[Impala-ASF-CR] IMPALA-5355: Fix the order of Sentry roles and privileges

["Alex Behm (Code Review)" <ge...@cloudera.org>]

Alex Behm has posted comments on this change.

Change subject: IMPALA-5355: Fix the order of Sentry roles and privileges
......................................................................


Patch Set 1:

(1 comment)

http://gerrit.cloudera.org:8080/#/c/7004/1/fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java
File fe/src/main/java/org/apache/impala/catalog/CatalogServiceCatalog.java:

Line 1214:   public Role removeRoleGrantGroup(String roleName, String groupName)
This approach looks correct, but I wonder if we should instead solve the dependency issue in ImpaladCatalog.updateCatalog(). We have a two-level hierarchy, so we could do a first pass over the updates to separate them into two lists. Then we apply the 'parent' list first, followed by the 'child' list.

The alternative approach has the following benefits:
- It deals with all objects in a consistent way, whereas the current approach is a one-off only for the roles/privileges which would definitely not work for the equivalent problem on dbs/tables (today we are saved by not having an ALTER DATABASE).
- It moves the additional work out of the 'critical' path where the catalogLock_ is held.
- It avoids unnecessarily updating and sending all (unchanged) privileges again.


-- 
To view, visit http://gerrit.cloudera.org:8080/7004
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings

Gerrit-MessageType: comment
Gerrit-Change-Id: I7072e95b74952ce5a51ea1b6e2ae3e80fb0940e0
Gerrit-PatchSet: 1
Gerrit-Project: Impala-ASF
Gerrit-Branch: master
Gerrit-Owner: Taras Bobrovytsky <tb...@cloudera.com>
Gerrit-Reviewer: Alex Behm <al...@cloudera.com>
Gerrit-Reviewer: Dimitris Tsirogiannis <dt...@cloudera.com>
Gerrit-HasComments: Yes