You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by GitBox <gi...@apache.org> on 2021/11/18 15:52:07 UTC
[GitHub] [nifi] markap14 opened a new pull request #5533: NIFI-9382: Created a new ClassloaderIsolationKey mechanism by which H…
markap14 opened a new pull request #5533:
URL: https://github.com/apache/nifi/pull/5533
…adoop related processors (and potentially others) can indicate that they need full classloaders to be cloned but can share with other instances in certain circumstances
- Added system tests
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
Thank you for submitting a contribution to Apache NiFi.
Please provide a short description of the PR here:
#### Description of PR
_Enables X functionality; fixes bug NIFI-YYYY._
In order to streamline the review of the contribution we ask you
to ensure the following steps have been taken:
### For all changes:
- [ ] Is there a JIRA ticket associated with this PR? Is it referenced
in the commit message?
- [ ] Does your PR title start with **NIFI-XXXX** where XXXX is the JIRA number you are trying to resolve? Pay particular attention to the hyphen "-" character.
- [ ] Has your PR been rebased against the latest commit within the target branch (typically `main`)?
- [ ] Is your initial contribution a single, squashed commit? _Additional commits in response to PR reviewer feedback should be made on this branch and pushed to allow change tracking. Do not `squash` or use `--force` when pushing to allow for clean monitoring of changes._
### For code changes:
- [ ] Have you ensured that the full suite of tests is executed via `mvn -Pcontrib-check clean install` at the root `nifi` folder?
- [ ] Have you written or updated unit tests to verify your changes?
- [ ] Have you verified that the full build is successful on JDK 8?
- [ ] Have you verified that the full build is successful on JDK 11?
- [ ] If adding new dependencies to the code, are these dependencies licensed in a way that is compatible for inclusion under [ASF 2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE` file, including the main `LICENSE` file under `nifi-assembly`?
- [ ] If applicable, have you updated the `NOTICE` file, including the main `NOTICE` file found under `nifi-assembly`?
- [ ] If adding new Properties, have you added `.displayName` in addition to .name (programmatic access) for each of the new properties?
### For documentation related changes:
- [ ] Have you ensured that format looks appropriate for the output in which it is rendered?
### Note:
Please ensure that once the PR is submitted, you check GitHub Actions CI for build issues and submit an update to your PR as soon as possible.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] adenes commented on a change in pull request #5533: NIFI-9382: Created a new ClassloaderIsolationKey mechanism by which H…
Posted by GitBox <gi...@apache.org>.
adenes commented on a change in pull request #5533:
URL: https://github.com/apache/nifi/pull/5533#discussion_r752453257
##########
File path: nifi-api/src/main/java/org/apache/nifi/components/ClassloaderIsolationKey.java
##########
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.nifi.components;
+
+import org.apache.nifi.context.PropertyContext;
+
+/**
+ * <p>
+ * There are times when a component must be created in such a way that each instance gets its own ClassLoader hierarchy,
+ * rather than sharing the ClassLoader with other components (see {@link org.apache.nifi.annotation.behavior.RequiresInstanceClassLoading @RequiresInstanceClassLoading}).
+ * This, however, can be extremely expensive, as all of the classes must be loaded again for each instance of the component. When thousands of these
+ * components are used in a single flow, the startup time can be great, and it can lead to massive amounts of RAM being required.
+ * </p>
+ *
+ * <p>
+ * For components that do require instance ClassLoading that clones ancestor resources, this interface can be optional implemented by the component.
+ * If the interface is implemented, the component is given the opportunity to return a distinct "key" that can be used to identify instances that may share
+ * the same ClassLoader.
+ * </p>
+ */
+public interface ClassloaderIsolationKey {
Review comment:
Wouldn't be `ClassloaderIsolationKeyAware` or `...Provider` a better name for this class as not the actual instances are the keys but they just provide it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] markap14 commented on a change in pull request #5533: NIFI-9382: Created a new ClassloaderIsolationKey mechanism by which H…
Posted by GitBox <gi...@apache.org>.
markap14 commented on a change in pull request #5533:
URL: https://github.com/apache/nifi/pull/5533#discussion_r752536616
##########
File path: nifi-api/src/main/java/org/apache/nifi/components/ClassloaderIsolationKey.java
##########
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.nifi.components;
+
+import org.apache.nifi.context.PropertyContext;
+
+/**
+ * <p>
+ * There are times when a component must be created in such a way that each instance gets its own ClassLoader hierarchy,
+ * rather than sharing the ClassLoader with other components (see {@link org.apache.nifi.annotation.behavior.RequiresInstanceClassLoading @RequiresInstanceClassLoading}).
+ * This, however, can be extremely expensive, as all of the classes must be loaded again for each instance of the component. When thousands of these
+ * components are used in a single flow, the startup time can be great, and it can lead to massive amounts of RAM being required.
+ * </p>
+ *
+ * <p>
+ * For components that do require instance ClassLoading that clones ancestor resources, this interface can be optional implemented by the component.
+ * If the interface is implemented, the component is given the opportunity to return a distinct "key" that can be used to identify instances that may share
+ * the same ClassLoader.
+ * </p>
+ */
+public interface ClassloaderIsolationKey {
Review comment:
Fair enough. Will rename to `ClassloaderIsolationKeyProvider`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] bbende merged pull request #5533: NIFI-9382: Created a new ClassloaderIsolationKey mechanism by which H…
Posted by GitBox <gi...@apache.org>.
bbende merged pull request #5533:
URL: https://github.com/apache/nifi/pull/5533
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nifi] bbende commented on a change in pull request #5533: NIFI-9382: Created a new ClassloaderIsolationKey mechanism by which H…
Posted by GitBox <gi...@apache.org>.
bbende commented on a change in pull request #5533:
URL: https://github.com/apache/nifi/pull/5533#discussion_r752635371
##########
File path: nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-nar-utils/src/main/java/org/apache/nifi/nar/StandardExtensionDiscoveringManager.java
##########
@@ -383,42 +388,69 @@ public InstanceClassLoader createInstanceClassLoader(final String classType, fin
final ConfigurableComponent tempComponent = getTempComponent(classType, bundle.getBundleDetails().getCoordinate());
final Class<?> type = tempComponent.getClass();
- final RequiresInstanceClassLoading requiresInstanceClassLoading = type.getAnnotation(RequiresInstanceClassLoading.class);
-
- final NarClassLoader narBundleClassLoader = (NarClassLoader) bundleClassLoader;
- logger.debug("Including ClassLoader resources from {} for component {}", new Object[] {bundle.getBundleDetails(), instanceIdentifier});
+ final boolean allowsSharedClassloader = tempComponent instanceof ClassloaderIsolationKeyProvider;
+ if (allowsSharedClassloader && classloaderIsolationKey == null) {
+ instanceClassLoader = new InstanceClassLoader(instanceIdentifier, classType, Collections.emptySet(), additionalUrls, bundleClassLoader);
+ } else {
+ final BaseClassLoaderKey baseClassLoaderKey = classloaderIsolationKey == null ? null : new BaseClassLoaderKey(bundle, classloaderIsolationKey);
+ final NarClassLoader narBundleClassLoader = (NarClassLoader) bundleClassLoader;
+ logger.debug("Including ClassLoader resources from {} for component {}", new Object[]{bundle.getBundleDetails(), instanceIdentifier});
+
+ final Set<URL> instanceUrls = new LinkedHashSet<>(Arrays.asList(narBundleClassLoader.getURLs()));
+ final Set<File> narNativeLibDirs = new LinkedHashSet<>();
+ narNativeLibDirs.add(narBundleClassLoader.getNARNativeLibDir());
+
+ ClassLoader ancestorClassLoader = narBundleClassLoader.getParent();
+
+ boolean resolvedSharedClassLoader = false;
+ final RequiresInstanceClassLoading requiresInstanceClassLoading = type.getAnnotation(RequiresInstanceClassLoading.class);
+ if (requiresInstanceClassLoading.cloneAncestorResources()) {
+ // Check to see if there's already a shared ClassLoader that can be used as the parent/base classloader
+ if (baseClassLoaderKey != null) {
+ final ClassLoader sharedBaseClassloader = sharedBaseClassloaders.get(baseClassLoaderKey);
+ if (sharedBaseClassloader != null) {
+ resolvedSharedClassLoader = true;
+ ancestorClassLoader = sharedBaseClassloader;
+ logger.debug("Creating InstanceClassLoader for type {} using shared Base ClassLoader {} for component {}", type, sharedBaseClassloader, instanceIdentifier);
+ }
+ }
- final Set<URL> instanceUrls = new LinkedHashSet<>();
- final Set<File> narNativeLibDirs = new LinkedHashSet<>();
+ // If we didn't find a shared ClassLoader to use, go ahead and clone the bundle's ClassLoader.
+ if (!resolvedSharedClassLoader) {
+ final ConfigurableComponent component = getTempComponent(classType, bundle.getBundleDetails().getCoordinate());
+ final Set<BundleCoordinate> reachableApiBundles = findReachableApiBundles(component);
- narNativeLibDirs.add(narBundleClassLoader.getNARNativeLibDir());
- instanceUrls.addAll(Arrays.asList(narBundleClassLoader.getURLs()));
+ while (ancestorClassLoader instanceof NarClassLoader) {
+ final Bundle ancestorNarBundle = classLoaderBundleLookup.get(ancestorClassLoader);
- ClassLoader ancestorClassLoader = narBundleClassLoader.getParent();
+ // stop including ancestor resources when we reach one of the APIs, or when we hit the Jetty NAR
+ if (ancestorNarBundle == null || reachableApiBundles.contains(ancestorNarBundle.getBundleDetails().getCoordinate())
+ || ancestorNarBundle.getBundleDetails().getCoordinate().getId().equals(NarClassLoaders.JETTY_NAR_ID)) {
+ break;
+ }
- if (requiresInstanceClassLoading.cloneAncestorResources()) {
- final ConfigurableComponent component = getTempComponent(classType, bundle.getBundleDetails().getCoordinate());
- final Set<BundleCoordinate> reachableApiBundles = findReachableApiBundles(component);
+ final NarClassLoader ancestorNarClassLoader = (NarClassLoader) ancestorClassLoader;
- while (ancestorClassLoader instanceof NarClassLoader) {
- final Bundle ancestorNarBundle = classLoaderBundleLookup.get(ancestorClassLoader);
+ narNativeLibDirs.add(ancestorNarClassLoader.getNARNativeLibDir());
+ Collections.addAll(instanceUrls, ancestorNarClassLoader.getURLs());
- // stop including ancestor resources when we reach one of the APIs, or when we hit the Jetty NAR
- if (ancestorNarBundle == null || reachableApiBundles.contains(ancestorNarBundle.getBundleDetails().getCoordinate())
- || ancestorNarBundle.getBundleDetails().getCoordinate().getId().equals(NarClassLoaders.JETTY_NAR_ID)) {
- break;
+ ancestorClassLoader = ancestorNarClassLoader.getParent();
+ }
}
+ }
- final NarClassLoader ancestorNarClassLoader = (NarClassLoader) ancestorClassLoader;
-
- narNativeLibDirs.add(ancestorNarClassLoader.getNARNativeLibDir());
- Collections.addAll(instanceUrls, ancestorNarClassLoader.getURLs());
+ // register our new InstanceClassLoader as the shared base classloader.
+ if (baseClassLoaderKey != null && !resolvedSharedClassLoader) {
+ // Created a shared class loader that is everything we need except for the additional URLs, as the additional URLs are instance-specific.
+ final ClassLoader sharedClassLoader = new SharedInstanceClassLoader(instanceIdentifier, classType, instanceUrls, Collections.emptySet(), narNativeLibDirs, ancestorClassLoader);
+ instanceClassLoader = new InstanceClassLoader(instanceIdentifier, classType, Collections.emptySet(), additionalUrls, Collections.emptySet(), sharedClassLoader);
- ancestorClassLoader = ancestorNarClassLoader.getParent();
+ logger.debug("Creating InstanceClassLoader for type {} using newly created shared Base ClassLoader {} for component {}", type, instanceClassLoader, instanceIdentifier);
Review comment:
Should pass in sharedClassLoader to the logging statement, rather than instanceClassLoader
##########
File path: nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-nar-utils/src/main/java/org/apache/nifi/nar/StandardExtensionDiscoveringManager.java
##########
@@ -383,42 +388,69 @@ public InstanceClassLoader createInstanceClassLoader(final String classType, fin
final ConfigurableComponent tempComponent = getTempComponent(classType, bundle.getBundleDetails().getCoordinate());
final Class<?> type = tempComponent.getClass();
- final RequiresInstanceClassLoading requiresInstanceClassLoading = type.getAnnotation(RequiresInstanceClassLoading.class);
-
- final NarClassLoader narBundleClassLoader = (NarClassLoader) bundleClassLoader;
- logger.debug("Including ClassLoader resources from {} for component {}", new Object[] {bundle.getBundleDetails(), instanceIdentifier});
+ final boolean allowsSharedClassloader = tempComponent instanceof ClassloaderIsolationKeyProvider;
+ if (allowsSharedClassloader && classloaderIsolationKey == null) {
+ instanceClassLoader = new InstanceClassLoader(instanceIdentifier, classType, Collections.emptySet(), additionalUrls, bundleClassLoader);
+ } else {
+ final BaseClassLoaderKey baseClassLoaderKey = classloaderIsolationKey == null ? null : new BaseClassLoaderKey(bundle, classloaderIsolationKey);
+ final NarClassLoader narBundleClassLoader = (NarClassLoader) bundleClassLoader;
+ logger.debug("Including ClassLoader resources from {} for component {}", new Object[]{bundle.getBundleDetails(), instanceIdentifier});
+
+ final Set<URL> instanceUrls = new LinkedHashSet<>(Arrays.asList(narBundleClassLoader.getURLs()));
+ final Set<File> narNativeLibDirs = new LinkedHashSet<>();
+ narNativeLibDirs.add(narBundleClassLoader.getNARNativeLibDir());
+
+ ClassLoader ancestorClassLoader = narBundleClassLoader.getParent();
+
+ boolean resolvedSharedClassLoader = false;
+ final RequiresInstanceClassLoading requiresInstanceClassLoading = type.getAnnotation(RequiresInstanceClassLoading.class);
+ if (requiresInstanceClassLoading.cloneAncestorResources()) {
+ // Check to see if there's already a shared ClassLoader that can be used as the parent/base classloader
+ if (baseClassLoaderKey != null) {
+ final ClassLoader sharedBaseClassloader = sharedBaseClassloaders.get(baseClassLoaderKey);
+ if (sharedBaseClassloader != null) {
+ resolvedSharedClassLoader = true;
+ ancestorClassLoader = sharedBaseClassloader;
+ logger.debug("Creating InstanceClassLoader for type {} using shared Base ClassLoader {} for component {}", type, sharedBaseClassloader, instanceIdentifier);
+ }
+ }
- final Set<URL> instanceUrls = new LinkedHashSet<>();
- final Set<File> narNativeLibDirs = new LinkedHashSet<>();
+ // If we didn't find a shared ClassLoader to use, go ahead and clone the bundle's ClassLoader.
+ if (!resolvedSharedClassLoader) {
+ final ConfigurableComponent component = getTempComponent(classType, bundle.getBundleDetails().getCoordinate());
+ final Set<BundleCoordinate> reachableApiBundles = findReachableApiBundles(component);
- narNativeLibDirs.add(narBundleClassLoader.getNARNativeLibDir());
- instanceUrls.addAll(Arrays.asList(narBundleClassLoader.getURLs()));
+ while (ancestorClassLoader instanceof NarClassLoader) {
+ final Bundle ancestorNarBundle = classLoaderBundleLookup.get(ancestorClassLoader);
- ClassLoader ancestorClassLoader = narBundleClassLoader.getParent();
+ // stop including ancestor resources when we reach one of the APIs, or when we hit the Jetty NAR
+ if (ancestorNarBundle == null || reachableApiBundles.contains(ancestorNarBundle.getBundleDetails().getCoordinate())
+ || ancestorNarBundle.getBundleDetails().getCoordinate().getId().equals(NarClassLoaders.JETTY_NAR_ID)) {
+ break;
+ }
- if (requiresInstanceClassLoading.cloneAncestorResources()) {
- final ConfigurableComponent component = getTempComponent(classType, bundle.getBundleDetails().getCoordinate());
- final Set<BundleCoordinate> reachableApiBundles = findReachableApiBundles(component);
+ final NarClassLoader ancestorNarClassLoader = (NarClassLoader) ancestorClassLoader;
- while (ancestorClassLoader instanceof NarClassLoader) {
- final Bundle ancestorNarBundle = classLoaderBundleLookup.get(ancestorClassLoader);
+ narNativeLibDirs.add(ancestorNarClassLoader.getNARNativeLibDir());
+ Collections.addAll(instanceUrls, ancestorNarClassLoader.getURLs());
- // stop including ancestor resources when we reach one of the APIs, or when we hit the Jetty NAR
- if (ancestorNarBundle == null || reachableApiBundles.contains(ancestorNarBundle.getBundleDetails().getCoordinate())
- || ancestorNarBundle.getBundleDetails().getCoordinate().getId().equals(NarClassLoaders.JETTY_NAR_ID)) {
- break;
+ ancestorClassLoader = ancestorNarClassLoader.getParent();
+ }
}
+ }
- final NarClassLoader ancestorNarClassLoader = (NarClassLoader) ancestorClassLoader;
-
- narNativeLibDirs.add(ancestorNarClassLoader.getNARNativeLibDir());
- Collections.addAll(instanceUrls, ancestorNarClassLoader.getURLs());
+ // register our new InstanceClassLoader as the shared base classloader.
+ if (baseClassLoaderKey != null && !resolvedSharedClassLoader) {
+ // Created a shared class loader that is everything we need except for the additional URLs, as the additional URLs are instance-specific.
+ final ClassLoader sharedClassLoader = new SharedInstanceClassLoader(instanceIdentifier, classType, instanceUrls, Collections.emptySet(), narNativeLibDirs, ancestorClassLoader);
+ instanceClassLoader = new InstanceClassLoader(instanceIdentifier, classType, Collections.emptySet(), additionalUrls, Collections.emptySet(), sharedClassLoader);
- ancestorClassLoader = ancestorNarClassLoader.getParent();
+ logger.debug("Creating InstanceClassLoader for type {} using newly created shared Base ClassLoader {} for component {}", type, instanceClassLoader, instanceIdentifier);
+ sharedBaseClassloaders.putIfAbsent(baseClassLoaderKey, sharedClassLoader);
+ } else {
+ instanceClassLoader = new InstanceClassLoader(instanceIdentifier, classType, instanceUrls, additionalUrls, narNativeLibDirs, ancestorClassLoader);
Review comment:
I think this may need to be split into a third case...
Right now when creating a component that has an existing isolation key, it will hit this else case and create the `InstanceClassLoader` with `instanceUrls` which has the current NAR's resources, but in this case those resources are already in the `SharedInstanceClassLoader.`
In the specific example of HDFS processors, the `SharedInstanceClassLoader` has `nifi-hadoop-nar` + `nifi-hadoop-libraries-nar`, and then the next processor that uses this same `SharedInstanceClassLoader` also gets `nifi-hadoop-nar` resources in its `InstanceClassLoader`.
##########
File path: nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-framework-nar-utils/src/main/java/org/apache/nifi/nar/StandardExtensionDiscoveringManager.java
##########
@@ -383,42 +388,69 @@ public InstanceClassLoader createInstanceClassLoader(final String classType, fin
final ConfigurableComponent tempComponent = getTempComponent(classType, bundle.getBundleDetails().getCoordinate());
final Class<?> type = tempComponent.getClass();
- final RequiresInstanceClassLoading requiresInstanceClassLoading = type.getAnnotation(RequiresInstanceClassLoading.class);
-
- final NarClassLoader narBundleClassLoader = (NarClassLoader) bundleClassLoader;
- logger.debug("Including ClassLoader resources from {} for component {}", new Object[] {bundle.getBundleDetails(), instanceIdentifier});
+ final boolean allowsSharedClassloader = tempComponent instanceof ClassloaderIsolationKeyProvider;
+ if (allowsSharedClassloader && classloaderIsolationKey == null) {
+ instanceClassLoader = new InstanceClassLoader(instanceIdentifier, classType, Collections.emptySet(), additionalUrls, bundleClassLoader);
+ } else {
+ final BaseClassLoaderKey baseClassLoaderKey = classloaderIsolationKey == null ? null : new BaseClassLoaderKey(bundle, classloaderIsolationKey);
+ final NarClassLoader narBundleClassLoader = (NarClassLoader) bundleClassLoader;
+ logger.debug("Including ClassLoader resources from {} for component {}", new Object[]{bundle.getBundleDetails(), instanceIdentifier});
+
+ final Set<URL> instanceUrls = new LinkedHashSet<>(Arrays.asList(narBundleClassLoader.getURLs()));
+ final Set<File> narNativeLibDirs = new LinkedHashSet<>();
+ narNativeLibDirs.add(narBundleClassLoader.getNARNativeLibDir());
+
+ ClassLoader ancestorClassLoader = narBundleClassLoader.getParent();
+
+ boolean resolvedSharedClassLoader = false;
+ final RequiresInstanceClassLoading requiresInstanceClassLoading = type.getAnnotation(RequiresInstanceClassLoading.class);
+ if (requiresInstanceClassLoading.cloneAncestorResources()) {
+ // Check to see if there's already a shared ClassLoader that can be used as the parent/base classloader
+ if (baseClassLoaderKey != null) {
+ final ClassLoader sharedBaseClassloader = sharedBaseClassloaders.get(baseClassLoaderKey);
+ if (sharedBaseClassloader != null) {
+ resolvedSharedClassLoader = true;
+ ancestorClassLoader = sharedBaseClassloader;
+ logger.debug("Creating InstanceClassLoader for type {} using shared Base ClassLoader {} for component {}", type, sharedBaseClassloader, instanceIdentifier);
+ }
+ }
- final Set<URL> instanceUrls = new LinkedHashSet<>();
- final Set<File> narNativeLibDirs = new LinkedHashSet<>();
+ // If we didn't find a shared ClassLoader to use, go ahead and clone the bundle's ClassLoader.
+ if (!resolvedSharedClassLoader) {
+ final ConfigurableComponent component = getTempComponent(classType, bundle.getBundleDetails().getCoordinate());
+ final Set<BundleCoordinate> reachableApiBundles = findReachableApiBundles(component);
- narNativeLibDirs.add(narBundleClassLoader.getNARNativeLibDir());
- instanceUrls.addAll(Arrays.asList(narBundleClassLoader.getURLs()));
+ while (ancestorClassLoader instanceof NarClassLoader) {
+ final Bundle ancestorNarBundle = classLoaderBundleLookup.get(ancestorClassLoader);
- ClassLoader ancestorClassLoader = narBundleClassLoader.getParent();
+ // stop including ancestor resources when we reach one of the APIs, or when we hit the Jetty NAR
+ if (ancestorNarBundle == null || reachableApiBundles.contains(ancestorNarBundle.getBundleDetails().getCoordinate())
+ || ancestorNarBundle.getBundleDetails().getCoordinate().getId().equals(NarClassLoaders.JETTY_NAR_ID)) {
+ break;
+ }
- if (requiresInstanceClassLoading.cloneAncestorResources()) {
- final ConfigurableComponent component = getTempComponent(classType, bundle.getBundleDetails().getCoordinate());
- final Set<BundleCoordinate> reachableApiBundles = findReachableApiBundles(component);
+ final NarClassLoader ancestorNarClassLoader = (NarClassLoader) ancestorClassLoader;
- while (ancestorClassLoader instanceof NarClassLoader) {
- final Bundle ancestorNarBundle = classLoaderBundleLookup.get(ancestorClassLoader);
+ narNativeLibDirs.add(ancestorNarClassLoader.getNARNativeLibDir());
+ Collections.addAll(instanceUrls, ancestorNarClassLoader.getURLs());
- // stop including ancestor resources when we reach one of the APIs, or when we hit the Jetty NAR
- if (ancestorNarBundle == null || reachableApiBundles.contains(ancestorNarBundle.getBundleDetails().getCoordinate())
- || ancestorNarBundle.getBundleDetails().getCoordinate().getId().equals(NarClassLoaders.JETTY_NAR_ID)) {
- break;
+ ancestorClassLoader = ancestorNarClassLoader.getParent();
+ }
}
+ }
- final NarClassLoader ancestorNarClassLoader = (NarClassLoader) ancestorClassLoader;
-
- narNativeLibDirs.add(ancestorNarClassLoader.getNARNativeLibDir());
- Collections.addAll(instanceUrls, ancestorNarClassLoader.getURLs());
+ // register our new InstanceClassLoader as the shared base classloader.
+ if (baseClassLoaderKey != null && !resolvedSharedClassLoader) {
+ // Created a shared class loader that is everything we need except for the additional URLs, as the additional URLs are instance-specific.
+ final ClassLoader sharedClassLoader = new SharedInstanceClassLoader(instanceIdentifier, classType, instanceUrls, Collections.emptySet(), narNativeLibDirs, ancestorClassLoader);
+ instanceClassLoader = new InstanceClassLoader(instanceIdentifier, classType, Collections.emptySet(), additionalUrls, Collections.emptySet(), sharedClassLoader);
- ancestorClassLoader = ancestorNarClassLoader.getParent();
+ logger.debug("Creating InstanceClassLoader for type {} using newly created shared Base ClassLoader {} for component {}", type, instanceClassLoader, instanceIdentifier);
+ sharedBaseClassloaders.putIfAbsent(baseClassLoaderKey, sharedClassLoader);
Review comment:
Can we add logging that prints the resources of the shared class loader here? Something like...
```
if (logger.isTraceEnabled()) {
for (URL url : ((SharedInstanceClassLoader)sharedClassLoader).getURLs()) {
logger.trace("Shared Base ClassLoader URL resource: {}", new Object[] {url.toExternalForm()});
}
}
```
We have similar logging at the end of this method for the InstanceClassLoader, which previously was helpful to debug and see all the resources that got combined, but now all of the resources can end up in the SharedInstanceClassLoader.
##########
File path: nifi-commons/nifi-security-kerberos/src/main/java/org/apache/nifi/security/krb/ReentrantKerberosUser.java
##########
@@ -0,0 +1,95 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.nifi.security.krb;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.security.auth.login.AppConfigurationEntry;
+import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+
+public class ReentrantKerberosUser implements KerberosUser {
+ private static final Logger logger = LoggerFactory.getLogger(ReentrantKerberosUser.class);
+
+ private final KerberosUser delegate;
+ private long loginCount = 0L;
Review comment:
I'm not sure this is working the way we think... each instance of an HDFS processor is going to create its own instance of ReentrantKerberosUser. If we have 2 PutHDFS processors, then we have 2 ReentrantKerberosUser instances, each logs in and separately increments loginCount to 1. Then stop one of the processors and it will decrement the count for just that instance to 0 and then logout.
I'm not really sure yet if this on it's own causes any problems, but a bigger problem is that in `onUnscheduled` of `AbstractHadoopProcessor`, besides calling logout on the `KerberosUser`, we also clear some static state:
```
// Clean-up the static reference to the Configuration instance
UserGroupInformation.setConfiguration(new Configuration());
// Clean-up the reference to the InstanceClassLoader that was put into Configuration
final Configuration configuration = resources.getConfiguration();
if (configuration != null) {
configuration.setClassLoader(null);
}
// Need to remove the Provider instance from the JVM's Providers class so that InstanceClassLoader can be GC'd eventually
final SaslPlainServer.SecurityProvider saslProvider = new SaslPlainServer.SecurityProvider();
Security.removeProvider(saslProvider.getName());
```
The above classes are now shared by multiple processors, so if you have two PutHDFS processors with the same principal and stop one of them, the other starts failing....
```
2021-11-18 16:28:17,476 ERROR [Timer-Driven Process Thread-6] o.apache.nifi.processors.hadoop.PutHDFS PutHDFS[id=34b42c62-017d-1000-5630-184049585bdb] Failed to access HDFS due to org.apache.hadoop.security.AccessControlException: org.apache.hadoop.security.AccessControlException: SIMPLE authentication is not enabled. Available:[TOKEN, KERBEROS]: org.apache.hadoop.ipc.RemoteException(org.apache.hadoop.security.AccessControlException): org.apache.hadoop.security.AccessControlException: SIMPLE authentication is not enabled. Available:[TOKEN, KERBEROS]
↳ causes: org.apache.hadoop.security.AccessControlException: org.apache.hadoop.security.AccessControlException: SIMPLE authentication is not enabled. Available:[TOKEN, KERBEROS]
org.apache.hadoop.security.AccessControlException: org.apache.hadoop.security.AccessControlException: SIMPLE authentication is not enabled. Available:[TOKEN, KERBEROS]
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at org.apache.hadoop.ipc.RemoteException.instantiateException(RemoteException.java:121)
at org.apache.hadoop.ipc.RemoteException.unwrapRemoteException(RemoteException.java:88)
at org.apache.hadoop.hdfs.DFSClient.getFileInfo(DFSClient.java:1733)
at org.apache.hadoop.hdfs.DistributedFileSystem$29.doCall(DistributedFileSystem.java:1725)
at org.apache.hadoop.hdfs.DistributedFileSystem$29.doCall(DistributedFileSystem.java:1722)
at org.apache.hadoop.fs.FileSystemLinkResolver.resolve(FileSystemLinkResolver.java:81)
at org.apache.hadoop.hdfs.DistributedFileSystem.getFileStatus(DistributedFileSystem.java:1737)
at org.apache.nifi.processors.hadoop.PutHDFS$1.run(PutHDFS.java:327)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAs(Subject.java:360)
at org.apache.hadoop.security.UserGroupInformation.doAs(UserGroupInformation.java:1822)
at org.apache.nifi.processors.hadoop.PutHDFS.onTrigger(PutHDFS.java:297)
at org.apache.nifi.processor.AbstractProcessor.onTrigger(AbstractProcessor.java:27)
at org.apache.nifi.controller.StandardProcessorNode.onTrigger(StandardProcessorNode.java:1273)
at org.apache.nifi.controller.tasks.ConnectableTask.invoke(ConnectableTask.java:214)
at org.apache.nifi.controller.scheduling.TimerDrivenSchedulingAgent$1.run(TimerDrivenSchedulingAgent.java:103)
at org.apache.nifi.engine.FlowEngine$2.run(FlowEngine.java:110)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: org.apache.hadoop.ipc.RemoteException: org.apache.hadoop.security.AccessControlException: SIMPLE authentication is not enabled. Available:[TOKEN, KERBEROS]
at org.apache.hadoop.ipc.Client.getRpcResponse(Client.java:1562)
at org.apache.hadoop.ipc.Client.call(Client.java:1508)
at org.apache.hadoop.ipc.Client.call(Client.java:1405)
at org.apache.hadoop.ipc.ProtobufRpcEngine2$Invoker.invoke(ProtobufRpcEngine2.java:234)
at org.apache.hadoop.ipc.ProtobufRpcEngine2$Invoker.invoke(ProtobufRpcEngine2.java:119)
at com.sun.proxy.$Proxy168.getFileInfo(Unknown Source)
at org.apache.hadoop.hdfs.protocolPB.ClientNamenodeProtocolTranslatorPB.getFileInfo(ClientNamenodeProtocolTranslatorPB.java:964)
at sun.reflect.GeneratedMethodAccessor284.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.hadoop.io.retry.RetryInvocationHandler.invokeMethod(RetryInvocationHandler.java:422)
at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeMethod(RetryInvocationHandler.java:165)
at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invoke(RetryInvocationHandler.java:157)
at org.apache.hadoop.io.retry.RetryInvocationHandler$Call.invokeOnce(RetryInvocationHandler.java:95)
at org.apache.hadoop.io.retry.RetryInvocationHandler.invoke(RetryInvocationHandler.java:359)
at com.sun.proxy.$Proxy169.getFileInfo(Unknown Source)
at org.apache.hadoop.hdfs.DFSClient.getFileInfo(DFSClient.java:1731)
... 21 common frames omitted
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org