xiangfu0 opened a new pull request, #19966: URL: https://github.com/apache/pinot/pull/19966
Native server admission previously trusted a claimed broker identity and did not bind streamed result delivery to authenticated broker authority. This change projects certificate/session/tenant grants with each coherent installation snapshot, bounds the broker lease from the snapshot RPC's first send, and checks the captured authority throughout query delivery. An explicit opt-in `GrpcQueryServer` constructor uses verified mutual TLS and fences each streamed block, final response, and successful completion. Existing Helix/ZK construction remains the default. Native query listeners remain disabled in normal starters. Stacked on #19965. All PRs in this series remain drafts. Validation: - 87 focused TestNG tests passed across permit/deadline context, physical acquisition, authenticated gRPC, server metadata/lifecycle, catalog, metadata transport, controller APIs, and normal starters. - Affected-module formatting, checkstyle, and license validation passed. Compilation used warning/deprecation flags; no warnings matched added source lines. - Focused tests cover real mutual TLS, certificate binding, admission rejection, streamed/final completion fencing, revocation, delayed snapshots, and lost-response recovery. This adds local admission and enqueue-time fences; it does not establish remote receipt before expiry. Normal broker planning/dispatch/lifecycle, receiver-side validation, production clock qualification, and an owned TLS rotation lifecycle remain required before native query activation. The bounded metadata projection can conservatively reject oversized grants, and authorization changes currently fence all queries on the affected server. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
