Andrew Wong has posted comments on this change. ( http://gerrit.cloudera.org:8080/17529 )
Change subject: WIP: KUDU-2612 allow system user to read list of table replicas ...................................................................... Patch Set 1: (2 comments) http://gerrit.cloudera.org:8080/#/c/17529/1/src/kudu/integration-tests/ts_authz-itest.cc File src/kudu/integration-tests/ts_authz-itest.cc: http://gerrit.cloudera.org:8080/#/c/17529/1/src/kudu/integration-tests/ts_authz-itest.cc@705 PS1, Line 705: opts.num_tablet_servers = 3; > The point was to have as many default settings as possible in this scenario I'm fairly confident that's the case -- follower replicas don't perform authz checks. http://gerrit.cloudera.org:8080/#/c/17529/1/src/kudu/master/catalog_manager.cc File src/kudu/master/catalog_manager.cc: http://gerrit.cloudera.org:8080/#/c/17529/1/src/kudu/master/catalog_manager.cc@5536 PS1, Line 5536: && !master_->IsServiceUserOrSuperUser(*user)) { : // Acquire the table lock and then check that the user is authorized to operate on : // the table that the tablet belongs to. : TableMetadataLock table_lock(tablet_info->table().get(), LockMode::READ); > I guess what I wanted to point is that in this context the service user tha Ah indeed, I missed the context that this was for getting tablet locations by ID upon commit. Sorry for the noise. I suppose getting TabletLocations responses isn't strictly sensitive. At most, it contains the partition keys. I think I'm ok with opening this endpoint up a bit to service users in this way. -- To view, visit http://gerrit.cloudera.org:8080/17529 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: kudu Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I26f06af17e5ee85522e2ef867d41cf0f3ddbe5d5 Gerrit-Change-Number: 17529 Gerrit-PatchSet: 1 Gerrit-Owner: Alexey Serbin <[email protected]> Gerrit-Reviewer: Alexey Serbin <[email protected]> Gerrit-Reviewer: Andrew Wong <[email protected]> Gerrit-Reviewer: Grant Henke <[email protected]> Gerrit-Reviewer: Kudu Jenkins (120) Gerrit-Comment-Date: Tue, 01 Jun 2021 19:05:45 +0000 Gerrit-HasComments: Yes
