alexandrefimov commented on code in PR #7637:
URL: https://github.com/apache/kyuubi/pull/7637#discussion_r3832224651
##########
extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/rule/config/AuthzConfigurationChecker.scala:
##########
@@ -30,6 +30,9 @@ import
org.apache.kyuubi.plugin.spark.authz.util.AuthZUtils.SKIP_CATALOGLESS_V2_
case class AuthzConfigurationChecker(spark: SparkSession) extends (LogicalPlan
=> Unit) {
final val RESTRICT_LIST_KEY = "spark.kyuubi.conf.restricted.list"
+ final val EXCLUDED_RULES_KEY = "spark.sql.optimizer.excludedRules"
+
+ final private val AUTHZ_RANGER_RULE_PACKAGE =
"org.apache.kyuubi.plugin.spark.authz.ranger"
Review Comment:
Happy to do that in a follow-up.
One thing I checked while looking at it: `excludedRules` only filters
optimizer batches, and Spark has no analyzer equivalent, so the rules that
apply masking and row filters can't be excluded at all. Of the rules the
extension injects, four are reachable this way — `RuleAuthorization` in
`…authz.ranger`, and `RuleEliminateMarker`, `RuleEliminatePermanentViewMarker`,
`RuleEliminateTypeOf` in `…authz.rule`. Reading those three, excluding one
looks like it breaks the query rather than lifting a check: the markers survive
into planning and `TypeOfPlaceHolder` has no `eval`. So widening the prefix
looks like future-proofing to me — new rules land under `…authz.rule` — rather
than closing a live bypass. That's code reading, not a run.
It does flip behaviour for anyone excluding one of those cleanup rules
today, so waiting for @cfmcgrady / @pan3793 seems right. Should I open an issue
and a PR for it once they weigh in?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
