yandrey321 opened a new pull request, #11024:
URL: https://github.com/apache/ozone/pull/11024
## What changes were proposed in this pull request?
HDDS-15244 reported that the `/logLevel` HTTP endpoint is inaccessible in
secure
clusters (permanent 403 / SPNEGO replay). Investigation showed the endpoint
is
**not** broken on master:
- In a secure cluster operators set
`ozone.http.filter.initializers=org.apache.hadoop.security.AuthenticationFilterInitializer`
(see `compose/ozonesecure` and `SecuringOzoneHTTP.md`). That initializer
registers
the SPNEGO `AuthenticationFilter` as `authentication`.
- `addDefaultServlets()` registers `/logLevel` via `addServlet(...)`, which
calls
`addFilterPathMapping("/logLevel", …)` — mapping the auth filter onto
`/logLevel`
exactly **once**.
- Result: `/logLevel` challenges unauthenticated requests (401) and returns
200 to an
authenticated Ozone admin, gated by `hasAdministratorAccess`.
This PR:
1. **Adds integration tests** locking the (already-correct) behavior in both
non-secure
and secure (SPNEGO/Kerberos + MiniKdc) clusters, covering OM, SCM and DN:
- `TestLogLevelEndpointInsecure` — GET/SET `/logLevel` return 200 and
reflect the level change.
- `TestLogLevelEndpointSecure` — authenticated admin GET/SET succeed over
SPNEGO;
unauthenticated requests are rejected (401/403). The secure test sets
`ozone.http.filter.initializers=AuthenticationFilterInitializer`,
mirroring a real
secure cluster, and restores global login-user / `jdk.http.auth.*`
system state
around each request.
- `LogLevelEndpointTestUtil` — shared helpers for both suites.
2. **Corrects the documentation** (`Observability.md` /
`Observability.zh.md`), which
stated `/logLevel` is "not yet supported in secure environment". These
endpoints work
over SPNEGO: run `kinit` first, the requesting user must be an Ozone
administrator, and
`ozone insight` negotiates SPNEGO automatically (since HDDS-13883).
No change to `ozone insight` — SPNEGO client support already exists.
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-15244
## How was this patch tested?
New integration tests, run locally:
- `TestLogLevelEndpointInsecure` — 6/6 pass (GET/SET on OM, SCM, DN).
- `TestLogLevelEndpointSecure` — 9/9 pass (admin GET/SET over SPNEGO on OM,
SCM, DN;
unauthenticated requests rejected).
- Total 15/15, `checkstyle:check` clean on the touched modules.
```
mvn -pl hadoop-ozone/integration-test test \
-Dtest=TestLogLevelEndpointInsecure,TestLogLevelEndpointSecure
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
