws Exception {
+ SecretKeyProtocol scm = mock(SecretKeyProtocol.class);
+ ManagedSecretKey oldKey = SecretKeyTestUtil.generateHmac(Instant.now(),
Duration.ofDays(9));
+ IOException failure = new IOException("SCM fetch failed");
+ when(scm.getCurrentSecretKey()).thenReturn(oldKey).thenThrow(failure);
+ SecretKeyClient client = DefaultSecretKeyClient.create(new
OzoneConfiguration(), scm, "test-");
+ try {
+ client.start(new OzoneConfiguration());
+ UncheckedIOException exception =
assertThrows(UncheckedIOException.class, client::refetchSecretKey);
+ assertSame(failure, exception.getCause());
+ assertSame(oldKey, client.getCurrentSecretKey());
+ } finally {
+ client.stop();
+ }
+ }
+}
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestBlockTokensCLI.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestBlockTokensCLI.java
index 31c3b36dd46..f0dbb9833df 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestBlockTokensCLI.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/TestBlockTokensCLI.java
@@ -44,7 +44,6 @@
import java.io.File;
import java.io.IOException;
import java.io.PrintStream;
-import java.io.UnsupportedEncodingException;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.time.Duration;
@@ -182,7 +181,8 @@ private static void setSecureConfig() throws IOException {
}
@Test
- public void testFetchKeyOMAdminCommand() throws UnsupportedEncodingException
{
+ public void testFetchKeyOMAdminCommand() throws Exception {
+ getScmSecretKeyManager().checkAndRotate(true);
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
PrintStream printStream = new PrintStream(outputStream, true, "UTF-8");
System.setOut(printStream);
diff --git
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestOMAdminRpcAuthorization.java
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestOMAdminRpcAuthorization.java
index 654f8ab2a5b..817cb575f68 100644
---
a/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestOMAdminRpcAuthorization.java
+++
b/hadoop-ozone/integration-test/src/test/java/org/apache/hadoop/ozone/om/TestOMAdminRpcAuthorization.java
@@ -22,13 +22,17 @@
import static
org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ACL_AUTHORIZER_CLASS_NATIVE;
import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ACL_ENABLED;
import static org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_ADMINISTRATORS;
+import static
org.apache.hadoop.ozone.OzoneConfigKeys.OZONE_CLIENT_FAILOVER_MAX_ATTEMPTS_KEY;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.doThrow;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.when;
+import java.io.IOException;
+import java.io.UncheckedIOException;
import java.security.PrivilegedExceptionAction;
import java.util.UUID;
import org.apache.hadoop.fs.SafeModeAction;
@@ -72,6 +76,7 @@ public class TestOMAdminRpcAuthorization {
@BeforeAll
static void init() throws Exception {
conf = new OzoneConfiguration();
+ conf.setInt(OZONE_CLIENT_FAILOVER_MAX_ATTEMPTS_KEY, 0);
conf.setBoolean(OZONE_ACL_ENABLED, true);
conf.set(OZONE_ACL_AUTHORIZER_CLASS, OZONE_ACL_AUTHORIZER_CLASS_NATIVE);
conf.set(OZONE_ADMINISTRATORS, "admin");
@@ -157,6 +162,22 @@ void refetchSecretKeyAdminIsAllowed() throws Exception {
assertEquals(secretKeyId, refetchSecretKey(admin));
}
+ @Test
+ void refetchSecretKeyFailureIsReturned() {
+ SecretKeyClient original = cluster.getOzoneManager().getSecretKeyClient();
+ SecretKeyClient failingClient = mock(SecretKeyClient.class);
+ doThrow(new UncheckedIOException(new IOException("SCM fetch
failed"))).when(failingClient).refetchSecretKey();
+ cluster.getOzoneManager().setSecretKeyClient(failingClient);
+ try {
+ UserGroupInformation admin =
UserGroupInformation.createUserForTesting("admin", new String[] {"admins"});
+ OMException exception = assertThrows(OMException.class, () ->
refetchSecretKey(admin));
+ assertEquals(OMException.ResultCodes.INTERNAL_ERROR,
exception.getResult());
+ assertTrue(exception.getMessage().contains("SCM fetch failed"));
+ } finally {
+ cluster.getOzoneManager().setSecretKeyClient(original);
+ }
+ }
+
@Test
void getOMConfigurationNonAdminIsDenied() throws Exception {
UserGroupInformation nonAdmin =
diff --git
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
index de6b83b653c..a19a054dd99 100644
---
a/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
+++
b/hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java
@@ -1419,7 +1419,11 @@ public SecretKeyClient getSecretKeyClient() {
@Override
public UUID refetchSecretKey() throws IOException {
checkAdminUserPrivilege("refetch secret key.");
- secretKeyClient.refetchSecretKey();
+ try {
+ secretKeyClient.refetchSecretKey();
+ } catch (UncheckedIOException e) {
+ throw e.getCause();
+ }
return secretKeyClient.getCurrentSecretKey().getId();
}
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
