This is an automated email from the ASF dual-hosted git repository.
manishswaminathan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/pinot.git
The following commit(s) were added to refs/heads/master by this push:
new ca952da64b1 Pull resolveAuthProvider into MinionTaskUtils for reuse in
other utils (#17626)
ca952da64b1 is described below
commit ca952da64b1e282b3cb20e269bd3bf1af4d5491b
Author: Shounak kulkarni <[email protected]>
AuthorDate: Thu Feb 5 12:12:32 2026 +0530
Pull resolveAuthProvider into MinionTaskUtils for reuse in other utils
(#17626)
* Pull resolveAuthProvider into MinionTaskUtils for reuse in other utils
* fix other usages
* skip resolving auth provider where only token is required and task
configs already have it
---
.../BaseMultipleSegmentsConversionExecutor.java | 2 +-
.../plugin/minion/tasks/BaseTaskExecutor.java | 26 +------------
.../pinot/plugin/minion/tasks/MinionTaskUtils.java | 44 ++++++++++++++++++++++
.../SegmentGenerationAndPushTaskExecutor.java | 4 +-
4 files changed, 49 insertions(+), 27 deletions(-)
diff --git
a/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/BaseMultipleSegmentsConversionExecutor.java
b/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/BaseMultipleSegmentsConversionExecutor.java
index 22a8790cb6e..22351040b04 100644
---
a/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/BaseMultipleSegmentsConversionExecutor.java
+++
b/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/BaseMultipleSegmentsConversionExecutor.java
@@ -570,7 +570,7 @@ public abstract class
BaseMultipleSegmentsConversionExecutor extends BaseTaskExe
spec.setPushJobSpec(pushJobSpec);
spec.setTableSpec(tableSpec);
spec.setPinotClusterSpecs(pinotClusterSpecs);
- spec.setAuthToken(taskConfigs.get(BatchConfigProperties.AUTH_TOKEN));
+ spec.setAuthToken(MinionTaskUtils.resolveAuthToken(taskConfigs));
return spec;
}
diff --git
a/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/BaseTaskExecutor.java
b/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/BaseTaskExecutor.java
index 245bfc2480a..061c43ea4cc 100644
---
a/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/BaseTaskExecutor.java
+++
b/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/BaseTaskExecutor.java
@@ -25,9 +25,6 @@ import java.util.Collections;
import java.util.List;
import java.util.Map;
import org.apache.commons.io.FileUtils;
-import org.apache.commons.lang3.StringUtils;
-import org.apache.pinot.common.auth.AuthProviderUtils;
-import org.apache.pinot.common.auth.NullAuthProvider;
import org.apache.pinot.common.metadata.ZKMetadataProvider;
import org.apache.pinot.common.metadata.segment.SegmentZKMetadata;
import
org.apache.pinot.common.metadata.segment.SegmentZKMetadataCustomMapModifier;
@@ -35,7 +32,6 @@ import org.apache.pinot.common.metrics.MinionMeter;
import org.apache.pinot.common.metrics.MinionMetrics;
import org.apache.pinot.common.utils.TarCompressionUtils;
import org.apache.pinot.common.utils.fetcher.SegmentFetcherFactory;
-import org.apache.pinot.core.common.MinionConstants;
import org.apache.pinot.core.minion.PinotTaskConfig;
import org.apache.pinot.core.util.PeerServerSegmentFinder;
import org.apache.pinot.minion.MinionContext;
@@ -118,28 +114,10 @@ public abstract class BaseTaskExecutor implements
PinotTaskExecutor {
}
/**
- * Resolves the AuthProvider to use for Minion tasks.
- * Priority order:
- * 1. If AUTH_TOKEN is explicitly provided in task configs (by Controller),
use it for this specific task
- * 2. Otherwise, fall back to the runtime AuthProvider from MinionContext
(enables per-request token rotation)
- *
- * This approach allows:
- * - Controller to override credentials per-task (e.g., for multi-tenancy or
privileged operations)
- * - Dynamic token rotation when no explicit override is provided
- * - Clean separation between task-specific and global authentication
+ * Resolves the AuthProvider for Minion task executors. Delegates to {@link
MinionTaskUtils#resolveAuthProvider}.
*/
protected static AuthProvider resolveAuthProvider(Map<String, String>
taskConfigs) {
- String explicitToken = taskConfigs.get(MinionConstants.AUTH_TOKEN);
- if (StringUtils.isNotBlank(explicitToken)) {
- return AuthProviderUtils.makeAuthProvider(explicitToken);
- }
-
- AuthProvider runtimeProvider = MINION_CONTEXT.getTaskAuthProvider();
- if (runtimeProvider == null || runtimeProvider instanceof
NullAuthProvider) {
- return new NullAuthProvider();
- }
-
- return runtimeProvider;
+ return MinionTaskUtils.resolveAuthProvider(taskConfigs);
}
protected File downloadSegmentToLocalAndUntar(String tableNameWithType,
String segmentName, String deepstoreURL,
diff --git
a/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/MinionTaskUtils.java
b/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/MinionTaskUtils.java
index de88fb3a0eb..2da96335b75 100644
---
a/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/MinionTaskUtils.java
+++
b/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/MinionTaskUtils.java
@@ -33,6 +33,8 @@ import org.apache.commons.lang3.StringUtils;
import org.apache.helix.HelixAdmin;
import org.apache.helix.model.ExternalView;
import org.apache.helix.model.InstanceConfig;
+import org.apache.pinot.common.auth.AuthProviderUtils;
+import org.apache.pinot.common.auth.NullAuthProvider;
import org.apache.pinot.common.restlet.resources.ValidDocIdsBitmapResponse;
import org.apache.pinot.common.restlet.resources.ValidDocIdsMetadataInfo;
import org.apache.pinot.common.restlet.resources.ValidDocIdsType;
@@ -41,7 +43,9 @@ import org.apache.pinot.common.utils.ServiceStatus;
import org.apache.pinot.common.utils.config.InstanceUtils;
import org.apache.pinot.controller.helix.core.minion.ClusterInfoAccessor;
import org.apache.pinot.controller.util.ServerSegmentMetadataReader;
+import org.apache.pinot.core.common.MinionConstants;
import org.apache.pinot.minion.MinionContext;
+import org.apache.pinot.spi.auth.AuthProvider;
import org.apache.pinot.spi.config.table.TableConfig;
import org.apache.pinot.spi.config.table.TableTaskConfig;
import org.apache.pinot.spi.config.table.UpsertConfig;
@@ -71,6 +75,46 @@ public class MinionTaskUtils {
private MinionTaskUtils() {
}
+ /**
+ * Resolves the AuthProvider to use for Minion tasks.
+ * Priority order:
+ * 1. If AUTH_TOKEN is explicitly provided in task configs (by Controller),
use it for this specific task
+ * 2. Otherwise, fall back to the runtime AuthProvider from MinionContext
(enables per-request token rotation)
+ *
+ * This allows any minion task or util to resolve auth from task configs
without requiring callers to pass
+ * AuthProvider explicitly.
+ */
+ public static AuthProvider resolveAuthProvider(Map<String, String>
taskConfigs) {
+ String explicitToken = taskConfigs.get(MinionConstants.AUTH_TOKEN);
+ if (StringUtils.isNotBlank(explicitToken)) {
+ return AuthProviderUtils.makeAuthProvider(explicitToken);
+ }
+
+ AuthProvider runtimeProvider =
MinionContext.getInstance().getTaskAuthProvider();
+ if (runtimeProvider == null || runtimeProvider instanceof
NullAuthProvider) {
+ return new NullAuthProvider();
+ }
+
+ return runtimeProvider;
+ }
+
+ /**
+ * Resolves the auth token string to use for Minion tasks (e.g. for specs
that accept a token string).
+ * If AUTH_TOKEN is already present in task configs, returns it without
creating an AuthProvider.
+ * Otherwise resolves via {@link #resolveAuthProvider} and returns its
static token.
+ *
+ * @param taskConfigs task config map (may contain
MinionConstants.AUTH_TOKEN)
+ * @return auth token string, or null if none
+ */
+ @Nullable
+ public static String resolveAuthToken(Map<String, String> taskConfigs) {
+ String explicitToken = taskConfigs.get(MinionConstants.AUTH_TOKEN);
+ if (StringUtils.isNotBlank(explicitToken)) {
+ return explicitToken;
+ }
+ return AuthProviderUtils.toStaticToken(resolveAuthProvider(taskConfigs));
+ }
+
public static PinotFS getInputPinotFS(Map<String, String> taskConfigs, URI
fileURI)
throws Exception {
String fileURIScheme = fileURI.getScheme();
diff --git
a/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/segmentgenerationandpush/SegmentGenerationAndPushTaskExecutor.java
b/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/segmentgenerationandpush/SegmentGenerationAndPushTaskExecutor.java
index fb97f90cc84..dc42ca8eda9 100644
---
a/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/segmentgenerationandpush/SegmentGenerationAndPushTaskExecutor.java
+++
b/pinot-plugins/pinot-minion-tasks/pinot-minion-builtin-tasks/src/main/java/org/apache/pinot/plugin/minion/tasks/segmentgenerationandpush/SegmentGenerationAndPushTaskExecutor.java
@@ -231,7 +231,7 @@ public class SegmentGenerationAndPushTaskExecutor extends
BaseTaskExecutor {
spec.setPushJobSpec(pushJobSpec);
spec.setTableSpec(tableSpec);
spec.setPinotClusterSpecs(pinotClusterSpecs);
- spec.setAuthToken(taskConfigs.get(BatchConfigProperties.AUTH_TOKEN));
+ spec.setAuthToken(MinionTaskUtils.resolveAuthToken(taskConfigs));
return spec;
}
@@ -295,7 +295,7 @@ public class SegmentGenerationAndPushTaskExecutor extends
BaseTaskExecutor {
BatchConfigProperties.RECORD_READER_PROP_PREFIX));
taskSpec.setRecordReaderSpec(recordReaderSpec);
- String authToken = taskConfigs.get(BatchConfigProperties.AUTH_TOKEN);
+ String authToken = MinionTaskUtils.resolveAuthToken(taskConfigs);
String tableNameWithType =
taskConfigs.get(BatchConfigProperties.TABLE_NAME);
Schema schema;
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
