You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dolphinscheduler.apache.org by GitBox <gi...@apache.org> on 2023/01/13 15:12:34 UTC
[GitHub] [dolphinscheduler] Radeity opened a new issue, #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Radeity opened a new issue, #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395
### Search before asking
- [X] I had searched in the [issues](https://github.com/apache/dolphinscheduler/issues?q=is%3Aissue) and found no similar feature requirement.
### Description
We have refactored resource center https://github.com/apache/dolphinscheduler/pull/12076 in which remove the resource table. Also, change the resource permission authority from `user granularity` to `tenant granularity`.
However, authorize resource in user management is `user granularity`, which should be removed, cuz it will not pass the user tenant check in `isUserTenantValid`. In a word, two things we can do:
- Support authorize resources in tenant management.
- Provide a script to migrate outdated resources to new resource path of admin's corresponding tenant.
<br>
Welcome to discuss about how to ensure a smooth transition.
### Are you willing to submit a PR?
- [X] Yes I am willing to submit a PR!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] github-actions[bot] closed issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
URL: https://github.com/apache/dolphinscheduler/issues/13395
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] Radeity commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by "Radeity (via GitHub)" <gi...@apache.org>.
Radeity commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1407389238
>
> Hi @SbloodyS, after further consideration, i think it's inappropriate to support authorize resources in tenant management, for following reasons:
>
> * Resource binds with tenant by `fullName`, which means after creating resource, it belongs to a specific tenant.
> * It doesn't exist the conception of `authorization` any more. One resource can only belong to one tenant.
>
> Thus, i will make other **changes** when log in as ADMIN:
>
> * First, remove resources authorization in user management.
> * Second, support data migration in resource management, admin can choose the destination tenant, then it simply copies datas from `baseDir` of one tenant to another.
>
> <img alt="image" width="1432" src="https://user-images.githubusercontent.com/45198818/213612902-084fdb8b-2508-49fd-a0d0-88c6f0fa9625.png">
>
> * Third, admin can see all resources from deprecated resource table and resources belong to all tenants. **HOWEVER**, `t_ds_relation_resources_user` and `t_ds_relation_udfs_user` will no longer in use, users have to migrate old resources to new tenant for using them. About this point, we may have to send a email to notify all users.
>
>
> Keep the old resources and remove old authority, it's a more smooth transition. If you agree with that, i'll work on this from now on.
Hi, @SbloodyS , what do you think of this proposal?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] Radeity commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by "Radeity (via GitHub)" <gi...@apache.org>.
Radeity commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1415032870
H, @zhongjiajie, do we have to discuss more about migrate way? If use symlink or other mapper ways, we should consider tenant isolation, there's no problem with only read, but one tenant write resource, is should keep unchanged in other tenants' view. Maintain different resource version may help, cons are its complexity, and we have to design it carefully. Any suggestion are welcome!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] github-actions[bot] commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1455263445
This issue has been automatically marked as stale because it has not had recent activity for 30 days. It will be closed in next 7 days if no further activity occurs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] Radeity commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by "Radeity (via GitHub)" <gi...@apache.org>.
Radeity commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1409895234
> As for the third point, I think we can provide a one-time upgrade tool for users to migrate existing permissions in `t_ds_relation_resources_user` and `t_ds_relation_udfs_user` to the new tenant.
Hi, @SbloodyS, good suggestion! Like our schema update tool, one-time tool is more convenient, one thing i want to make sure, do we have to provide an interactive script in which user can assign the target tenant for each resource, or just move old resources to one tenant together? I prefer the latter way, WDYT.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] SbloodyS commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1409843247
Sorry for late reply.
I'm totally agree with you. As for the third point, I think we can provide a one-time upgrade tool for users to migrate existing permissions in `t_ds_relation_resources_user` and `t_ds_relation_udfs_user` to the new tenant. So that greatly reduces the complexity of upgrading for users. WDYT? @Radeity
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] Radeity commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by GitBox <gi...@apache.org>.
Radeity commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1382000820
cc @SbloodyS @EricPyZhou
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] SbloodyS commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1409897173
> Hi, @SbloodyS, good suggestion! Like our schema update tool, one-time tool is more convenient, one thing i want to make sure, do we have to provide an interactive script in which user can assign the target tenant for each resource, or just move old resources to one tenant together? I prefer the latter way, WDYT.
The latter way sounds good to me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] github-actions[bot] commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1467158040
This issue has been closed because it has not received response for too long time. You could reopen it if you encountered similar problems in the future.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] Radeity commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by "Radeity (via GitHub)" <gi...@apache.org>.
Radeity commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1409906582
> The latter way sounds good to me.
Thanks, i'll work on this. Also, after doing this, i'll create another pr to totally remove outdated codes in resource center, cuz when user upgrade to the new version and follow the upgrade doc to execute the script, deprecated logic will never be in used.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] SbloodyS commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by GitBox <gi...@apache.org>.
SbloodyS commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1383607316
> cc @SbloodyS @EricPyZhou
Good catch! 👍🏻
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] github-actions[bot] commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by GitBox <gi...@apache.org>.
github-actions[bot] commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1382000387
Thank you for your feedback, we have received your issue, Please wait patiently for a reply.
* In order for us to understand your request as soon as possible, please provide detailed information、version or pictures.
* If you haven't received a reply for a long time, you can [join our slack](https://s.apache.org/dolphinscheduler-slack) and send your question to channel `#troubleshooting`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [dolphinscheduler] Radeity commented on issue #13395: [Improvement][Resource Center] Remove permission management of resource in user management
Posted by GitBox <gi...@apache.org>.
Radeity commented on issue #13395:
URL: https://github.com/apache/dolphinscheduler/issues/13395#issuecomment-1397894540
> > cc @SbloodyS @EricPyZhou
>
> Good catch! 👍🏻
Hi @SbloodyS, after further consideration, i think it's inappropriate to support authorize resources in tenant management, for following reasons:
- Resource binds with tenant by `fullName`, which means after creating resource, it belongs to a specific tenant.
- It doesn't exist the conception of `authorization` any more. One resource can only belong to one tenant.
Thus, i will make other **changes** when log in as ADMIN:
- First, remove resources authorization in user management.
- Second, support data migration in resource management, admin can choose the destination tenant, then it simply copies datas from `baseDir` of one tenant to another.
<img width="1432" alt="image" src="https://user-images.githubusercontent.com/45198818/213612902-084fdb8b-2508-49fd-a0d0-88c6f0fa9625.png">
- Third, admin can see all resources from deprecated resource table and resources belong to all tenants. **HOWEVER**, `t_ds_relation_resources_user` and `t_ds_relation_udfs_user` will no longer in use, users have to migrate old resources to new tenant for using them. About this point, we may have to send a email to notify all users.
<br>
Keep the old resources and remove old authority, it's a more smooth transition. If you agree with that, i'll work on this from now on.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org