You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kyuubi.apache.org by ch...@apache.org on 2026/07/21 03:32:29 UTC
(kyuubi) branch branch-1.12 updated (4e37820385 -> 988e323c8e)
This is an automated email from the ASF dual-hosted git repository.
pan3793 pushed a change to branch branch-1.12
in repository https://gitbox.apache.org/repos/asf/kyuubi.git
discard 4e37820385 [KYUUBI #2470][AUTHZ] Add Ranger performance tracing to rule authorization
new 988e323c8e [KYUUBI #2470][AUTHZ] Add Ranger performance tracing to rule authorization
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (4e37820385)
\
N -- N -- N refs/heads/branch-1.12 (988e323c8e)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
(kyuubi) 01/01: [KYUUBI #2470][AUTHZ] Add Ranger performance tracing to rule authorization
Posted by ch...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
pan3793 pushed a commit to branch branch-1.12
in repository https://gitbox.apache.org/repos/asf/kyuubi.git
commit 988e323c8e5abcff6e14878dcef7ea322155ad8d
Author: hutiefang <hu...@qq.com>
AuthorDate: Tue Jul 21 11:16:10 2026 +0800
[KYUUBI #2470][AUTHZ] Add Ranger performance tracing to rule authorization
### Why are the changes needed?
Closes #2470.
`RuleAuthorization.checkPrivileges` currently has no Ranger performance trace around privilege-request construction and evaluation. This adds the established `sparkauth.request` tracer around the complete authorization path and logs it from `finally`, so both successful checks and exceptions finish the timing record without changing authorization results.
### How was this patch tested?
- `JAVA_HOME=$(/usr/libexec/java_home -v 17) ./dev/reformat`
- `JAVA_HOME=$(/usr/libexec/java_home -v 17) ./build/mvn -pl extensions/spark/kyuubi-spark-authz -am -DwildcardSuites=org.apache.kyuubi.plugin.spark.authz.ranger.InMemoryCatalogRangerSparkExtensionSuite -DskipITs test`
- 16 tests passed, including a new assertion that captures the performance trace on both successful and denied authorization paths.
- `git diff --check`
### Was this patch authored or co-authored using generative AI tooling?
Assisted-by: OpenAI Codex with GPT-5
Closes #7555 from hutiefang76/codex/kyuubi-2470-ranger-perf-tracer.
Closes #2470
35aa3ecd9 [Cheng Pan] restore
1f4dffcbb [Cheng Pan] DataSourceV2RelationTableExtractorSuite extends KyuubiFunSuite
d2ac06ffe [Cheng Pan] fix PaimonCatalogRangerSparkExtensionSuite
d4c6f6854 [Cheng Pan] flip assume and super.beforeEach()
a0379aa74 [Cheng Pan] codestyle
8333cc478 [Cheng Pan] codestyle
356a24d43 [Cheng Pan] restore test hierarchy
ce04403e7 [hutiefang] [KYUUBI #2470][AUTHZ] Add Ranger performance tracing to rule authorization
Lead-authored-by: hutiefang <hu...@qq.com>
Co-authored-by: Cheng Pan <ch...@apache.org>
Signed-off-by: Cheng Pan <ch...@apache.org>
---
extensions/spark/kyuubi-spark-authz/pom.xml | 8 ++
.../spark/authz/ranger/RuleAuthorization.scala | 96 +++++++++++++---------
.../spark/authz/gen/PolicyJsonFileGenerator.scala | 6 +-
.../authz/FunctionPrivilegesBuilderSuite.scala | 8 +-
.../IcebergCatalogPrivilegesBuilderSuite.scala | 6 --
.../spark/authz/PrivilegesBuilderSuite.scala | 8 +-
.../V2JdbcTableCatalogPrivilegesBuilderSuite.scala | 6 --
.../authz/gen/CheckAuthzExtractorSPISuite.scala | 7 +-
.../spark/authz/gen/JsonSpecFileGenerator.scala | 7 +-
.../spark/authz/ranger/AccessResourceSuite.scala | 7 +-
.../authz/ranger/AuthzSessionSigningSuite.scala | 8 +-
.../DeltaCatalogRangerSparkExtensionSuite.scala | 6 --
.../IcebergCatalogRangerSparkExtensionSuite.scala | 5 --
.../PaimonCatalogRangerSparkExtensionSuite.scala | 9 +-
.../authz/ranger/RangerSparkExtensionSuite.scala | 36 ++++++--
.../authz/ranger/SparkRangerAdminPluginSuite.scala | 6 +-
.../datamasking/DataMaskingForIcebergSuite.scala | 4 -
.../datamasking/DataMaskingForJDBCV2Suite.scala | 4 -
.../ranger/datamasking/DataMaskingTestBase.scala | 7 +-
.../rowfiltering/RowFilteringForIcebergSuite.scala | 4 -
.../rowfiltering/RowFilteringForJDBCV2Suite.scala | 4 -
.../ranger/rowfiltering/RowFilteringTestBase.scala | 7 +-
.../rule/AuthzConfigurationCheckerSuite.scala | 12 +--
.../DataSourceV2RelationTableExtractorSuite.scala | 8 +-
.../spark/sql/RuleAuthorizationBenchmark.scala | 8 +-
25 files changed, 127 insertions(+), 160 deletions(-)
diff --git a/extensions/spark/kyuubi-spark-authz/pom.xml b/extensions/spark/kyuubi-spark-authz/pom.xml
index 5fd27d9714..9e311642dd 100644
--- a/extensions/spark/kyuubi-spark-authz/pom.xml
+++ b/extensions/spark/kyuubi-spark-authz/pom.xml
@@ -306,6 +306,14 @@
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.kyuubi</groupId>
+ <artifactId>kyuubi-common_${scala.binary.version}</artifactId>
+ <version>${project.version}</version>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
+
<dependency>
<groupId>org.apache.spark</groupId>
<artifactId>spark-hive_${scala.binary.version}</artifactId>
diff --git a/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RuleAuthorization.scala b/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RuleAuthorization.scala
index 1fd86a3789..676d12cf11 100644
--- a/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RuleAuthorization.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/main/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RuleAuthorization.scala
@@ -20,6 +20,7 @@ package org.apache.kyuubi.plugin.spark.authz.ranger
import scala.collection.mutable
import org.apache.ranger.plugin.policyengine.RangerAccessRequest
+import org.apache.ranger.plugin.util.RangerPerfTracer
import org.apache.spark.sql.SparkSession
import org.apache.spark.sql.catalyst.plans.logical.LogicalPlan
@@ -31,55 +32,70 @@ import org.apache.kyuubi.plugin.spark.authz.rule.Authorization
import org.apache.kyuubi.plugin.spark.authz.util.AuthZUtils._
case class RuleAuthorization(spark: SparkSession) extends Authorization(spark) {
+ private val PERF_SPARKAUTH_REQUEST_LOG =
+ RangerPerfTracer.getPerfLogger("sparkauth.request")
+
override def checkPrivileges(spark: SparkSession, plan: LogicalPlan): Unit = {
- val auditHandler = new SparkRangerAuditHandler
- val ugi = getAuthzUgi(spark.sparkContext)
- val (inputs, outputs, opType) = PrivilegesBuilder.build(plan, spark)
+ val perf = if (RangerPerfTracer.isPerfTraceEnabled(PERF_SPARKAUTH_REQUEST_LOG)) {
+ RangerPerfTracer.getPerfTracer(
+ PERF_SPARKAUTH_REQUEST_LOG,
+ "RuleAuthorization.checkPrivileges()")
+ } else {
+ null
+ }
- // Use a HashSet to deduplicate the same AccessResource and AccessType, the requests will be all
- // the non-duplicate requests and in the same order as the input requests.
- val requests = new mutable.ArrayBuffer[AccessRequest]()
- val requestsSet = new mutable.HashSet[(AccessResource, AccessType)]()
+ try {
+ val auditHandler = new SparkRangerAuditHandler
+ val ugi = getAuthzUgi(spark.sparkContext)
+ val (inputs, outputs, opType) = PrivilegesBuilder.build(plan, spark)
- def addAccessRequest(objects: Iterable[PrivilegeObject], isInput: Boolean): Unit = {
- objects.foreach { obj =>
- val resource = AccessResource(obj, opType)
- val accessType = ranger.AccessType(obj, opType, isInput)
- if (accessType != AccessType.NONE && !requestsSet.contains((resource, accessType))) {
- requests += AccessRequest(resource, ugi, opType, accessType)
- requestsSet.add(resource, accessType)
+ // Use a HashSet to deduplicate the same AccessResource and AccessType. The requests will be
+ // all the non-duplicate requests and in the same order as the input requests.
+ val requests = new mutable.ArrayBuffer[AccessRequest]()
+ val requestsSet = new mutable.HashSet[(AccessResource, AccessType)]()
+
+ def addAccessRequest(objects: Iterable[PrivilegeObject], isInput: Boolean): Unit = {
+ objects.foreach { obj =>
+ val resource = AccessResource(obj, opType)
+ val accessType = ranger.AccessType(obj, opType, isInput)
+ if (accessType != AccessType.NONE && !requestsSet.contains((resource, accessType))) {
+ requests += AccessRequest(resource, ugi, opType, accessType)
+ requestsSet.add(resource, accessType)
+ }
}
}
- }
- addAccessRequest(inputs, isInput = true)
- addAccessRequest(outputs, isInput = false)
+ addAccessRequest(inputs, isInput = true)
+ addAccessRequest(outputs, isInput = false)
- val requestArrays = requests.map { request =>
- val resource = request.getResource.asInstanceOf[AccessResource]
- resource.objectType match {
- case ObjectType.COLUMN if resource.getColumns.nonEmpty =>
- resource.getColumns.map { col =>
- val cr =
- AccessResource(
- COLUMN,
- resource.getDatabase,
- resource.getTable,
- col,
- Option(resource.getOwnerUser),
- resource.catalog)
- AccessRequest(cr, ugi, opType, request.accessType).asInstanceOf[RangerAccessRequest]
- }
- case _ => Seq(request)
- }
- }.toSeq
+ val requestArrays = requests.map { request =>
+ val resource = request.getResource.asInstanceOf[AccessResource]
+ resource.objectType match {
+ case ObjectType.COLUMN if resource.getColumns.nonEmpty =>
+ resource.getColumns.map { col =>
+ val cr =
+ AccessResource(
+ COLUMN,
+ resource.getDatabase,
+ resource.getTable,
+ col,
+ Option(resource.getOwnerUser),
+ resource.catalog)
+ AccessRequest(cr, ugi, opType, request.accessType).asInstanceOf[RangerAccessRequest]
+ }
+ case _ => Seq(request)
+ }
+ }.toSeq
- if (authorizeInSingleCall) {
- verify(requestArrays.flatten, auditHandler)
- } else {
- requestArrays.flatten.foreach { req =>
- verify(Seq(req), auditHandler)
+ if (authorizeInSingleCall) {
+ verify(requestArrays.flatten, auditHandler)
+ } else {
+ requestArrays.flatten.foreach { req =>
+ verify(Seq(req), auditHandler)
+ }
}
+ } finally {
+ RangerPerfTracer.log(perf)
}
}
}
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/gen/scala/org/apache/kyuubi/plugin/spark/authz/gen/PolicyJsonFileGenerator.scala b/extensions/spark/kyuubi-spark-authz/src/test/gen/scala/org/apache/kyuubi/plugin/spark/authz/gen/PolicyJsonFileGenerator.scala
index d259b202a5..a1f4b77e9e 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/gen/scala/org/apache/kyuubi/plugin/spark/authz/gen/PolicyJsonFileGenerator.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/gen/scala/org/apache/kyuubi/plugin/spark/authz/gen/PolicyJsonFileGenerator.scala
@@ -27,9 +27,8 @@ import com.fasterxml.jackson.databind.json.JsonMapper
import com.fasterxml.jackson.databind.node.ObjectNode
import com.fasterxml.jackson.module.scala.DefaultScalaModule
import org.apache.ranger.plugin.model.RangerPolicy
-// scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.plugin.spark.authz.RangerTestNamespace._
import org.apache.kyuubi.plugin.spark.authz.RangerTestUsers._
import org.apache.kyuubi.plugin.spark.authz.gen.KRangerPolicyItemAccess.allowTypes
@@ -52,8 +51,7 @@ import org.apache.kyuubi.util.GoldenFileUtils._
* dev/gen/gen_ranger_policy_json.sh
* }}}
*/
-class PolicyJsonFileGenerator extends AnyFunSuite {
- // scalastyle:on
+class PolicyJsonFileGenerator extends KyuubiFunSuite {
final private val mapper: ObjectMapper = JsonMapper.builder()
.addModule(DefaultScalaModule)
.serializationInclusion(Include.NON_NULL)
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/FunctionPrivilegesBuilderSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/FunctionPrivilegesBuilderSuite.scala
index 5d8a824b4f..5a50a5b870 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/FunctionPrivilegesBuilderSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/FunctionPrivilegesBuilderSuite.scala
@@ -18,16 +18,12 @@
package org.apache.kyuubi.plugin.spark.authz
import org.apache.spark.sql.catalyst.plans.logical.LogicalPlan
-import org.scalatest.{BeforeAndAfterAll, BeforeAndAfterEach}
-// scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.plugin.spark.authz.OperationType.QUERY
import org.apache.kyuubi.plugin.spark.authz.ranger.AccessType
-abstract class FunctionPrivilegesBuilderSuite extends AnyFunSuite
- with SparkSessionProvider with BeforeAndAfterAll with BeforeAndAfterEach {
- // scalastyle:on
+abstract class FunctionPrivilegesBuilderSuite extends KyuubiFunSuite with SparkSessionProvider {
protected def withTable(t: String)(f: String => Unit): Unit = {
try {
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/IcebergCatalogPrivilegesBuilderSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/IcebergCatalogPrivilegesBuilderSuite.scala
index b8d51bc2cc..a64431b226 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/IcebergCatalogPrivilegesBuilderSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/IcebergCatalogPrivilegesBuilderSuite.scala
@@ -17,8 +17,6 @@
package org.apache.kyuubi.plugin.spark.authz
-import org.scalatest.Outcome
-
import org.apache.kyuubi.Utils
import org.apache.kyuubi.plugin.spark.authz.OperationType._
import org.apache.kyuubi.plugin.spark.authz.ranger.AccessType
@@ -50,10 +48,6 @@ class IcebergCatalogPrivilegesBuilderSuite extends V2CommandsPrivilegesSuite {
super.beforeAll()
}
- override def withFixture(test: NoArgTest): Outcome = {
- test()
- }
-
test("DeleteFromIcebergTable") {
val plan = sql(s"DELETE FROM $catalogTable WHERE key = 1 ").queryExecution.analyzed
val (inputs, outputs, operationType) = PrivilegesBuilder.build(plan, spark)
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/PrivilegesBuilderSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/PrivilegesBuilderSuite.scala
index 64faa2bc15..1e90e9f4e0 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/PrivilegesBuilderSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/PrivilegesBuilderSuite.scala
@@ -25,10 +25,8 @@ import org.apache.spark.sql.catalyst.catalog.{CatalogStorageFormat, CatalogTable
import org.apache.spark.sql.catalyst.plans.logical.LogicalPlan
import org.apache.spark.sql.sources.{BaseRelation, InsertableRelation, SchemaRelationProvider}
import org.apache.spark.sql.types.{IntegerType, StringType, StructType}
-import org.scalatest.{BeforeAndAfterAll, BeforeAndAfterEach}
-// scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.plugin.spark.authz.OperationType._
import org.apache.kyuubi.plugin.spark.authz.RangerTestNamespace._
import org.apache.kyuubi.plugin.spark.authz.RangerTestUsers._
@@ -36,9 +34,7 @@ import org.apache.kyuubi.plugin.spark.authz.ranger.AccessType
import org.apache.kyuubi.plugin.spark.authz.util.AuthZUtils._
import org.apache.kyuubi.util.AssertionUtils._
-abstract class PrivilegesBuilderSuite extends AnyFunSuite
- with SparkSessionProvider with BeforeAndAfterAll with BeforeAndAfterEach {
-// scalastyle:on
+abstract class PrivilegesBuilderSuite extends KyuubiFunSuite with SparkSessionProvider {
protected def withTable(t: String)(f: String => Unit): Unit = {
try {
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/V2JdbcTableCatalogPrivilegesBuilderSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/V2JdbcTableCatalogPrivilegesBuilderSuite.scala
index 0ad11eb39a..37601d6ab5 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/V2JdbcTableCatalogPrivilegesBuilderSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/V2JdbcTableCatalogPrivilegesBuilderSuite.scala
@@ -20,8 +20,6 @@ import java.sql.DriverManager
import scala.util.Try
-import org.scalatest.Outcome
-
import org.apache.kyuubi.plugin.spark.authz.V2JdbcTableCatalogPrivilegesBuilderSuite._
import org.apache.kyuubi.plugin.spark.authz.serde._
import org.apache.kyuubi.plugin.spark.authz.util.AuthZUtils._
@@ -55,10 +53,6 @@ class V2JdbcTableCatalogPrivilegesBuilderSuite extends V2CommandsPrivilegesSuite
}
}
- override def withFixture(test: NoArgTest): Outcome = {
- test()
- }
-
test("Extracting table info with ResolvedDbObjectNameTableExtractor") {
val ns1 = "testns1"
val tbl = "testtbl"
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/gen/CheckAuthzExtractorSPISuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/gen/CheckAuthzExtractorSPISuite.scala
index 7a66e99eaf..8959a55a9e 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/gen/CheckAuthzExtractorSPISuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/gen/CheckAuthzExtractorSPISuite.scala
@@ -19,14 +19,11 @@ package org.apache.kyuubi.plugin.spark.authz.gen
import java.nio.file.Paths
-// scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
-
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.util.AssertionUtils._
import org.apache.kyuubi.util.GoldenFileUtils._
-class CheckAuthzExtractorSPISuite extends AnyFunSuite {
- // scalastyle:on
+class CheckAuthzExtractorSPISuite extends KyuubiFunSuite {
test("check authz extractor SPI service file sorted") {
Seq(
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/gen/JsonSpecFileGenerator.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/gen/JsonSpecFileGenerator.scala
index 4d76a8b18e..78ef4a31e4 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/gen/JsonSpecFileGenerator.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/gen/JsonSpecFileGenerator.scala
@@ -20,9 +20,7 @@ package org.apache.kyuubi.plugin.spark.authz.gen
import java.nio.charset.StandardCharsets
import java.nio.file.{Files, Paths, StandardOpenOption}
-//scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
-
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.plugin.spark.authz.serde.{mapper, CommandSpec}
import org.apache.kyuubi.plugin.spark.authz.serde.CommandSpecs
import org.apache.kyuubi.util.AssertionUtils._
@@ -41,8 +39,7 @@ import org.apache.kyuubi.util.GoldenFileUtils._
* dev/gen/gen_ranger_spec_json.sh
* }}}
*/
-class JsonSpecFileGenerator extends AnyFunSuite {
- // scalastyle:on
+class JsonSpecFileGenerator extends KyuubiFunSuite {
test("check spec json files") {
writeCommandSpecJson("database", Seq(DatabaseCommands))
writeCommandSpecJson(
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/AccessResourceSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/AccessResourceSuite.scala
index 4fb3df9d63..2de223faed 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/AccessResourceSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/AccessResourceSuite.scala
@@ -17,13 +17,10 @@
package org.apache.kyuubi.plugin.spark.authz.ranger
-// scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
-
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.plugin.spark.authz.ObjectType._
-class AccessResourceSuite extends AnyFunSuite {
-// scalastyle:on
+class AccessResourceSuite extends KyuubiFunSuite {
test("generate spark ranger resources") {
val resource = AccessResource(DATABASE, "my_db_name", None)
assert(resource.catalog.isEmpty)
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/AuthzSessionSigningSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/AuthzSessionSigningSuite.scala
index 080ec013f5..4eebce38d1 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/AuthzSessionSigningSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/AuthzSessionSigningSuite.scala
@@ -21,18 +21,14 @@ import java.util.Base64
import org.apache.spark.SparkConf
import org.apache.spark.sql.SparkSessionExtensions
-import org.scalatest.BeforeAndAfterAll
-// scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.config.KyuubiReservedKeys.{KYUUBI_SESSION_SIGN_PUBLICKEY, KYUUBI_SESSION_USER_KEY, KYUUBI_SESSION_USER_SIGN}
import org.apache.kyuubi.plugin.spark.authz.{AccessControlException, SparkSessionProvider}
import org.apache.kyuubi.plugin.spark.authz.util.AuthZUtils
import org.apache.kyuubi.util.SignUtils
-class AuthzSessionSigningSuite extends AnyFunSuite
- with SparkSessionProvider with BeforeAndAfterAll {
- // scalastyle:on
+class AuthzSessionSigningSuite extends KyuubiFunSuite with SparkSessionProvider {
override protected val extension: SparkSessionExtensions => Unit = new RangerSparkExtension
override protected val catalogImpl: String = "in-memory"
override protected val extraSparkConf: SparkConf = new SparkConf()
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/DeltaCatalogRangerSparkExtensionSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/DeltaCatalogRangerSparkExtensionSuite.scala
index 75af93c7c6..db5ad5d50a 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/DeltaCatalogRangerSparkExtensionSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/DeltaCatalogRangerSparkExtensionSuite.scala
@@ -18,8 +18,6 @@ package org.apache.kyuubi.plugin.spark.authz.ranger
import java.nio.file.Path
-import org.scalatest.Outcome
-
import org.apache.kyuubi.Utils
import org.apache.kyuubi.plugin.spark.authz.AccessControlException
import org.apache.kyuubi.plugin.spark.authz.RangerTestNamespace._
@@ -75,10 +73,6 @@ class DeltaCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite {
|${propString(props)}
|""".stripMargin
- override def withFixture(test: NoArgTest): Outcome = {
- test()
- }
-
override def beforeAll(): Unit = {
spark.conf.set(s"spark.sql.catalog.$sparkCatalog", deltaCatalogClassName)
spark.conf.set(
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/IcebergCatalogRangerSparkExtensionSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/IcebergCatalogRangerSparkExtensionSuite.scala
index b72e82c170..c4f99623a0 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/IcebergCatalogRangerSparkExtensionSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/IcebergCatalogRangerSparkExtensionSuite.scala
@@ -22,7 +22,6 @@ import java.text.SimpleDateFormat
import scala.util.Try
import org.apache.spark.sql.Row
-import org.scalatest.Outcome
import org.apache.kyuubi.Utils
// scalastyle:off
@@ -51,10 +50,6 @@ class IcebergCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite
val bobNamespace = "default_bob"
val bobSelectTable = "table_select_bob_1"
- override def withFixture(test: NoArgTest): Outcome = {
- test()
- }
-
override def beforeAll(): Unit = {
super.beforeAll()
spark.conf.set(
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/PaimonCatalogRangerSparkExtensionSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/PaimonCatalogRangerSparkExtensionSuite.scala
index 17b1010bfc..2cde070d03 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/PaimonCatalogRangerSparkExtensionSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/PaimonCatalogRangerSparkExtensionSuite.scala
@@ -16,7 +16,8 @@
*/
package org.apache.kyuubi.plugin.spark.authz.ranger
-import org.scalatest.Outcome
+import org.scalactic.source
+import org.scalatest.Tag
import org.apache.kyuubi.Utils
import org.apache.kyuubi.plugin.spark.authz.AccessControlException
@@ -41,9 +42,10 @@ class PaimonCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite {
val namespace1 = "paimon_ns"
val table1 = "table1"
- override def withFixture(test: NoArgTest): Outcome = {
+ override protected def test(testName: String, testTags: Tag*)(
+ testFun: => Any)(implicit pos: source.Position): Unit = {
assume(isSupportedVersion)
- test()
+ super.test(testName, testTags: _*)(testFun)(pos)
}
override def beforeAll(): Unit = {
@@ -60,7 +62,6 @@ class PaimonCatalogRangerSparkExtensionSuite extends RangerSparkExtensionSuite {
override def afterAll(): Unit = {
if (isSupportedVersion) {
doAs(admin, sql(s"DROP DATABASE IF EXISTS $catalogV2.$namespace1"))
-
super.afterAll()
spark.sessionState.catalog.reset()
spark.sessionState.conf.clear()
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala
index 7b10746fb3..c97d223754 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/RangerSparkExtensionSuite.scala
@@ -23,6 +23,7 @@ import java.nio.file.Path
import scala.util.Try
import org.apache.hadoop.security.UserGroupInformation
+import org.apache.logging.log4j.Level
import org.apache.spark.SparkConf
import org.apache.spark.sql.{DataFrame, Row, SparkSessionExtensions}
import org.apache.spark.sql.catalyst.analysis.NoSuchTableException
@@ -33,11 +34,8 @@ import org.apache.spark.sql.execution.columnar.InMemoryRelation
import org.apache.spark.sql.execution.datasources.LogicalRelation
import org.apache.spark.sql.functions.col
import org.apache.spark.sql.types.{IntegerType, StructField, StructType}
-import org.scalatest.BeforeAndAfterAll
-// scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
-import org.apache.kyuubi.Utils
+import org.apache.kyuubi.{KyuubiFunSuite, Utils}
import org.apache.kyuubi.plugin.lineage.Lineage
import org.apache.kyuubi.plugin.lineage.helper.SparkSQLLineageParseHelper
import org.apache.kyuubi.plugin.spark.authz.{AccessControlException, SparkSessionProvider}
@@ -49,9 +47,8 @@ import org.apache.kyuubi.plugin.spark.authz.util.AuthZUtils._
import org.apache.kyuubi.util.AssertionUtils._
import org.apache.kyuubi.util.reflect.ReflectUtils._
-abstract class RangerSparkExtensionSuite extends AnyFunSuite
- with SparkSessionProvider with BeforeAndAfterAll with MysqlContainerEnv {
- // scalastyle:on
+abstract class RangerSparkExtensionSuite extends KyuubiFunSuite
+ with SparkSessionProvider with MysqlContainerEnv {
override protected val extension: SparkSessionExtensions => Unit = new RangerSparkExtension
var mysqlJdbcUrl = ""
@@ -168,6 +165,31 @@ abstract class RangerSparkExtensionSuite extends AnyFunSuite
assert(logicalPlan.getTagValue(KYUUBI_AUTHZ_TAG).nonEmpty)
}
+ test("[KYUUBI #2470] RuleAuthorization: trace successful and failed privilege checks") {
+ def assertPrivilegeCheckTraced(f: => Unit): Unit = {
+ val appender = new LogAppender
+ appender.setThreshold(Level.DEBUG)
+ withLogAppender(
+ appender,
+ Seq("org.apache.ranger.perf.sparkauth.request"),
+ Some(Level.DEBUG)) {
+ f
+ assert(appender.loggingEvents.exists(
+ _.getMessage.getFormattedMessage.contains("RuleAuthorization.checkPrivileges()")))
+ }
+ }
+
+ val successPlan = spark.sessionState.sqlParser.parsePlan("SHOW TABLES")
+ assertPrivilegeCheckTraced {
+ doAs(admin, new RuleAuthorization(spark).apply(successPlan))
+ }
+
+ assertPrivilegeCheckTraced {
+ intercept[AccessControlException](
+ doAs(denyUser, sql("CREATE DATABASE kyuubi_2470")))
+ }
+ }
+
test("[KYUUBI #3226]: Another session should also check even if the plan is cached.") {
val testTable = "mytable"
val create =
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/SparkRangerAdminPluginSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/SparkRangerAdminPluginSuite.scala
index 301ae87c55..83ad3ba238 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/SparkRangerAdminPluginSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/SparkRangerAdminPluginSuite.scala
@@ -18,16 +18,14 @@
package org.apache.kyuubi.plugin.spark.authz.ranger
import org.apache.hadoop.security.UserGroupInformation
-// scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.plugin.spark.authz.{ObjectType, OperationType}
import org.apache.kyuubi.plugin.spark.authz.RangerTestNamespace._
import org.apache.kyuubi.plugin.spark.authz.RangerTestUsers._
import org.apache.kyuubi.plugin.spark.authz.ranger.SparkRangerAdminPlugin._
-class SparkRangerAdminPluginSuite extends AnyFunSuite {
-// scalastyle:on
+class SparkRangerAdminPluginSuite extends KyuubiFunSuite {
test("get filter expression") {
val bob = UserGroupInformation.createRemoteUser("bob")
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingForIcebergSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingForIcebergSuite.scala
index 6554e18352..ad583801fc 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingForIcebergSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingForIcebergSuite.scala
@@ -18,7 +18,6 @@
package org.apache.kyuubi.plugin.spark.authz.ranger.datamasking
import org.apache.spark.SparkConf
-import org.scalatest.Outcome
import org.apache.kyuubi.Utils
import org.apache.kyuubi.tags.IcebergTest
@@ -49,7 +48,4 @@ class DataMaskingForIcebergSuite extends DataMaskingTestBase {
super.afterAll()
}
- override def withFixture(test: NoArgTest): Outcome = {
- test()
- }
}
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingForJDBCV2Suite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingForJDBCV2Suite.scala
index ad1ead0b84..557150d7a0 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingForJDBCV2Suite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingForJDBCV2Suite.scala
@@ -21,7 +21,6 @@ import java.sql.DriverManager
import scala.util.Try
import org.apache.spark.SparkConf
-import org.scalatest.Outcome
import org.apache.kyuubi.plugin.spark.authz.V2JdbcTableCatalogPrivilegesBuilderSuite._
import org.apache.kyuubi.plugin.spark.authz.util.AuthZUtils._
@@ -53,7 +52,4 @@ class DataMaskingForJDBCV2Suite extends DataMaskingTestBase {
}
}
- override def withFixture(test: NoArgTest): Outcome = {
- test()
- }
}
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingTestBase.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingTestBase.scala
index 6303959a2e..529ccf51da 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingTestBase.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/datamasking/DataMaskingTestBase.scala
@@ -21,13 +21,11 @@ import java.sql.Timestamp
import scala.util.Try
-// scalastyle:off
import org.apache.commons.codec.digest.DigestUtils.md5Hex
import org.apache.spark.SparkConf
import org.apache.spark.sql.{Row, SparkSessionExtensions}
-import org.scalatest.BeforeAndAfterAll
-import org.scalatest.funsuite.AnyFunSuite
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.plugin.spark.authz.RangerTestUsers._
import org.apache.kyuubi.plugin.spark.authz.SparkSessionProvider
import org.apache.kyuubi.plugin.spark.authz.ranger.RangerSparkExtension
@@ -36,8 +34,7 @@ import org.apache.kyuubi.plugin.spark.authz.ranger.RangerSparkExtension
* Base trait for data masking tests, derivative classes shall name themselves following:
* DataMaskingFor CatalogImpl? FileFormat? Additions? Suite
*/
-trait DataMaskingTestBase extends AnyFunSuite with SparkSessionProvider with BeforeAndAfterAll {
-// scalastyle:on
+trait DataMaskingTestBase extends KyuubiFunSuite with SparkSessionProvider {
override protected val extension: SparkSessionExtensions => Unit = new RangerSparkExtension
// SPARK-44444 (Spark 4.0) enables ANSI SQL mode by default. Under ANSI mode,
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringForIcebergSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringForIcebergSuite.scala
index 002923ec3e..6c15c60e5b 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringForIcebergSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringForIcebergSuite.scala
@@ -18,7 +18,6 @@
package org.apache.kyuubi.plugin.spark.authz.ranger.rowfiltering
import org.apache.spark.SparkConf
-import org.scalatest.Outcome
import org.apache.kyuubi.Utils
import org.apache.kyuubi.tags.IcebergTest
@@ -49,7 +48,4 @@ class RowFilteringForIcebergSuite extends RowFilteringTestBase {
super.afterAll()
}
- override def withFixture(test: NoArgTest): Outcome = {
- test()
- }
}
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringForJDBCV2Suite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringForJDBCV2Suite.scala
index cec33c2935..1357f4a9e5 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringForJDBCV2Suite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringForJDBCV2Suite.scala
@@ -22,7 +22,6 @@ import java.sql.DriverManager
import scala.util.Try
import org.apache.spark.SparkConf
-import org.scalatest.Outcome
import org.apache.kyuubi.plugin.spark.authz.V2JdbcTableCatalogPrivilegesBuilderSuite._
import org.apache.kyuubi.plugin.spark.authz.util.AuthZUtils._
@@ -54,7 +53,4 @@ class RowFilteringForJDBCV2Suite extends RowFilteringTestBase {
}
}
- override def withFixture(test: NoArgTest): Outcome = {
- test()
- }
}
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringTestBase.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringTestBase.scala
index 3d0890d196..2c8ff0ad6e 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringTestBase.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/ranger/rowfiltering/RowFilteringTestBase.scala
@@ -17,13 +17,11 @@
package org.apache.kyuubi.plugin.spark.authz.ranger.rowfiltering
-// scalastyle:off
import scala.util.Try
import org.apache.spark.sql.{Row, SparkSessionExtensions}
-import org.scalatest.BeforeAndAfterAll
-import org.scalatest.funsuite.AnyFunSuite
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.plugin.spark.authz.RangerTestUsers._
import org.apache.kyuubi.plugin.spark.authz.SparkSessionProvider
import org.apache.kyuubi.plugin.spark.authz.ranger.RangerSparkExtension
@@ -32,8 +30,7 @@ import org.apache.kyuubi.plugin.spark.authz.ranger.RangerSparkExtension
* Base trait for row filtering tests, derivative classes shall name themselves following:
* RowFilteringFor CatalogImpl? FileFormat? Additions? Suite
*/
-trait RowFilteringTestBase extends AnyFunSuite with SparkSessionProvider with BeforeAndAfterAll {
-// scalastyle:on
+trait RowFilteringTestBase extends KyuubiFunSuite with SparkSessionProvider {
override protected val extension: SparkSessionExtensions => Unit = new RangerSparkExtension
private def setup(): Unit = {
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzConfigurationCheckerSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzConfigurationCheckerSuite.scala
index 647f1d5fd6..330c76f892 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzConfigurationCheckerSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/rule/AuthzConfigurationCheckerSuite.scala
@@ -17,16 +17,12 @@
package org.apache.kyuubi.plugin.spark.authz.rule
-import org.scalatest.BeforeAndAfterAll
-// scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
-
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.plugin.spark.authz.{AccessControlException, SparkSessionProvider}
import org.apache.kyuubi.plugin.spark.authz.ranger.RuleAuthorization
import org.apache.kyuubi.plugin.spark.authz.rule.config.AuthzConfigurationChecker
-class AuthzConfigurationCheckerSuite extends AnyFunSuite with SparkSessionProvider
- with BeforeAndAfterAll {
+class AuthzConfigurationCheckerSuite extends KyuubiFunSuite with SparkSessionProvider {
override protected val catalogImpl: String = "in-memory"
override def afterAll(): Unit = {
@@ -51,8 +47,8 @@ class AuthzConfigurationCheckerSuite extends AnyFunSuite with SparkSessionProvid
intercept[AccessControlException](extension.apply(p6))
val p7 = sql("set spark.sql.efg=hijk").queryExecution.analyzed
extension.apply(p7)
- val p8 = sql(
- s"set spark.sql.optimizer.excludedRules=${classOf[RuleAuthorization].getName}").queryExecution.analyzed
+ val p8 = sql(s"set spark.sql.optimizer.excludedRules=${classOf[RuleAuthorization].getName}")
+ .queryExecution.analyzed
intercept[AccessControlException](extension.apply(p8))
val p9 = sql(
"set spark.kyuubi.authz.skipCataloglessV2Relation.enabled=true").queryExecution.analyzed
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/serde/DataSourceV2RelationTableExtractorSuite.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/serde/DataSourceV2RelationTableExtractorSuite.scala
index 5575ffdfec..d6e2567a1a 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/serde/DataSourceV2RelationTableExtractorSuite.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/kyuubi/plugin/spark/authz/serde/DataSourceV2RelationTableExtractorSuite.scala
@@ -23,12 +23,10 @@ import org.apache.spark.sql.SparkSession
import org.apache.spark.sql.connector.catalog.{Identifier, Table => V2Table, TableCapability}
import org.apache.spark.sql.execution.datasources.v2.DataSourceV2Relation
import org.apache.spark.sql.types.{StringType, StructField, StructType}
-import org.scalatest.BeforeAndAfterAll
-// scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
-class DataSourceV2RelationTableExtractorSuite extends AnyFunSuite with BeforeAndAfterAll {
-// scalastyle:on
+import org.apache.kyuubi.KyuubiFunSuite
+
+class DataSourceV2RelationTableExtractorSuite extends KyuubiFunSuite {
private val skipConfKey = "spark.kyuubi.authz.skipCataloglessV2Relation.enabled"
diff --git a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/spark/sql/RuleAuthorizationBenchmark.scala b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/spark/sql/RuleAuthorizationBenchmark.scala
index 4286d2fca3..679768fea3 100644
--- a/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/spark/sql/RuleAuthorizationBenchmark.scala
+++ b/extensions/spark/kyuubi-spark-authz/src/test/scala/org/apache/spark/sql/RuleAuthorizationBenchmark.scala
@@ -26,10 +26,8 @@ import scala.concurrent.duration.Duration
import scala.reflect.io.Path.jfile2path
import org.apache.spark.benchmark.Benchmark
-import org.scalatest.BeforeAndAfterAll
-// scalastyle:off
-import org.scalatest.funsuite.AnyFunSuite
+import org.apache.kyuubi.KyuubiFunSuite
import org.apache.kyuubi.plugin.spark.authz.SparkSessionProvider
import org.apache.kyuubi.plugin.spark.authz.benchmark.KyuubiBenchmarkBase
import org.apache.kyuubi.plugin.spark.authz.ranger.RuleAuthorization
@@ -44,10 +42,8 @@ import org.apache.kyuubi.util.ThreadUtils
* -Dtest=none -DwildcardSuites=org.apache.spark.sql.RuleAuthorizationBenchmark
* }}}
*/
-class RuleAuthorizationBenchmark extends AnyFunSuite
- with SparkSessionProvider with BeforeAndAfterAll
+class RuleAuthorizationBenchmark extends KyuubiFunSuite with SparkSessionProvider
with KyuubiBenchmarkBase {
- // scalastyle:on
override protected val catalogImpl: String = "hive"
private val runBenchmark = sys.env.contains("RUN_BENCHMARK")