Andrew Wong has posted comments on this change. ( http://gerrit.cloudera.org:8080/17529 )
Change subject: WIP: KUDU-2612 allow system user to read list of table replicas ...................................................................... Patch Set 1: (3 comments) http://gerrit.cloudera.org:8080/#/c/17529/1/src/kudu/integration-tests/ts_authz-itest.cc File src/kudu/integration-tests/ts_authz-itest.cc: http://gerrit.cloudera.org:8080/#/c/17529/1/src/kudu/integration-tests/ts_authz-itest.cc@705 PS1, Line 705: opts.num_tablet_servers = 3; nit: we could also reduce this to 1, and reduce the replication factor of the txn status table for this test with the --txn_manager_status_table_num_replicas flag -- especially if the test doesn't otherwise depend on replication. http://gerrit.cloudera.org:8080/#/c/17529/1/src/kudu/integration-tests/ts_authz-itest.cc@713 PS1, Line 713: TEST_P(TSAuthzTxnOpsITest, BasicOpsOnEmptyTransactions) { nit: if it's more convenient, TestWorkload might be worth trying out for these tests instead, so you don't have to add so much boilerplate code. It might not be, given I know TestWorkloads typically expect no errors, but in case you hadn't considered it. http://gerrit.cloudera.org:8080/#/c/17529/1/src/kudu/master/catalog_manager.cc File src/kudu/master/catalog_manager.cc: http://gerrit.cloudera.org:8080/#/c/17529/1/src/kudu/master/catalog_manager.cc@5536 PS1, Line 5536: && !master_->IsServiceUserOrSuperUser(*user)) { : // Acquire the table lock and then check that the user is authorized to operate on : // the table that the tablet belongs to. : TableMetadataLock table_lock(tablet_info->table().get(), LockMode::READ); Would it make sense to check the table type from here, and opt out of authz checks only if this is a system table? I guess it's a broader product question: do we want to follow suit with the recent changes and broaden the allowed users for this RPC endpoint? I think conservatively, the answer is no, and we should only make the changes required for transactions. -- To view, visit http://gerrit.cloudera.org:8080/17529 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I26f06af17e5ee85522e2ef867d41cf0f3ddbe5d5 Gerrit-Change-Number: 17529 Gerrit-PatchSet: 1 Gerrit-Owner: Alexey Serbin <[email protected]> Gerrit-Reviewer: Andrew Wong <[email protected]> Gerrit-Reviewer: Grant Henke <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120) Gerrit-Comment-Date: Tue, 01 Jun 2021 17:48:41 +0000 Gerrit-HasComments: Yes
