polyzos commented on PR #3300: URL: https://github.com/apache/fluss/pull/3300#issuecomment-5010894537
Thanks for tackling this. One thing to address here: `lakeTieringHeartbeat` is not an internal-only RPC. It's called by the external Flink tiering job and calls `lakeTieringHeartbeat()` as its first startup action. Since `session.isInternal()` is only `true` for connections on `internal.listener.name`, the reject-all-external guard will throw `AuthorizationException` and **break lake tiering in any cluster with separate client/internal listeners**, i.e., exactly the secured deployments where authz is enabled. The existing tests don't catch this because the default single-listener setup (`FLUSS` = both client and internal, since `INTERNAL_LISTENER_NAME` defaults to `DEFAULT_LISTENER_NAME`) makes the test client look internal. The same should apply for #3301 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
