simbadzina commented on code in PR #5936:
URL: https://github.com/apache/hadoop/pull/5936#discussion_r1290501755
##########
hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/token/delegation/SQLDelegationTokenSecretManager.java:
##########
@@ -153,6 +163,39 @@ public synchronized TokenIdent
cancelToken(Token<TokenIdent> token,
return super.cancelToken(token, canceller);
}
+ /**
+ * Obtain a list of tokens that will be considered for cleanup, based on the
last
+ * time the token was updated in SQL. This list may include tokens that are
not
+ * expired and should not be deleted (e.g. if the token was last renewed
using a
+ * higher renewal interval).
+ * The number of results is limited to reduce performance impact. Some level
of
+ * contention is expected when multiple routers run cleanup simultaneously.
+ * @return Map of tokens that have not been updated in SQL after the token
renewal
+ * period.
+ */
+ @Override
+ protected Map<TokenIdent, DelegationTokenInformation> getTokensForCleanup() {
+ Map<TokenIdent, DelegationTokenInformation> tokens = new HashMap<>();
+ try {
+ // Query SQL for tokens that haven't been updated after
+ // the last token renewal period.
+ long maxModifiedTime = Time.now() - getTokenRenewInterval();
+ Map<byte[], byte[]> tokenInfoBytesList =
selectTokenInfos(maxModifiedTime,
+ this.maxTokenCleanupResults);
+
+ LOG.info("Found {} tokens for cleanup", tokenInfoBytesList.size());
+ for (Map.Entry<byte[], byte[]> tokenInfoBytes :
tokenInfoBytesList.entrySet()) {
+ TokenIdent tokenIdent = createTokenIdent(tokenInfoBytes.getKey());
+ DelegationTokenInformation tokenInfo =
createTokenInfo(tokenInfoBytes.getValue());
+ tokens.put(tokenIdent, tokenInfo);
+ }
+ } catch (IOException | SQLException e) {
+ LOG.error("Failed to get all tokens in SQL secret manager", e);
Review Comment:
This is not `all tokens` but a subset, filtered my maxModifiedTime.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
