Alex Behm has posted comments on this change. Change subject: IMPALA-5355: Fix the order of Sentry roles and privileges ......................................................................
Patch Set 1: (1 comment) http://gerrit.cloudera.org:8080/#/c/7004/1/fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java File fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java: Line 1214: public Role removeRoleGrantGroup(String roleName, String groupName) This approach looks correct, but I wonder if we should instead solve the dependency issue in ImpaladCatalog.updateCatalog(). We have a two-level hierarchy, so we could do a first pass over the updates to separate them into two lists. Then we apply the 'parent' list first, followed by the 'child' list. The alternative approach has the following benefits: - It deals with all objects in a consistent way, whereas the current approach is a one-off only for the roles/privileges which would definitely not work for the equivalent problem on dbs/tables (today we are saved by not having an ALTER DATABASE). - It moves the additional work out of the 'critical' path where the catalogLock_ is held. - It avoids unnecessarily updating and sending all (unchanged) privileges again. -- To view, visit http://gerrit.cloudera.org:8080/7004 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-MessageType: comment Gerrit-Change-Id: I7072e95b74952ce5a51ea1b6e2ae3e80fb0940e0 Gerrit-PatchSet: 1 Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-Owner: Taras Bobrovytsky <[email protected]> Gerrit-Reviewer: Alex Behm <[email protected]> Gerrit-Reviewer: Dimitris Tsirogiannis <[email protected]> Gerrit-HasComments: Yes
